iOS: Storing Non-User password

Question

I need to store third-party username/password in my iOS application, what is the best and most secure way to do this? When my app first runs, it will need to talk to Google's Picasa to download private pictures to use for the app. To talk to Picasa, I have to provide my username/password and storing in the code is not secure at all.

I've search the web, I see Keychain came up a lot, but how exactly do I pre-load my password into keychain ?

Is there a configuration file in xCode somewhere to store passwords needed for web-services?

Thanks

Answer 1

Think that you need to store the password in encrypted form. Pick some encrypting algorithm, generate the encrypted details. And in code have some method to decrypt it when needed.

You just don't want someone who would read your code as plain text to see the password.

Think that something as simple as splitting the password into separate strings and later joining them could be enough.

Here for example You have encrypted in code "My1Password":

#define R1        @"My" 

#define R2        @"Password"

+ (NSString *)generatePass{ return [NSString stringWithFormat:@"%@%@%@, R1, @(1), R2]; }

Answer 2

This is a response to krzysztof above:

I'm in a catch-22 situation here as I can't seem to grasp the concept of feeding the password as parameter to another function. Aside from avoid others reading the source code in plain text, can't hackers obtain the binary file and reverse engineer to read the password in the source code (R1 & R2 in this case)???

Back to encryption, lets take the following line of code which Encrypt/Decrypt data:

NSData *encryptedImage = [RNEncryptor encryptData:imageData withSettings:kRNCryptorAES256Settings password:@"A_SECRET_PASSWORD" error:nil];


NSData *decryptedData = [RNDecryptor decryptData:data withSettings:kRNCryptorAES256Settings password:@"A_SECRET_PASSWORD" error:nil];

This is where I'm stuck... where do I store A_SECRET_PASSWORD ?