title: Best practices for iOS applications security
body: <p>When thinking about iPhone/iPad applications security, I can notice that there is:</p>
  
  <ul>
  <li>Widely available hacking tools allow filesystem access</li>
  <li>Network interception, men in the middle attack </li>
  </ul>
  
  <p>==> data theft threat</p>
  
  <p>and also:</p>
  
  <ul>
  <li>Availability of hacking tools that allow to freely share a paid app with friends/community (seen in Cydia)</li>
  <li>Availability of hacking tools that allow to get in app purchases without paying (seen in Cydia, and heard that it doesn't work with any app) </li>
  </ul>
  
  <p>==> Revenue loss threat</p>
  
  <p>So I am wondering #1 <strong>what are best practices to get a better security in iOS application?</strong>
  Also, #2 <strong>what are best ways to reduce revenue loss and minimise hacking exposure</strong>?</p>
  
  <p>for #1
  I've seen some WWDC slides about security
  <a href="http://adcdownload.apple.com//wwdc_2010/wwdc_2010_video_assets__pdfs/204__creating_secure_applications.pdf" rel="noreferrer">1</a> <a href="http://adcdownload.apple.com//wwdc_2011/adc_on_itunes__wwdc11_sessions__pdf/202_security_overview.pdf" rel="noreferrer">2</a> <a href="http://adcdownload.apple.com//wwdc_2011/adc_on_itunes__wwdc11_sessions__pdf/208_securing_ios_applications.pdf" rel="noreferrer">3</a> <a href="http://adcdownload.apple.com//wwdc_2010/wwdc_2010_video_assets__pdfs/209__securing_application_data.pdf" rel="noreferrer">4</a>
  + <a href="https://developer.apple.com/library/ios/#documentation/Security/Conceptual/SecureCodingGuide/Introduction.html" rel="noreferrer">apple docs</a> </p>
  
  <p>and I can say that between theses best practices there are:</p>
  
  <ul>
  <li>Using APIs Offering Data Protection (like NSFileManager with NSFileProtectionKey attribute)</li>
  <li>Using Keychain</li>
  <li>Protecting sensitive data with SSL and using certificates </li>
  </ul>
  
  <p>for #2
  I think that using a business model based on free application, then in app purchase with Store Receipts verification can be the model with minimum revenue loss.</p>
  
  <p>What are your best practices for security, and best way to minimise app hacking chances?</p>