iPhone 和 SQLite 数据库安全
在包含现有 SQLite 数据库（即在编译时存在）的 iPhone iOS4 应用程序中，SQLite 数据库中的数据有多安全？
例如，是否值得加密 SQLite 数据库（使用根据许可出售的 sqlite3_key(...) 方法）？
In an iPhone iOS4 app containing an existing SQLite database (i.e. there at compile time), how secure is the data in the SQLite database?
For example, is it worth encrypting an SQLite database (using the sqlite3_key(...) method sold under license)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
在 iPhone 越狱之前，它是安全的。越狱后，人们可以访问您的数据库并将其复制到他的桌面上，然后可以看到您的数据。所以我认为如果你有非常重要的数据那么你应该加密你的数据库
It is secured until the iPhone is jailbreaked. After jailbreak one can go to your database and can copy it to his desktop and then can see your data. So I think if you have very important data then you should encrypt your database
您必须回答的第一个问题是您的数据有多大价值？这在一定程度上决定了黑客愿意花费多少时间来尝试获取它。安全性是一个复杂的主题，您可能需要花费数天时间来研究 IOS 安全性。这在很大程度上取决于 IOS 版本，IOS 4 是第一个很有可能真正安全的版本。首先，除非您的设备被锁定，否则没有什么是安全的。此外，即使设备被锁定，您的数据库也不会加密，除非您在代码中设置数据保护标志。除了保护一个应用程序的数据免受另一个应用程序的影响之外，沙盒实际上对您没有任何帮助。黑客使用您的设备将其越狱并安装 SSH 服务器，然后几乎可以做任何他们想做的事情，包括暴力破解密码尝试。如果 IOS 4 设备使用合适的密码锁定，并且您在数据库上设置了数据保护，那么您可能可以放心依靠 IOS 硬件加密。但是你能依赖用户来设置合适的密码吗？默认的简单密码只有 4 位数字 - 不太好。他们都是IOS 4+用户吗？如果没有，您将需要对数据库进行自己的加密。只是不要将密钥存储在任何地方，因为黑客会找到它。当您考虑编码的安全性时，请考虑黑客还可以反编译并运行您的应用程序的修改版本。
First question you have to answer is how valuable is your data? That somewhat determines how much time a hacker is willing to spend trying to get at it. Security is a complex subject and you could spend days researching IOS security. It depends heavily on the IOS version, with IOS 4 being the first release that has a decent chance of being really secure. First off nothing is secure unless your device is locked. Also, your database is NOT encrypted even if the device is locked unless you set data protection flags in your code. Sandbox doesn't help you here at all really, except to protect one apps data from another. A hacker with your device will jailbreak it and install an SSH server and at that point can pretty much do whatever they want, including brute-force passcode breaking attempts. If an IOS 4 device was locked with a decent passcode and you set data protection on your database, you are probably ok with counting on the IOS hardware encryption. But can you depend on users to set a decent passcode? The default simple passcode is only 4 digits - not that great. And will they all be IOS 4+ users? If not, you'll need your own encryption on the database. Just don't store the key anywhere, cuz hackers will find it. And while you are considering security in your coding, consider that hackers can also decompile and run a modified version of your app.
AFAIK 数据在 iOS 4.x 设备上进行物理加密。除此之外，应用程序是沙盒的，它是一个相当安全的系统。
AFAIK data are physically encrypted on iOS 4.x devices. Add to that the fact that application are sandboxed, it's a fairly secure system.