Is it secure to use XML to build iPhone application? [closed]

Question

I know PHP/MYSQL but i don't know much about iPhone development and as such I found someone to help me. He is telling me that he can make my app, which will be a basic note taking service that will let you post via the app to the website and then retrieve that note on the iphone when requested by the user. He said that he will use XML and that the data will be secure because its "hard coded."

I am not sure what he means but is it true that the app will be secure if done in XML?

Thanks

Answer 1

Using XML-formatted data will not make the content any more secure than using plain text. You need to think about using encryption or a secure channel when transferring data between the application and the "web site".

Answer 2

I'd suggest you should nail down precisely what your developer is talking about. Neither XML nor hard coding are things I'd ever expect to hear in the context of "It's secure because I'm using X".

XML is a markup language. You're probably familiar with it's cousin, HTML? XML is used to transport and store data in a text file. Play about with mysql --xml and you should be able to dump a table as an XML file: that'll give you the idea better than any explanation I could give.

If you have an app that talks to a web service, and it sounds like you do, then XML is a popular choice for transmitting the data, but there's nothing secure about it. To do secure XML data transfer over the Internet, you have to layer some security on top of it:

• you might encrypt the data before putting it in the XML
• or (probably better) encrypt the XML file before transfering it
• or tunnel a secure channel over the Internet (e.g. SL or a VPN) to transmit the XML file.

Since you've already got SSL in place for your web surfing, adding it to your web service should be straightforward and this is probably the way to go. Hard to tell without more detail.

Next, "hard coded". This means data or configuration settings that is included in the source code of an application. It's usually a bad idea.

Key to understanding this is to know what he proposes to hard code. He can't mean the note data you are transferring - he doesn't have that at compile time because the user types it in. Is he maybe hard coding authentication data into the app? That feels wrong as well, surely you're doing per-user authentication. Maybe he's encrypting, and hard coding the key? All sorts of things wrong with that.

This would generally make me nervous. There are some situations where hard-coding is appropriate but generally it's a sign you're doing something terribly wrong.