5

I started a few weeks ago to develop my first IOS app and it requires Twitter and Facebook Login.

I am very surprised about the different approaches that both platforms take in terms of security/authentication.

Facebook uses the IOS Bundle ID approach, which seems great, since every Bundle ID is unique and you cannot publish an app Bundle ID in behalf of another user, so is pretty easy for Facebook to figure out if your are who you say you are.

Twitter uses his traditional Key/Secret pair that uses in Web/REST applications in IOS as well, while it works for the Web because you don't need to expose those keys to the Client, that is not the case for IOS applications.

According with the official documentation

"To initialize the Twitter Kit with your app’s credentials, pass them to startWithConsumerKey:consumerSecret:"

"Calling startWithConsumerKey:consumerSecret: will override any keys which were automatically configured. Automatically configured keys live in your app’s Info.plist under the key"

My understanding is that even if I use my keys, or I use the keys generated by Fabric, those will be exposed on the plist which is a non-secure method to store private keys.

I am sure I am missing something here, please clarify me how it works.

  • I am interested to an answer for this as well. I have brief inputs over here as I believe storage of plist in context of reading data is very crucial from end-user perspective and as for reading data: plist data is not secure at all - getting plist content is easier and wouldn't even require any devices. Here, anyone could access a .plist file from the device itself unless hard coded in a class which is a much more secure way. – Shritam Bhowmick Dec 10 '15 at 16:07

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.