9:26 a.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Hi Nathaniel,
I've changed FreeOTP to use the Keychain to store the tokens (and
migrate anything present in NSUserDefaults).
The patches are attached and you can also view the changes here:
https://github.com/lbschenkel/FreeOTP-iOS/compare/keychain?diff=unified&a...
Note that I'm being very conservative and using
'kAccessibleWhenUnlockedThisDeviceOnly', so tokens will only be stored
in the device and will not be able to be transported to any other
device nor will be present in any backups. That should make the app be
as secure (assuming no security bugs in the iOS platform) as hardware
tokens.
Instead of using the raw Keychain API, which is very cumbersome and
hard to use (and read), I've decided to incorporate the FXKeychain
wrapper (from here: https://github.com/nicklockwood/FXKeychain). It
has the advantage of keeping TokenStore.m mostly unchanged and it has
a compatible license — and IMHO its code is pretty readable and has
good quality.
The commits are small on purpose to make each change easier to review.
Please let me know if you believe something can be improved.
Cheers,
Leonardo.
On 13/02/15 16:32, Nathaniel McCallum wrote:
On Tue, 2015-02-10 at 21:42 +0100, Leonardo Brondani Schenkel
wrote:
> Hi,
>
> Is there any reason why the iOS app the NSUserDefaults mechanism
> to store the secrets instead of the Keychain? It's not really
> considered a good practice to use the former to store secrets.
Nope. There isn't really a good reason.
> If there is no strong reason, would a patch that uses the
> Keychain be considered for inclusion into a future release?
Yes, I would consider it. The most important thing is that upgrades
be handled smoothly.
Nathaniel _______________________________________________
freeotp-devel mailing list freeotp-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/freeotp-devel
-----BEGIN PGP SIGNATURE-----
iQIcBAEBCgAGBQJU412RAAoJEAU3Aegu0h2/5tQQAOLJoQKz93OCsyP5KRCdbi5n
7NFvYyet/OzknsNBkDw49sm1V3iLOoZVjgwgkBA0KV9Nh18j6CniwMYYDDfKK2nW
PZuNyAxRQmx2ACMhRc3r5nthCYW+CdjrQCcKWECEy8WP4cseDlALNy3M22lSdZoO
90qkybCcss/GY4iT3Gdlt15puHbhqqmuIW0Sh3mpZTIdkswdx5ywlqBmyLv4VMVa
HzhB2wE2diEShWDNsj6B7wIzpmvYuGsuHdvDy8n4mxBK6lbl/LoZNPxpWhSjmEPk
5GPAKJoBhJlyDGndlphtUdtE0aBvA5YdQMnhPmQJoSudRiGyH9Q28ri42mvI9Kg/
++54dTaExU5Qvj4ooxijGK6bbFKUeglmpwQRl9IJdi8nFIB+clMxJTurxsuhmCmB
bFK+Ey8FWCdK04STiVS1Kfjc29+q4NWWJ5n4vN4DOL5kncqTuBiXn/wT+JgtH4+x
qgAB+MfzR7I1alJPfCqmDdua58QBgNPXKFMagU9dI8LT2ZKZDkFihNj7yWpG7J7q
Tpa8WblPAOIcZGeYf4diodk5C8tiZYnblGcifO6yCsfKdv4cj6PU8LVOPLzKaYPs
NMjVJZaWw3Czhf6pRvShTJ1+0LwCNQzXKIwJIAn4Z2ur79H1MKF4SYKsySrkw2MV
yRbPyWGqad76mmTiwpDl
=ZwwC
-----END PGP SIGNATURE-----