Security issue: Keychain Item Accessibility Constants missing

[KaiOelfke]

Hi,

you should add the kSecAttrAccessibleWhenUnlocked value for the kSecAttrAccessible key. If you don't do that the keychain information can be hacked easily.

More information: http://stackoverflow.com/questions/3558252/ios-keychain-security

https://developer.apple.com/library/ios/#documentation/Security/Reference/keychainservices/Reference/reference.html#//apple_ref/doc/constant_group/Keychain_Item_Accessibility_Constants

Thank you =)

[mattgreen]

+1 to this.

[d0n13]

Yes, I'd like to be able to set kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly

Anyone care to show where the easiest place to put this would be?

[d0n13]

From line 90 in ACSimpleKeychain.m

- (BOOL)storeUsername:(NSString *)username password:(NSString *)password identifier:(NSString *)identifier info:(NSDictionary *)info forService:(NSString *)service
{
    if ([self deleteCredentialsForUsername:username service:service] &&
        [self deleteCredentialsForIdentifier:identifier service:service])
    {
        NSMutableDictionary *dictionary = [NSMutableDictionary dictionaryWithObjectsAndKeys:
                                           (__bridge id)(kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly), (__bridge id)kSecAttrAccessible,
                                           (__bridge id)kSecClassGenericPassword, (__bridge id)kSecClass,
                                           [username dataUsingEncoding:NSUTF8StringEncoding], (__bridge id)kSecAttrAccount,
                                           [identifier dataUsingEncoding:NSUTF8StringEncoding], (__bridge id)kSecAttrGeneric,
                                           [service dataUsingEncoding:NSUTF8StringEncoding], (__bridge id)kSecAttrService, nil];
        [dictionary setValue:[password dataUsingEncoding:NSUTF8StringEncoding] forKey:(__bridge id)kSecValueData];
        NSMutableData *miscData = [NSMutableData data];
        NSKeyedArchiver *archiver = [[NSKeyedArchiver alloc] initForWritingWithMutableData:miscData];
        [archiver encodeObject:info forKey:ACKeychainInfo];
        [archiver finishEncoding];
        [dictionary setValue:miscData forKey:(__bridge id)kSecAttrComment];
        OSStatus status = SecItemAdd((__bridge CFDictionaryRef)dictionary, NULL);
        return (status == errSecSuccess);
    }
    return NO;
}

Hope that helps. Donie