Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app.

If I find out an app's app ID, can't I just create another iOS app with that app's bundle ID? Sure, I may not be able to distribute my app on Apple's App Store (since it requires every bundle ID to be unique), but can't I distribute it other ways? Shouldn't the iOS app also need to know the app secret? I guess Facebook figures allowing an attack to extract the app secret from the iOS app would be worse? What about storing the app secret in the iOS SDK Keychain Services?

share|improve this question
"Never include your App Secret in client-side or decompilable code." – mattdipasquale Feb 17 '14 at 16:45

The iOS app ID includes a team specific prefix that can not be changed nor set by the developer; it is automatically used when signing a build (which you even have to do when using ad hoc distribution or development builds)

So unless Facebook ignores that part when checking the App ID to be equal, you cannot create an app that passes as another app.

There you go:

App ID A string that identifies one or more apps from a single team. An App ID consists of a bundle ID search string preceded by the Team ID, a 10-character string generated by Apple to uniquely identify a team.

share|improve this answer

You can install up to 100 devices using Ad Hoc distribution,without App store.But First you need to register each device in apple dev center using device Id.So I don't think it's a huge problem.

share|improve this answer
That's a good point. I was thinking you could distribute the app via Cydia. But, your answer reminded me that, then, only jailbroken devices could install it. – mattdipasquale Feb 13 '14 at 3:42
Now, I have another question... How does the Facebook iOS SDK prevent bundle ID spoofing? In other words, why can't I just give my app its own bundle ID but then send Facebook the bundle ID of another app? – mattdipasquale Feb 13 '14 at 3:44
Hmmm... Looks like they're doing some sort of encryption, but I don't fully understand it yet. – mattdipasquale Feb 13 '14 at 3:57
Obviously jail broken devices won't worry about security ;) – Harikrishnan Feb 13 '14 at 5:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.