且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

您将如何在 iPhone 应用程序中保护机密数据?

更新时间:2023-08-17 15:24:28

简单的答案是,就目前的情况而言,在 iPhone 上保守秘密是不可能的.越狱的 iPhone 只是一台适合您手中的通用计算机.没有您可以访问的可信平台硬件.用户可以欺骗任何你能想象到的用来唯一标识给定设备的东西.用户可以将代码注入您的进程以执行检查钥匙串等操作.(搜索 MobileSubstrate 以了解我的意思.)对不起,你搞砸了.

The simple answer is that as things stand today it's just not possible to keep secrets on the iPhone. A jailbroken iPhone is just a general-purpose computer that fits in your hand. There's no trusted platform hardware that you can access. The user can spoof anything you can imagine using to uniquely identify a given device. The user can inject code into your process to do things like inspect the keychain. (Search for MobileSubstrate to see what I mean.) Sorry, you're screwed.

在这种情况下,应用购买收据中的一线曙光.如果您使用应用内购买在您的应用中销售商品,您将获得一张经过加密签名的收据,并且可以根据需要通过 Apple 进行验证.即使您无法对收据保密,它可以(由 Apple,而不是您)追踪到特定购买,这可能会阻止盗版者分享它们.您还可以根据收据限制对服务器的访问,以防止您的服务器资源被盗版者耗尽.

One ray of light in this situation is in app purchase receipts. If you sell an item in your app using in app purchase you get a receipt that's crypto signed and can be verified with Apple on demand. Even though you can't keep the receipt secret it can be traced (by Apple, not you) to a specific purchase, which might discourage pirates from sharing them. You can also throttle access to your server on a per-receipt basis to prevent your server resources from being drained by pirates.