Skip to content
This repository has been archived by the owner on Aug 24, 2019. It is now read-only.

Commit

Permalink
Better document security issues
Browse files Browse the repository at this point in the history
Based on @hashier's pull request in
#42 this better documents that
`AccessibilityType` really should be set. It does not change any
defaults but only updates documentation accordingly. So it is 100%
backwards compatible but should help developers to make an informed
decosion about how to store items in the keychain.
  • Loading branch information
Maximillian Dornseif authored and soffes committed Mar 11, 2016
1 parent 6dd2718 commit 1b5fb6c
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 1 deletion.
6 changes: 6 additions & 0 deletions Readme.markdown
Expand Up @@ -34,11 +34,13 @@ SSKeychain has the following class methods for working with the system keychain:
+ (NSArray *)accountsForService:(NSString *)serviceName;
+ (NSString *)passwordForService:(NSString *)serviceName account:(NSString *)account;
+ (BOOL)deletePasswordForService:(NSString *)serviceName account:(NSString *)account;
+ (void)setAccessibilityType:kSecAttrAccessibleAfterFirstUnlock;
+ (BOOL)setPassword:(NSString *)password forService:(NSString *)serviceName account:(NSString *)account;
```

Easy as that. (See [SSKeychain.h](https://github.com/soffes/sskeychain/blob/master/SSKeychain/SSKeychain.h) and [SSKeychainQuery.h](https://github.com/soffes/sskeychain/blob/master/SSKeychain/SSKeychainQuery.h) for all of the methods.)


## Documentation

### Use prepared documentation
Expand Down Expand Up @@ -69,6 +71,10 @@ Obviously, you should do something more sophisticated. You can just call `[error
Working with the keychain is pretty sucky. You should really check for errors and failures. This library doesn't make it any more stable, it just wraps up all of the annoying C APIs.
You also really should not use the default but set the `accessibilityType`.
`kSecAttrAccessibleWhenUnlocked` should work for most applications. See
[Apple Documentation](https://developer.apple.com/library/ios/DOCUMENTATION/Security/Reference/keychainservices/Reference/reference.html#//apple_ref/doc/constant_group/Keychain_Item_Accessibility_Constants)
for other options.
## Thanks
Expand Down
5 changes: 4 additions & 1 deletion Sources/SSKeychain.h
Expand Up @@ -186,7 +186,10 @@ extern NSString *const kSSKeychainWhereKey;
@param accessibilityType One of the "Keychain Item Accessibility Constants"
used for determining when a keychain item should be readable.
If the value is `NULL` (the default), the Keychain default will be used.
If the value is `NULL` (the default), the Keychain default will be used which
is highly insecure. You really should use at least `kSecAttrAccessibleAfterFirstUnlock`
for background applications or `kSecAttrAccessibleWhenUnlocked` for all
other applications.
@see accessibilityType
*/
Expand Down

0 comments on commit 1b5fb6c

Please sign in to comment.