iOS is Apple's operating system for the iPhone, iPad and iPod Touch.

learn more… | top users | synonyms (1)

1
vote
3answers
1k views

How secure is iOS Touch ID?

I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". ...
1
vote
1answer
296 views

Obfuscation and Mobile App

Recently, I stumbled with this topic in my mind for few days. I understand that obfuscation is not the best protection against reverse engineering. I wonder if there is another method that make it ...
1
vote
1answer
132 views

What security practices should I keep in mind during development? [closed]

I am beginning to develop apps for Android and iOS that make API calls to a PHP web application that I will be developing. Users will be required to sign up with a username, password, and (optional) ...
1
vote
1answer
139 views

Will ios8 encryption fail on forced shutdown?

I understand that IOS 8 data can be encrypted when the phone is locked, and decrypted for use when the phone is unlocked. But let's say the phone was unlocked (and thus the data is decrypted), and ...
1
vote
3answers
2k views

Sending secure information from app with ssl

I'm a web developer, but I occasionally step over into doing some mobile app development here and there. A client recently asked me to help them develop a very simple app. The app is essentially just ...
1
vote
3answers
234 views

What security mechanisms are in place for iOS' custom keyboards?

Apple has just announced iOS 8. The new version appears to be more extensible than previous versions, and one of the new possiblities is to allow developers to develop custom keyboards, different than ...
1
vote
2answers
296 views

Protecting the remote database against tampering in a mobile app

This is the first time I face a mobile app deployment at big scale. This app needs to connect to a remote server where to store and retrieve data. I discarded connecting directly to the MySQL ...
1
vote
1answer
90 views

Private messages for an ios app - how secure is this system?

I'm designing architecture for sending private messages (i.e. only sender and receiver are able to read a message). Client side - iOS, server side - Parse.com I'm thinking of using RSA to ...
1
vote
1answer
102 views

Securing iOS applications communication from client side

Many of you have heard about instagram flaw that facebook has not fixed yet, The flaw allows the attacker to hijack the session by sniffing the session cookie on Instagram iOS app since it does not ...
1
vote
1answer
143 views

Secure way of opening web page from iOS without need of logging in

I am developing an iOS application and web page, both use same Parse backend. Web page contains some functionality that is not available in the iOS application. Therefore I would like to present the ...
1
vote
1answer
355 views

What encryption does Apple use?

With their iOS devices, Apple allows people to block certain applications through "Restrictions". I recently had an issue with my iPhone where I'm positive that I entered the correct passcode on my ...
1
vote
1answer
519 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...
1
vote
1answer
2k views

iOS: sandbox of an iphone app

I am new to iOS so I do have only limited knowledge about iOS in general. For self learning purposes, I would like to know several things as I am quite confused after searching the web. I do know ...
1
vote
1answer
766 views

Using Apple NSKeyedArchiver class without encryption to save score data locally

first of all I'm sorry for my bad English! I have a question about the security of NSKeyedArchiver, a subclass of NSCoder of Apple Foundation.framework ...
1
vote
1answer
78 views

Starting point for Mobile Device Security particularly in a MDM setting?

I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
1
vote
0answers
46 views

What are the best ways for an iOS 9 user to protect against device fingerprinting?

In response to this series of questions: What unique device fingerprinting information can an iOS9 app collect? and as an update to this question: What are the best practices for maintaining privacy ...
1
vote
1answer
72 views

Web services API key

I have a PHP server with some .php files. Swift iOS application send POST request to server and get some response in JSON. PHP files on server do some work with MSQL. The question is: How to provide ...
1
vote
0answers
52 views

common crypto and bouncy castle, PBKDF2 generation

I am working on an iOS app and android app, for iOS I am using common crypto, and for android bouncy castle. I noticed that in android when I generate PBKDF2, if I use a salt or pass ...
1
vote
0answers
93 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
1
vote
1answer
201 views

Secure socket communication between iOS device and 3rd party server

I'd like your advice on what is the best approach for the challenge in my hands... I'm developing an extension to a 3rd party software. I'm doing my development using Python/Twisted/Autobahn. The end ...
1
vote
1answer
91 views

iOS permissions for 3rd party app developers [closed]

I am putting together a summary on iOS and Android security risks based on app permissions. On Android, it is easy to define all of the permissions and what 3rd party developers have access to (from ...
1
vote
0answers
130 views

Force TLS on mobile app

i'm developing a mobile application for iOS and Android. On this app i'm asking resources on a secure server through ajax. Server's developers asked me to force the call in order that we use TLS ...
1
vote
0answers
118 views

FIPS Compliance with iOS app

Our company is working on getting FIPS validation for the iOS app and is in the initial phase. We have decided to use a private FIPS-certified libraries for using in the crypto modules. I have some ...
1
vote
0answers
519 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
1
vote
0answers
40 views

Is SCEP safe if I use a different long and complex password per enrollment, and validate it against expected parameters?

I'm considering using SCEP to enroll iPads and other devices in my network. The iOS configuration profile allows me to configure a different password for each device. Is it valid, and safe for me to ...
1
vote
2answers
2k views

Why do I need a certificate to pin an SSL connection with AF Networking 2?

