在 iPad/iPhone 上的用户会话期间存储安全密钥是否安全？
在我的应用程序中，一旦用户通过身份验证，他就会收到一种安全密钥，需要将其存储在 iPhone/iPad 上的会话中。该安全密钥用于他在会话期间的所有未来请求。 如果我在获得密钥后将其存储在某个全局变量中，它有多安全？ iPhone越狱后可以访问吗？如果是这样，保存会话密钥的安全位置是什么？
谢谢， 赫塔尔
In my application, once the user is authenticated, he receives a sort of security key that needs to be stored for his session on the iPhone/iPad. This security key is used for all his future requests during the session.
How safe is it if i were to store the key in some global variable once I get it? Can it be accessed if the iPhone is jailbroken? If so, what would be a safe place to keep the session key?
Thanks,
Hetal
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您担心谁会窃取代码？用户还是其他恶意程序？如果是用户，并且代码非常有价值，那么理论上，任何能够物理访问该设备的人都可以破解它。但实际上，你是相当安全的。您可以在代码位于内存中时对其进行加密，并仅在使用时对其进行解密。
同样，实际上，网络应用程序始终通过 cookie 来执行此操作。如果代码仅对单个会话有效，那么即使它被泄露，您也可能是安全的。您可能希望认为代码在内存中时是“安全的”，但需要采取其他保护措施来检测代码何时以及是否被盗。即代码仅在 10 分钟内有效，然后必须刷新，仅对一个 IP 有效或对交易数量进行限制等。具体取决于您的应用程序需求。
Who are you worried is going to steal the code? The user or another malicious program? If its the user, and the code is very valuable you have to assume that anyone with physical access to the device could, in theory, break it. But as a practical matter you are pretty safe. You could encrypt the code while it's in memory and only decrypt it as you use it.
Again, as a practical matter, web-apps do this all the time via cookies. If the code is only valid for a single session you are probably safe if it is compromised. You might want to consider the code 'safe' while it is in memory, but put in other protection to detect when and if it does get stolen. i.e. have the code only be valid for 10 minutes and then has to be refreshed, only valid from one IP or limits on the number of transactions etc. Depending on what your application needs are.