在 iPhone 源和项目资源上存储密钥
在iPhone源代码和项目资源（例如plist文件）上存储密钥（内部使用密码等）安全吗？
显然没有什么是 100% 安全的，但是可以从已安装的应用程序中轻松提取这些信息吗？
您建议如何存储这些密钥以便在源代码中使用它们？
以防万一，这个问题与存储用户密码无关。
Is storing secret keys (internal use passwords and such) on iPhone source code and project resources (such as plist files) secure?
Obviously nothing is 100% secure, but can this information be extracted easily from an installed app?
How do you recommend storing these keys to use them in the source code?
Just in case, this question is not about storing user passwords.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
通过更长的讨论发现基本上相同的问题：
如何在 iPhone 应用程序中保护秘密数据的秘密？
总结一下：似乎没有官方方法可以在应用程序二进制文件中安全地存储秘密密钥。
很抱歉发布重复的问题。
Found basically the same question with a longer discussion:
How would you keep secret data secret in an iPhone application?
To sump up: it seems there's no official way to securely store secret keys in the app binary.
Sorry for posting a duplicate question.
很大程度上取决于您所说的安全是什么意思。对于正常的设备使用，它可以被认为是安全的，因为用户无法访问它。然而，对于能够完全访问文件系统的越狱设备来说，所有的赌注都已落空。因此，在越狱的手机上查看应用程序包中的 plist 文件非常简单。
您可能会考虑使用钥匙串，理论上它会更安全，并且还有一个优点，即数据在重新安装应用程序后仍可保存。和以前一样，在越狱的设备上，没有什么可以被认为是 100% 安全的，但这取决于你想要解决多少麻烦。
A lot depends on what you mean by secure. For normal device use it could be considered secure in that there is no way for a user to access it. However all bets are off for a jail-broken device which has complete access to the filesystem. So viewing a plist file in your application bundle is trivial on a jail-broken phone.
You might consider the use of the keychain which in theory would be safer and also has the advantage that the data will survive a reinstallation of your app. As before on a jail broken device nothing can be considered to be 100% secure but it depends how much trouble you want to go to.