How Would You Securely Store Private User Data Offline On A Device? W

1.	How Would You Securely Store Private User Data Offline On A Device? What Other Security Best Practices Should Be Taken?
Answer» Again there is no right answer to this, but it's a great way to see how much a person has dug into iOS SECURITY. If you're interviewing with a bank I'd almost definitely expect someone to know something about it, but all COMPANIES need to take security seriously, so here's the ideal list of topics I'd expect to hear in an answer: If the data is extremely sensitive then it should never be stored offline on the device because all devices are crackable. The keychain is ONE option for storing data securely. However it's encryption is based on the pin code of the device. User's are not forced to set a pin, so in some situations the data may not even be encrypted. In addition the users pin code may be easily hacked. A better solution is to use something like SQLCipher which is a fully encrypted SQLite database. The encryption key can be enforced by the application and separate from the user's pin code. Other security best practices are: Only communicate with remote servers over SSL/HTTPS. If possible IMPLEMENT certificate pinning in the application to prevent man-in-the-middle attacks on public WiFi. Clear sensitive data out of memory by overwriting it. Ensure all validation of data being submitted is ALSO run on the server side. Again there is no right answer to this, but it's a great way to see how much a person has dug into iOS security. If you're interviewing with a bank I'd almost definitely expect someone to know something about it, but all companies need to take security seriously, so here's the ideal list of topics I'd expect to hear in an answer: If the data is extremely sensitive then it should never be stored offline on the device because all devices are crackable. The keychain is one option for storing data securely. However it's encryption is based on the pin code of the device. User's are not forced to set a pin, so in some situations the data may not even be encrypted. In addition the users pin code may be easily hacked. A better solution is to use something like SQLCipher which is a fully encrypted SQLite database. The encryption key can be enforced by the application and separate from the user's pin code. Other security best practices are:

How Would You Securely Store Private User Data Offline On A Device? What Other Security Best Practices Should Be Taken?

Answer»

Again there is no right answer to this, but it's a great way to see how much a person has dug into iOS SECURITY. If you're interviewing with a bank I'd almost definitely expect someone to know something about it, but all COMPANIES need to take security seriously, so here's the ideal list of topics I'd expect to hear in an answer:

If the data is extremely sensitive then it should never be stored offline on the device because all devices are crackable.

The keychain is ONE option for storing data securely. However it's encryption is based on the pin code of the device. User's are not forced to set a pin, so in some situations the data may not even be encrypted. In addition the users pin code may be easily hacked.

A better solution is to use something like SQLCipher which is a fully encrypted SQLite database. The encryption key can be enforced by the application and separate from the user's pin code.

Other security best practices are:

Only communicate with remote servers over SSL/HTTPS.
If possible IMPLEMENT certificate pinning in the application to prevent man-in-the-middle attacks on public WiFi.
Clear sensitive data out of memory by overwriting it.
Ensure all validation of data being submitted is ALSO run on the server side.

Again there is no right answer to this, but it's a great way to see how much a person has dug into iOS security. If you're interviewing with a bank I'd almost definitely expect someone to know something about it, but all companies need to take security seriously, so here's the ideal list of topics I'd expect to hear in an answer:

If the data is extremely sensitive then it should never be stored offline on the device because all devices are crackable.

The keychain is one option for storing data securely. However it's encryption is based on the pin code of the device. User's are not forced to set a pin, so in some situations the data may not even be encrypted. In addition the users pin code may be easily hacked.

A better solution is to use something like SQLCipher which is a fully encrypted SQLite database. The encryption key can be enforced by the application and separate from the user's pin code.

Other security best practices are:

How Would You Securely Store Private User Data Offline On A Device? What Other Security Best Practices Should Be Taken?

Discussion

No Comment Found

Related InterviewSolutions

Reply to Comment