在Settings.bundle中存储密码并使用CFPreferencesCopyAppValue获取的安全影响 [英] Security implications of storing a password in Settings.bundle and getting with CFPreferencesCopyAppValue

问题描述

对于这个问题似乎明显的道歉，但无论什么原因，我没有能够找到一个确定的答案在苹果文档中，在哪里和如何Settings.bundle密码信息存储。我的问题：如果我需要为应用程序存储一些凭据，我使用Settings.bundle，以便密码输入到PST的设置区域的PSTextFieldSpecifier文本字段与IsSecure = YES，然后我访问从我的应用程序的值使用CFPreferencesCopyAppValue，永远不写到NSUserDefaults，并只通过网络安全地发送它，存储和检索方法相比，使用我自己的应用程序设置中的钥匙串存储和检索密码安全吗？感谢您的输入。

Apologies for the seeming obviousness of this question, but for whatever reason I haven't been able to find a definitive answer in the Apple documentation about where and how Settings.bundle password info is stored. My question: if I need to store some credentials for an app, and I use a Settings.bundle so that the password is entered into a PSTextFieldSpecifier textfield in Apple's Settings area with IsSecure = YES, and then I access the value from my app using CFPreferencesCopyAppValue, never writing it out to NSUserDefaults and only sending it over the network securely, how secure is that storage and retrieval method when compared to storing and retrieving the password using the keychain in my own app settings? Thanks for your input.

推荐答案

CFPreferencesCopyAppValue 访问使用 NSUserDefaults 时获得的相同信息。在安全性方面，功能是完全相同的。也就是说，它不加密。它只是在它的模糊的意义上是安全的。 正确的答案是使用钥匙串。

CFPreferencesCopyAppValue is just the Core Foundation way of accessing the same information you get when using NSUserDefaults. In terms of security, the features are exactly the same. That is, it's not encrypted. It's secure only in the sense that it's obscured. The "correct" answer is to use the keychain.

计数器是许多应用程序使用 NSUserDefaults 存储密码。你可以认为，除非密码控制访问任何值的信息，否则尝试使用钥匙串是不值得的。这引出了第二个参数，赞成在设置应用程序中使用安全字段：keychain API是可怕的，根据我的经验，至少，编写无错码是棘手的。

The counter to that is that many applications use NSUserDefaults to store passwords. You could argue that unless the password controls access to information of any value then it's not worth the effort in trying to use the keychain. Which brings me to the second argument in favour of using a secure field in the Settings application: the keychain API is hideous and, in my experience at least, writing error-free code is tricky.

这篇关于在Settings.bundle中存储密码并使用CFPreferencesCopyAppValue获取的安全影响的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！