Search code examples
ioskeychain

Is keychain item created by app safe without access control?

I'm saving a secret in keychain in my app without access control. From what I've searched the item should be only accessible by my app.

Is there anyway to compromise this keychain item? e.g can a hacker install a fake app with same bundle identifier to replace my app and get my keychain item?

Solution

  • iOS has a single keychain that is accessible when the device is unlocked. Only your app(or set of apps if you have keychain sharing set up), has access to the keychain items you store. But if your device is jailbroken there are ways to steal items from the keychain. See this tutorial has some good info on Keychain best practices:

    ios App Security Ray Wenderlich

    From the above site:

    Although Keychain Access is more secure, it is also a high-priority target. For jailbroken iOS devices there are command line utilities that print out the Keychain Access database’s contents.