是否可以使用应用程序分发已填充的钥匙串
我正在开发一个使用私有网络服务的应用程序。 目前，我们使用捆绑的客户端证书来启用 2 路 SSL 连接，但证书的密码位于代码中，令人担心的是，该证书可能会被反编译并与（简单）提取的证书文件一起用于恶意目的。
有没有一种方法可以将密码预先加载到应用程序钥匙串中以便与应用程序一起分发，以便密码永远不会公开？
I am working on an application that uses a private web service.
We currently use a bundled client certificate to enable 2-way SSL connectivity however the password for the certificate is in the code and it is a concern that this could be de-compiled and used with the (trivially)extracted certificate file for nefarious purposes.
Is there a method by which I can pre-load a password into the application keychain for distribution with the app so that the password is never left in the open?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
无论你如何将密码放入二进制文件中，都会有某种方式来利用它，无论是调试工具、代码分析等。
你最好将你的 Web 服务视为开放的......也许不太可能在就在下一个未来，但基本上你放弃了对公众的访问。
钥匙串应该使用用户特定的密钥进行加密，这显然是你做不到的——否则你无论如何都可以读取每个人的数据。
如果您确实需要保护它，您可能需要服务器上的用户帐户......如果这比模糊更安全，则由您决定。
No matter how you put your password into your binary, there will be someway to exploit this, be it with debugging tools, code analysis etc.
You better treat your web service as open... maybe unlikely to get not properly authorized requests in the very next future, but basically you give away access to the public.
Keychain should be encrypted with user specific key, and this you obviously cannot do - or you would be able to read everyones data anyway.
If you really need to protect it, you probably need user accounts on your server... if this is more secure than obscurity it up to you.