We develop a financial application that will allow payment and other important actions, we also use some SDKs to help us with some functions. Including SDK in our app based on what I understand will have access to:

  • The same keychain our app has access to
  • Any folders/files our app has access to
  • Any app permissions our app has, e.g. location data, photo library access
  • iCloud containers of our app
  • All data our app exchanges with a web server, e.g. user logins, personal information

Having third-party SDK implemented part of our app, we don't need third party SDK to have such permission but I understand it will as default when using third-party SDK. How do we make sure to cover all those and other potential third-party SDK hacks on our main application?

closed as too broad by Steffen Ullrich, Xander, Rory Alsop Apr 8 at 12:31

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Do you mean how to find a vendor you can trust to not cheat? These are likely similar criteria on which you decide which software you install on your systems, where you buy stuff online ... - probably you trust established vendors which actually have to loose credibility if they cheat and you distrust new and unknown vendors unless someone you trust will vouch for them or they are open enough and you have enough knowledge and time so that you can verify what they do yourself. – Steffen Ullrich Mar 31 at 18:13
  • This is not a question on how to trust a vendor because we can do TPSA for those third-party companies that provide SDK. Our application allows payments and other actions, we want to know the SDK we use won't be able to intercept or do anything like keylogging, screen scrubbing and such. Not sure if it's technically possible to create such isolation – Filopn Apr 1 at 0:41
  • Such problems are usually resolved by reputational and contractual trust rather than technical controls, although code audit is sometimes a contractual requirement :) – gowenfawr Apr 1 at 1:57
  • If it's that important to you, insist on only using open sourced SDK, that you can audit and remove any features not necessary for your application. – Lie Ryan Apr 1 at 3:39
  • @Filopn: it would be technically possible to implement sufficient isolation if the SDK is running within its own process with different privileges so that it cannot direct access the sensitive data and there is only some clearly defined inter process communication to deal with the SDK which does not allow it access to sensitive data. Of course, such scenario need to be explicitly supported by the SDK and it is unclear if it would be even possible to implement such thing since it is not clear from your question what the SDK is for and what kind of access it actually needs. – Steffen Ullrich Apr 1 at 4:22

Browse other questions tagged or ask your own question.