I am using the AF Networking 2 library and read that I need to include the server's certificate here. The client should be able to tell that the certificate is valid when it connects to the server, ...
1
vote
0answers
185 views

HIPAA Compliant App, using Encypted Core Data vs Core Data Attribute Encyption

I am writing an iOS app which needs to be HIPAA compliant. The app should preferably function offline, so data needs to be stored on the phone. So here is what I was thinking of doing: On First ...
1
vote
0answers
179 views

Implementation of different BCrypt versions

I'm fairly new to encryption, and I am investigating the different kind of encryptions. I want to encrypt passwords in a secure way. I discussed this with my colleague, and he said that BCrypt is the ...
0
votes
2answers
658 views

Are passwords safe to send through POST, without SSL in a iOS app?

Is it safe to post passwords to my web server in this manner? NSURL *url=[NSURL URLWithString:@"http://mywebsite/test/register.php"]; NSData *postData = [post dataUsingEncoding:NSASCIIStringEncoding ...
0
votes
2answers
111 views

how to encrypt a sensitive model on android and ios

I am writing a mobile app which uses a statistical model contained in binary files. I want to be able to distribute the app freely, but I don't want anyone to be able to use my model files, even on a ...
0
votes
3answers
94 views

How secure is my method?

I want to select data from a MySql database on an iphone device. The method I seem is the easiest one is to connect to a php file with GET arguments and then return it as a string. Now I'm just ...
0
votes
1answer
878 views

How to prove iOS app is vulnerable to MiTM

I'm updating an iOS app and I want to prove that it is vulnerable to MiTM attack. I have set up Charles Proxy on my mac and configured the Simulator so that it trusts Charles CA Certificate, per ...
0
votes
3answers
193 views

Restrict request to Android and Iphone App only?

I have a ASP.NET/IIS server. I want to restrict my server to only accept request from Android and Iphone(IOS) applications. I have heard about HMAC. Can HMAC help me?
0
votes
1answer
271 views

What process on my jail broken iPhone is listening on port 80 [closed]

I can access it via telnet from the internet once I get the IP of my phone Probably an HTTP server telnet XXXX 80 Trying XXXX... Connected to XXXX. Escape character is '^]'. HELP ...
0
votes
1answer
84 views

I need to transfer user's private key (RSA) to my App. Is file sharing a good solution?

I've asked a similar question here earlier iOS: Is it ok to store a RSA private key (use to decrypt text) in your application document directory? However, the person recommend me to use keychain ...
0
votes
1answer
245 views

Iphone app not allowing proxy

Hi everyone I am interested in how a banking app works, especially the way it handles https requests. So I installed one, set my proxy settings, started burp suite and expected it to work. As you may ...
0
votes
1answer
690 views

What tools are available for iOS vulnerability assessment and penetration testing [closed]

I want to start learning about VA on Apple iOS devices. Besides documentation, is there any good tool - in terms of automated vulnerability scanners, or scripts - to start?
0
votes
1answer
214 views

Per Vendor/Publisher Device Unique Identifier, How is it and how much secure? [closed]

iOS and WP8 support Unique Identifier per Vendor or Publisher according to this and that. Android unfortunately does not support that feature. Is there anybody knows the mechanics of that mechanism? ...
0
votes
1answer
377 views

Zeus for iOS devices

Is there a known variant of Zeus which attacks iOS based mobile devices? I have read about versions for Android and Symbian , wondering if iOS is vulnerable to it as well.
0
votes
1answer
85 views

Level of Data Security in iOS [closed]

How secure is the data stored on iOS devices, specifically app data like notes, pictures, etc.? Are there any ways to make it more secure?
0
votes
0answers
49 views

How can I protect a mobile application from LogJam?

I develop a two-factor authentication app on iOS and Android and I recently noticed that they run perfectly fine against a local dev server that is vulnerable to LogJam. Is there any way to secure ...
0
votes
1answer
18 views

Is it secure to have an iPad app run a webDAV server on localhost without authentication?

I have two iPad apps running on the same device. One is hosting a webDAV server on http://localhost:8080 without any authentication (the server is active whilst the app is foregrounded, and for a few ...
0
votes
0answers
9 views

Is it possible to UI automate testing involving Two-factor Authentication for an iOS app? [migrated]

I have an iOS app that uses 2FA for certain account related features. I'd like to create some UI automation tests for those features, but they require receiving either SMS messages or email. On a ...
0
votes
0answers
52 views

What unique device fingerprinting information can an iOS9 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? Apple has apparently ...
0
votes
1answer
59 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
0
votes
0answers
36 views

Does sending a token back with a different channel (iOS Push Notification) improve security?

So I have this customer who has a project which is "very sensitive". It's a Jabber client which will connect to their servers to allow users to communicate. Here's what he requires for the ...
0
votes
0answers
40 views

Do iOS applications have access to the certificates installed?

As the title says, I'm curious if a generic iOS application can access/retrieve the certificates installed in the device (e.g., via a management profile) Thanks
0
votes
1answer
137 views

Tablet / phone app security in unsecured networks

Although reluctant to use my laptop on unsecured networks, I at least know that without me launching any processes or logging into certain web pages, that I will not be sending any credentials over ...
0
votes
0answers
16 views

Heartbleed - impact on iOS apps? [duplicate]

Just heard about the heartbleed news over the internet for OpenSSL and wondering if it affects ios apps as well. My app uses openssl crypto library and thus the concern ! Any views in this regard ...
-1
votes
1answer
131 views

Possible ways to test security for Windows Phone 7 or iOS devices [closed]

I'm trying to test the security features of different types of OSs available, and I decided to narrow this down to the Windows Phone 7 and iOS operating systems. I will be testing both my Nokia 800 ...