Security in iOS/Mac OS development
Privacy is no joke. In recent years, it’s becoming a bigger topic in headlines. Edward Snowden, Cambridge Analytica, celebrity stolen accounts like Donald Trump and Jeff Bezos just to name a recent few. We are going from “hey, I have nothing to hide” to “WHAT? ANYONE CAN USE MY PERSONAL DATA?” and companies, especially Apple, exploit that. Privacy and security gets a huge chunk in press releases of any product launch, and it works. At least it worked for me.
I don’t feel in danger installing anything from the App Store. I’m not looking for any crappy default software when buy new iPhone or Mac.
Rule of thumb is don’t do anything shady, like a jailbreak, use apps which are tightly integrated with the system and you’ll be safe. So when we started building safe space, we decided to challenge that. What exactly safe mean and is there options to bypass system security or is it always people to blame in all the data breaches?
What are we trying to achieve?
The goal is to have a solution similar to default Photos app on iOS but with an additional layer of security. The UX would be simple, with a password on a launch screen and photos after. But if for any reason your iCloud or/and device gets stolen. Files would be encrypted and there is no way to open them without a passcode.
Similar to end-to-end encrypted chats. Messages can be stolen but can’t be read.
Sounds simple, but it’s not. So we spend 8 months building and digging security and encryption options.
Key moments which we need:
- None of the unencrypted files should be passed over the internet
- Since we are dealing with sensitive data, user should be able to restore files without accessing internet if needed. (Given the files itself are downloaded)
- Minimum or ideally no reliance on server side
- Using default iOS tools for encryption
Let's go over all the secure options we can use for storing secure data:
Custom server
That's the most straightforward solution. Get user's files encrypt them and hide on remote location. This way which is used by the most apps and the first reason we are building Safe Space.
Storing all users data in single place creates a huge security risk. If server gets compromised data of all users gets compromised. Server security is brutal and hard, data leaks are frequent. That's why that approach require high level of maintenance and as a result cost.
- Subscription price is inevitable.
- high risk of compromising all the data
Keychain
Keychain is Apple default answer for storing sensitive data.
You can save password to keychain like in normal password manager or you can create secure field which can be accessed in the app but won't be visible to the user.
That's a great place to store things, since even if your iCloud get stolen 2fa is required to enable keychain. If the device gets stolen biometrics is required to access keychain data
- Although keychain data is encrypted. Using that data is open. If the app get compromised, password potentially can be stolen during execution.
Secure Enclave
Each iOS device from iPhone 7 and MacBook with T1+ chip has a dedicated processor specifically for encryption. It's like a separate computer with its own ram, processor and OS. You can ask that coprocessor to do the encryption or decryption of the data. But that processor never share private keys and can't accept private keys from host OS. Which means each device encrypts its data differently.
- The best level of security, but slow execution time and no way to encrypt/decrypt the same data on multiple devices
In safe space, we decided to go with Keychain. We don't store you password anywhere. Each time you log in on a new device and enter the password, we encrypt it and store in a secure keychain field. That way each device has it's own encrypted version of a secured key and that's the only way to decrypt the same shared data on multiple devices. Using a strong password and ideally storing in a separate location will allow storing files in iCloud without ever worrying about losing your iPhone or access. Stay safe ✌️
if you want to join our iOS test program, please click
https://2ufis92j26w.typeform.com/to/JOMif1CO
