苹果二进制文件的安全性如何（密钥安全）
我正在为 iPhone 开发一个应用程序，它使用 HTTP 请求从网络服务器获取报价数据。
我正在与另一位管理 Web 服务的开发人员合作。我们使用 MD5 加密（简单异或）在 iPhone 和网络服务器之间传递数据。
今天早上他向我提出了一个问题，坦率地说，这超出了我的知识范围。
“苹果二进制文件有多安全？”
他担心是否有人可以通过 iTunes 获取 .app 捆绑包，然后解码该捆绑包并直接访问我的源代码，从而允许他们获取我们用于编码数据的密钥。
我个人甚至不知道从哪里开始，但我确信那里有更多知识渊博/狡猾的人。
那么，有可能吗？如果是，我该怎么做才能保护我的消息来源？
I'm developing an application for iPhone which uses a HTTP request to get quote data from a webserver.
I am working with another developer who is managing the web service. We are using an MD5 encryption (simple xor) to pass the data between iPhone and webserver.
He posed a question to me this morning which is quite frankly way out of my pool of knowledge.
'How safe is the apple binary?'
He is worried about whether someone could obtain the .app bundle via iTunes, and then decode that bundle and access my source code directly, allowing them to obtain the secret key we are using to encode the data.
I personally, wouldn't even know where to begin, but i'm sure there are more knowledgeable/crafty fellows out there.
So, is it possible? if is it, what can I do to try and safe guard my source?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
该二进制文件甚至远不安全。无论是通过 iTunes 下载还是在越狱的 iPhone 上，除了混淆之外你别无选择，而顽固的对手总是能绕过这一点。永远不要依赖客户端应用程序中嵌入的某些内容的“保密性”，它不是保密的。曾经。在任何平台、任何语言、使用任何技术。
如果您需要限制谁可以访问您的系统，则需要每用户帐户。没有其他安全机制。 Apple 确实提供了通过 iTunes 帐户“验证”用户身份的方法，您可能需要研究一下。
另外，“MD5加密”没有任何意义。 MD5是一种哈希函数与加密应用程序，但说你正在做“MD5加密”和“简单异或”是没有意义的。我可以使用 XOR 和 MD5 来做很多事情，但几乎没有什么可以作为有意义的加密方案，并且与专家设计的真实算法（例如 AES）相比没有任何优势。
使用 HTTPS（基于 SSL 的 HTTP）。没有理由不这样做，iPhone完全支持它。如果需要，您至少可以从 http://www.startssl.com/< 为您的服务器获取免费的 SSL 证书/a> .现在也有很多廉价的 SSL 证书提供商。谷歌了一下。
我强烈建议您和您的合作开发人员开始阅读有关信息安全的理论和实践方面的内容，因为您似乎对该主题缺乏了解，并且可能存在一些重大误解，这些误解将导致系统容易被破坏。
The binary is not even remotely safe. Whether through the iTunes download or on a jailbroken iPhone, there's nothing you can do other than obfuscation, which a determined adversary will always get past. Do not ever rely on the "secrecy" of something embedded in a client application, it is not secret. Ever. On any platform, in any language, with any technique.
If you need to limit who can access your system, you need per-user accounts. There is no other safe mechanism. Apple does provide ways to "authenticate" users via their iTunes accounts, you may want to look into that.
Also, "MD5 encryption" means nothing. MD5 is a hash function with cryptographic applications, but saying you're doing "MD5 encryption" and "simple XOR" is just meaningless. I can use XOR and MD5 to do any number of things, few if any would serve as a meaningful encryption scheme, and would have no advantages whatsoever over a real algorithm designed by experts, such as AES.
Use HTTPS (HTTP over SSL). There is no reason not to, the iPhone fully supports it. If you need to, you can get free SSL certificates for your server from at least http://www.startssl.com/ . There are lots of cheap SSL certificate providers out there these days, too. Google a bit.
I'd strongly recommend you and your co-developer start reading up on information security, both in theory and practice, because it appears you have very little grounding in the subject, and probably several significant misconceptions that will lead to easily-broken systems.