0

I want to store a local player's high score in the iOS game. What is the best way to approach it? Should I use NSUserDefaults in this case? Is it safe enough to store a high score?

Thanks in advance.

7 Answers 7

4

NSUserDefaults is not correct place to store this kind of information. The best way is to hide the user score in Keychain, so that noone can crack it (perhaps the game score is relevant to your monetization idea).

Other good thing is that Keychain is seamless syncable via iCloud, "it's just works".

The best way to store player's high score is to use following code in your project. Following method will help you to save some value in Keychain:

- (void) setValue: (NSData *) value forAccount: (NSString *) account service: (NSString *) service {
    NSDictionary *searchDict = @{
        (__bridge id) kSecClass: (__bridge id) kSecClassGenericPassword,
        (__bridge id) kSecMatchLimit: (__bridge id) kSecMatchLimitOne,
        (__bridge id) kSecAttrService: service,
        (__bridge id) kSecAttrAccount: account,
        (__bridge id) kSecReturnData: @YES,
    };
    CFDataRef keyData = NULL;
    SecItemCopyMatching ((__bridge CFDictionaryRef) searchDict, (CFTypeRef *) &keyData);

    if (keyData) {
        CFRelease (keyData);
        NSDictionary *removeDict = @{
            (__bridge id) kSecClass: (__bridge id) kSecClassGenericPassword,
            (__bridge id) kSecAttrService: service,
            (__bridge id) kSecAttrAccount: account,
        };
        SecItemDelete ((__bridge CFDictionaryRef) removeDict);
    }

    if (value) {
        NSDictionary *writeDict = @{
            (__bridge id) kSecClass: (__bridge id) kSecClassGenericPassword,
            (__bridge id) kSecAttrService: service,
            (__bridge id) kSecAttrAccount: account,
            (__bridge id) kSecValueData: value,
        };
        SecItemAdd ((__bridge CFDictionaryRef) writeDict, NULL);
    }
}
  • where value is your user score archived into NSData

to pack integer into NSData:

NSUInteger score = <some number>;
NSData *dataValue = [NSData dataWithBytes:&score length:sizeof(score)];

to unpack:

NSUInteger score;
[dataValue getBytes:&score length:sizeof(score)];
  • account - is the name of your value, for example @"userScore", or score for certain user @"ForzenHeart_Score"
  • service - is the name of your application, you can use your bundle ID [[NSBundle mainBundle] bundleIdentifier]

To get saved data from Keychain you use this method:

- (NSData *) valueForAccount: (NSString *) account service: (NSString *) service {
    NSDictionary *searchDict = @{
        (__bridge id) kSecClass: (__bridge id) kSecClassGenericPassword,
        (__bridge id) kSecMatchLimit: (__bridge id) kSecMatchLimitOne,
        (__bridge id) kSecAttrService: service,
        (__bridge id) kSecAttrAccount: account,
        (__bridge id) kSecReturnData: @YES,
    };
    CFDataRef keyData = NULL;
    SecItemCopyMatching ((__bridge CFDictionaryRef) searchDict, (CFTypeRef *) &keyData);
    return (__bridge_transfer NSData *) keyData;
}

And don't forget to wipe all user related data when you have to, simply by passing nil as value parameter for -(void)setValue... method listed above.

1

NSUserDefaults is not safe because the defaults are actually keyed into a .plist file stored locally on the device in your application folder. This is the directory: .../YourApp.app/Library/Preferences/appBundleName.plist. This can very easily be modified and viewed with tools on and off the device, and no jail-break is required for off-device viewing. As other's have suggested, use the iOS Keychain for it's added security. Also, here is an open-source library for secure defaults in iOS: Secure-NSUserDefaults.

To answer your question directly, it is not safe enough for any sensitive data that you do not want the user modifying indirectly. NSUserDefaults can easily be accessed and modified with little effort. Do not store encrypted data in NSUserDefaults because that too can easily be accessed as well. The attacker won't easily be able to decrypt the data but they can still access it nonetheless with ease. The iOS Keychain is also not very secure either because the contents can be dumped easily too but not decrypted. For your purposes though, the iOS Keychain is fine.

0

NSUSerDefaults in never safe.

Either use iOS Keychain or upload the data to your server (the most reliable way)

6
  • Why the NSUSerDefaults isn't safe? Jul 20, 2014 at 13:59
  • @FrozenHeart here's the detailed explanation - andyibanez.com/nsuserdefaults-not-for-sensitive-data Jul 20, 2014 at 14:02
  • I think question is not about hiding/securing high score but is it NSUserDefaults is reliable or not.
    – modusCell
    Jul 20, 2014 at 14:04
  • @mohacs reliable for what? Being hacked externally - no. Reliable for saving data? - Oh yeah. Jul 20, 2014 at 14:05
  • I think it is about is it reliable for saving data not security wise.
    – modusCell
    Jul 20, 2014 at 14:06
0

No NSUserDefaults is not safe.You can use Keychain.

The contents of NSUserDefaults are stored in plain text. They can be accessed and modified with tools like iExplorerwihout the jailbreak.

If that is not the issue you can go for NSUserDefaults

0

Generally, NSUserDefaults should only contain settings that can be changed by the user. Internal data of your app should not be stored in NSUserDefaults.

Use iOS Keychain to store really secure data.

Alternatively, you could use a cryptographic algorithm (e.g. AES) to encrypt the data you store in NSUserDefaults, or save it in a dictionary and write it to a file.

0

Do not use NSUserDefaults to hold anything locally. It is not secure. You should store score in the keychain where it is encrypted, there's small wrapper class that makes saving username/password into the keychain very easy:

Click here to Know more

0

I often choose coredata something like these situations. There are lots of handy & safe framework about this. Nowadays I use MagicalRecord framework. It's useful and commonly used framework.

You just create your model and decare magical record framework to your AppDelegate.m file. And anywhere you want save data properly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.