6
\$\begingroup\$

If I need to obfuscate an iPhone password that is hardcode (Oauth Client Identifier and Client Secret), would this be a way to do it?

NSString *a = @"a";
NSString *b = @"b";
NSString *c = @"c";
NSString *d = @"d";
NSString *e = @"e";
NSString *f = @"f";
NSString *g = @"g";
NSString *h = @"h";
NSString *i = @"i";
/*    hidden     */
NSString *w = @"w";
NSString *x = @"x";
NSString *y = @"y";
NSString *z = @"z";

NSString *pwd = [NSString stringWithFormat:@"%@%@%@%@%@%@%@%@", p,a,s,s,w,o,r,d];

I know obfuscate isn't recommended but after reading this Oauth secrets in mobile apps it seems like the only way.

\$\endgroup\$
8
\$\begingroup\$

A slightly better option that takes a little more effort up front but saves a lot of time in the long run, and makes the code more readable (and the obfuscated word harder to crack) would be to follow this pattern...

First, create an NSString class category and fill that category with a readonly property for every character.

@interface NSString (Obfuscater)

@property (readonly) NSString *a;
@property (readonly) NSString *b;
@property (readonly) NSString *c;
// etc...

@end

Now, we write the accessor method, which will follow this pattern:

- (NSString *)a {
    return [self stringByAppendingString:@"a"];
}

And how does this work?

NSString *password = @"".p.a.s.s.w.o.r.d;

This is about the same as nesting stringByAppendingString: several times, with the inner most call being:

[@"" stringByAppendingString:@"p"];

We start with an empty string and append the first character, etc.

Now, this version, compared to the one proposed in the question, is slower, and becomes noticeably more slower with exceptionally long strings, but the obfuscation is better and the working code is more readable.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.