Question

What are the best practices to add sensitive data to the iOS application?
For sensitive data I mean a key or token to communicate with some external server.

Can we compile a certificate in the app, and iOS can remove it on installation?

I feel like we can not really 100% guarantee security of it, but what is the best practice layer we can add.

Answer 1

There is no mechanism that will ensure to a server that only your application is allowed to speak to it. So if that is your goal, then it is unsolvable. This has been talked to death on SO. Just a few:

• Secure Communication Between iPhone and Server?
• Store an encryption key in Keychain while application installation process
• Secure https encryption for iPhone app to webpage

(And the many other links within those postings.)

And elsewhere:

• Obfuscating Cocoa

You cannot authenticate devices or software. You can only authenticate users. That means a login. Without a login that is partially stored in the user’s brain (or at least in something separate from their iPhone), it’s just obfuscation.

Now, that doesn’t mean that obfuscation is useless. It isn’t. You can get some mileage out of a simple authentication token (like a client key), but don’t expect it to survive an attack. That doesn’t mean you shouldn’t do it; it just means you shouldn’t spend a lot of time/money on it since it will fail pretty fast.

In no cases should you implement something that ticks off paying customers. Read the several threads linked above (and the several threads linked from those threads). If after that, you still absolutely need a solution, then you’ll need to hire someone to keep track of the cracks and fix them every time a new one comes out. It will never stop.