Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app.

If I find out an app's app ID, can't I just create another iOS app with that app's bundle ID? Sure, I may not be able to distribute my app on Apple's App Store (since it requires every bundle ID to be unique), but can't I distribute it other ways? Shouldn't the iOS app also need to know the app secret? I guess Facebook figures allowing an attack to extract the app secret from the iOS app would be worse? What about storing the app secret in the iOS SDK Keychain Services?

share|improve this question
    
"Never include your App Secret in client-side or decompilable code." developers.facebook.com/docs/facebook-login/security –  MattDiPasquale Feb 17 at 16:45

1 Answer 1

You can install up to 100 devices using Ad Hoc distribution,without App store.But First you need to register each device in apple dev center using device Id.So I don't think it's a huge problem.

share|improve this answer
    
That's a good point. I was thinking you could distribute the app via Cydia. But, your answer reminded me that, then, only jailbroken devices could install it. –  MattDiPasquale Feb 13 at 3:42
    
Now, I have another question... How does the Facebook iOS SDK prevent bundle ID spoofing? In other words, why can't I just give my app its own bundle ID but then send Facebook the bundle ID of another app? –  MattDiPasquale Feb 13 at 3:44
    
Hmmm... Looks like they're doing some sort of encryption, but I don't fully understand it yet. –  MattDiPasquale Feb 13 at 3:57
    
Obviously jail broken devices won't worry about security ;) –  Abraham Van Helsing Feb 13 at 5:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.