Question

I’m building an iPhone app with in-app purchase. I’m using the “built-in” model where the additional content unlocks after the receipt is verified. I have the transaction working without issue… but what is the best way to save a record of the purchase on the user’s device?

Apple’s guide recommends using NSUserDefaults to store that information. The problem with this recommendation is that anyone with a free copy of iPhone Explorer can very easily go into the app, edit the plist, and unlock the full version without actually paying.

Can someone recommend a more secure solution?

Answer 1

Standard disclaimer: There’s no “real solution” here that will defeat all piracy– there are only varying degrees of difficulty in unlocking stuff for free. Current conventional wisdom: it might not be important to worry about the small number of people who know how to edit app plists.

Anyways:

1. You can store this data in (say) a file anywhere that’s persistent in your app’s filesystem. That’s anywhere under ~ except /tmp or /Library/Caches. You can use period-prefixed filenames that are generally hidden under trivial directory listings.
2. You could store it in the keychain in some format, which isn’t necessarily any more secure for what you’re doing, but is a fairly obfuscated place to keep a flag.
3. In either of the above cases, you could sign the flag with a key that’s embedded in your app’s binary. If I were going to this extent, I’d concatenate the device’s unique ID with the value of the flag (YES) or whatever other ID string you need, and then SHA-HMAC that with a 16byte key that you generate and keep obfuscated in your binary.

Most of this is probably overkill, see disclaimer at top. 🙂