Save username-password with NSUserDefault, how and how much safe?

objective-c ios passwords nsuserdefaults username
Sefran2 picture Sefran2 · Mar 6, 2011 · Viewed 8.2k times · Source

I would save a couple of values (username-password) with NSUserDefault.

First: is there a way to save them together (like in an array for example)? Second: is it safe? or do I have encrypt the password in a some way?

Answer

Ferruccio picture Ferruccio · Mar 6, 2011

Encryption will give you some security. The problem is your program would also have to decrypt the password, which means it must have the key stored in it somewhere. This will make it vulnerable to reverse-engineering. A better approach is to use an one-way function (such as a hash) on the password and store that hash value. When a user enters a password, you then apply the one-way function to the password and compare the result to the stored value. In this manner, the password cannot be compromised (well, there's always a dictionary attack, but that's a matter of password strength).

Instead of using NSUserDefaults, you would be better off using iOS Keychain Services. It's main purpose is to securely store user credentials. Apple has already done all the hard work for you. Take advantage of it.

Related questions

How to link to apps on the app store

I am creating a free version of my iPhone game. I want to have a button inside the free version that takes people to the paid version in the app store. If I use a standard link http://itunes.apple.…

Read More
How can I make a UITextField move up when the keyboard is present - on starting to edit?

With the iOS SDK: I have a UIView with UITextFields that bring up a keyboard. I need it to be able to: Allow scrolling of the contents of the UIScrollView to see the other text fields once the keyboard is …

Read More
How do I check if a string contains another string in Objective-C?

How can I check if a string (NSString) contains another smaller string? I was hoping for something like: NSString *string = @"hello bla bla"; NSLog(@"%d",[string containsSubstring:@"hello"]); But the closest I could find was: if ([string rangeOfString:@"hello"] == 0) { NSLog(@"…

Read More