Storing OAuth keys in code for iPhone apps

I'm writing an iPhone app that integrates with third party APIs. These APIs use OAuth开发者_JAVA百科 (key/secret specific to my app not per user) in order to authenticate which app the request is being made in behalf of.

Is it secure (or how secure) is it to simply put the key/secret in code? Can this sort of data be reverse-engineered? Is there a better way to go about including this data in a project?

There is no place on the iPhone to hide data. A user with a jailbroken iPhone has more control over the device than any developer. If possible you should setup a web service such as a REST or SOAP service to take care of these OAuth transactions on behalf of the client.

As Rook said earlier, there is no way to hide your data in iPhone. But you can make hacker job so difficult. I just done a work around for the same issue.

1. Put oAuth key information in PLIST
2. Mannually I encrypt this PLIST by using AES key and I got encrypted "CIPHER TEXT"
3. Modify the AES key by appending characters in between with your own logic. Since it required at runtime to decrypt the plist
4. Add this modified key with plist "CIPHER TEXT" and store this value in New plist.
5. Remove old plist which has oAuth information

Now you have only one plist which has encrypted value with modified KEY

Advantage:

1. Hacking is so difficult since hacker don't have a proper cipher text in plist

2. To hack this code they should know to separate Modified AES key from Cipher text.

3. Thou they found Modified AES key, they don't have any clue about the appending algorithm, here i simple used EVEN position of the character, but you can't modify this and you can take 3rd or 4th position of the character. Which is actually will differ for each developer

for more information please visit below link;

https://sites.google.com/site/greateindiaclub/mobil-apps/ios/securelystoringoauthkeysiniosapplication

I'd suggest looking into the Keychain services provided by Apple

http://developer.apple.com/library/ios/#documentation/Security/Conceptual/keychainServConcepts/01introduction/introduction.html