WWDC 2015

Security and Your Apps

This session focuses on the security of Apple provided in OS X and iOS.

App Transport Security

Apps build against with iOS 9 and OSX 11 cannot make HTTP connections. Add exceptions on info.plists for each insecure domain.

System Integrity Protection

Multi-layered protections for OSX.

OSX 11 will move all third-party binary to user-space from system locations.

The Keychain and Touch ID

Keychain

specialized databases
optimized for searching attributes
efficiently storing for small payload

Consideration

turn keychain code into a sample and testable unit
User the highest data protection level
- Default kSecAttrAccessibleWhenUnlocked
- Background apps kSecAttrAccessibleAfterFirstUnlock
- Deprecated kSecAttrAccessibleAlways

Reducing Password Prompts

Web and native app shared web credentials
- Add App entitlement Associated Domains for actual devices
  - webcredentials:www.example.com
- Server JSON (https://example.com/apple-app-site-association)
```
//sample json:
{
"webcredentials":
{
"apps": [
  "YWBN8XTPBJ.com.example.app",
  "YWBN8XTPBJ.com.example.app-dev"
]
}
}
```

//saving to shared container
let user = "[email protected]"
let password = SecCreteSharedWebCredentialPassword().takeRetainedValue()
SecAddSharedWebCredential("www.example.com", username, passwoed) { error in print(error) }
//Retrieving from safari
SecRequestSharedWebCredential("www.macosforge.org", .None)
{ credentials, error in
    if CFArrayGetCount(credentials) > 0 {
        let dict = unsafeBitCast(CFArrayGetValueAtIndex(credentials, 0),
        CFDictionaryRef.self) as Dictionary
        let username = dict[kSecAttrAccount as String]
        let password = dict[kSecSharedPassword as String]
        login(username, password)
    }
}

iCloud Keychain

For all passwords that can be used on multiple devices
- Add kSecAttrSynchronizable to all SecItem calls
Warning
- Updating or deleting items will affect items on ALL devices
- Check SecItem.h
- Check iOS security whitepaper

Device Specific Credentials

Examples

Limited use tokens and cookies
Encrypted messaging keys
Keys with specific protection requirements

Use Touch ID when :

Replace existing security barrier
Adding one when it would have been too inconvenient before
Examples
- Viewing especially sensitive data
- Confirming an operation