Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

iOS Storing Login Info for Web 2.0 App

P

piazza31

macrumors newbie
Original poster
Jan 8, 2008
11
0
Hi,
I need to store user login info for a Web 2.0 service in my iPhone app. I wonder what's the safe and secure way to do it. I send login info encoded as specified in the service api, but what about the strings stored on the device? Do I need to adhere to some standard, keychain or other type of encryption to safely store username and password of the user?
Are there any rules to follow also for the distribution on the App Store? I read in another place that you should declare what type of encryption you use in the app for export purposes...
Who could clarify this question please? Or point me in the right direction?

Thanks a lot.
 
P

piazza31

macrumors newbie
Original poster
Jan 8, 2008
11
0
robbieduncan said:
I would suggest you use the built-in keychain services as described in the documentation.
Click to expand...

Ok. But how do I use the settings bundle to organize those keys? I'd like to have those information on the settings page of the iPhone, as in standard apps. But from what I know on the plist configuration I have access to nsuserdefaults only, how could I integrate the keychain services there without writing a non standard view directly in my app?
 
robbieduncan

robbieduncan

Moderator emeritus
Jul 24, 2002
25,611
893
Harrogate
piazza31 said:
Ok. But how do I use the settings bundle to organize those keys? I'd like to have those information on the settings page of the iPhone, as in standard apps. But from what I know on the plist configuration I have access to nsuserdefaults only, how could I integrate the keychain services there without writing a non standard view directly in my app?
Click to expand...

I don't really understand the question: the keychain is the model. It has nothing to do with what the view onto that data is. You need to write a the controller layer to link the two.

I see no reason that a settings bundle cannot store data in the keychain: NetNewsWire for example uses a settings bundle and store usernames and passwords. I cannot imagine they are not using the keychain.
 
P

piazza31

macrumors newbie
Original poster
Jan 8, 2008
11
0
robbieduncan said:
I don't really understand the question: the keychain is the model. It has nothing to do with what the view onto that data is. You need to write a the controller layer to link the two.
Click to expand...

Sorry, I didn't formulate my question the right way. I don't know how to link the settings bundle with my view controller if I use the keychain to store the login information. In the documentation it explains only the possible types it accepts in the plist file, but that seems to be arrays, strings and dictionary with some special options. I see no mention about working with controllers from your application.
Maybe I am missing something...
 
robbieduncan

robbieduncan

Moderator emeritus
Jul 24, 2002
25,611
893
Harrogate
piazza31 said:
I don't know how to link the settings bundle with my view controller if I use the keychain to store the login information.
Click to expand...

What view controller? One in the main app? You shouldn't even be trying to link them.

The settings bundle views are linked to the controller layer in the settings bundle. This reads/writes the keychain.

In the main app you read the values from the keychain when you need to make a connection.

Edit to add: none of this has anything to do with NSUserDefaults, plists or the like: the keychain is the model, not NSUserDefaults or a plist.
 
robbieduncan

robbieduncan

Moderator emeritus
Jul 24, 2002
25,611
893
Harrogate
My apologies to piazza31! I have read the documentation and from what I see you cannot include code in the settings bundle. My best suggestion is that the IsSecure key for text fields may actually cause the value to get stored in the keychain and retrieved from it transparently...
 
P

piazza31

macrumors newbie
Original poster
Jan 8, 2008
11
0
robbieduncan said:
My apologies to piazza31! I have read the documentation and from what I see you cannot include code in the settings bundle. My best suggestion is that the IsSecure key for text fields may actually cause the value to get stored in the keychain and retrieved from it transparently...
Click to expand...

No problem! Thanks anyway!
 
N

Nutter

macrumors 6502
Mar 31, 2005
432
0
London, England
robbieduncan said:
My best suggestion is that the IsSecure key for text fields may actually cause the value to get stored in the keychain and retrieved from it transparently...
Click to expand...

Unfortunately, it does not. All values from Settings.app are stored in user defaults, which to my mind makes the very existence of the isSecure property rather unwise.

The solution is to prompt the user for secure information only from within the app. In my app (Byline) I allow the user to change the account username from Settings.app, and then ask for the account password when the app is launched.
 
robbieduncan

robbieduncan

Moderator emeritus
Jul 24, 2002
25,611
893
Harrogate
Nutter said:
Unfortunately, it does not. All values from Settings.app are stored in user defaults, which to my mind makes the very existence of the isSecure property rather unwise.

The solution is to prompt the user for secure information only from within the app. In my app (Byline) I allow the user to change the account username from Settings.app, and then ask for the account password when the app is launched.
Click to expand...

So my password for my NetNewsWire account is stored in plain text? That's shocking.
 
B

Brendan.Porter

macrumors member
May 19, 2007
36
0
Between tourists, corn, and windmills.
I don't think it is that shocking that a password is stored in an unaccessible place. If you're smart you would encrypt the password before storing it, and decrypt it after retrieving it.

If you don't put the password in a user-viewable setting (ie, don't put in a Type in the settings plist for the password Key) then the user can't even find the password, because Settings won't display it. The worst case scenario is that someone hacks into your device somehow and finds the plist, then either views or downloads it. If it is encrypted, its useless.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom