Prioritize user privacy and data security in your app. Discuss best practices for data handling, user consent, and security measures to protect user information.

All subtopics
Posts under Privacy & Security topic

Post

Replies

Boosts

Views

Activity

Privacy & Security Resources
General: Forums topic: Privacy & Security Privacy Resources Security Resources Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"
0
0
1.3k
Jul ’25
Changing a Keychain's password with Security.framework
I'm able to create a custom keychian using:OSStatus SecKeychainCreate(const char *pathName, UInt32 passwordLength, const void *password, Boolean promptUser, SecAccessRef initialAccess, SecKeychainRef *keychain);Once that keychain is created however, I want to be able to change the password used to unlock the keychain periodically. So far, I have not found the corresponding SecKeychain* method to do that.The following command works in terminal "/usr/bin/security set-keychain-password ...." but how to in the Security framework?
3
0
1.3k
Nov ’21
Keychain write errSecNotAvailable
What could cause the errSecNotAvailable error (-25291) to be returned from a keychain write? I see from the documentation "No trust results are available," [1]. Is that something that can be remedied on a retry of the same keychain query, is there some action that can be taken to fix the error programmatically, or does the user have to do something on the device to fix this? I see one comment indicating the device would need to be restarted [2].[1] https://developer.apple.com/library/ios/documentation/Security/Reference/keychainservices/#//apple_ref/c/econst/errSecNotAvailable[2] http://fossies.org/linux/fpcbuild/fpcsrc/packages/univint/src/SecBase.pas
12
0
10k
Feb ’23
SecIdentityRef without importing (SecPKCS12Import) into the keychain
How can I get an SecIdentityRef without adding to the keychain?Running a secure web server using CocoaAsyncSocket requires an array of certificates where the first item is a SecIdentityRef. (The 2nd item is a SecCertificateRef which I can succesfully obtain using SecCertificateCreateWithData from my .pfx file containing the public and private keys).The examples I have seen add the certificate to the keychain (using SecPKCS12Import) in order to get a SecIdentityRef, but I don't want to modify the keychain at all. (Note: my certificate is trusted by a root certificate which is already in the keychain).Any advice is welcome. Thanks.
11
0
6.2k
Apr ’23
Create an X.509 certificate progamatically
Hi,Is it possible to create an X.509 certificate using only the system security frameworks? Basically I would like to implement a CA locally.The docs say it's "possible to create X.509 certificates", quote: Certificate, Key, and Trust Services Certificate, Key, and Trust Services is a C API for managing certificates, public and private keys, symmetric keys, and trust policies in iOS and OS X. You can use these services in your app to:Create certificates and asymmetric keysBut in the reference docs all I can find is reading existing certificates from DER/PEM/PKCS#12 sources. I would like to avoid using OpenSSL to do this.Kind Regards,Alex
4
0
1.6k
Mar ’23
App Transport Security due date
There seems to be an unclear statement on whether ATS is going to be required to be ON in order to continue submitting to the app store. Do we know if there is a date for ATS to be a requirement? Or did they just leave it at "Opt-out" for the time being?
8
0
7.7k
Jan ’22
App Integrity
Hi,Is there any means by which i can identify or get the hash value of the certificate with which Apple signed my application before uploading it on AppStore? So that i can use this value to verify appliation integrity at runtime.
10
0
14k
Mar ’22
Intermittent -34018 errors from users in the field
This thread is the place to post if:you’re encountering -34018 errors being returned by the Security frameworkthe problem is intermittent, that is, it shows up very occasionally on user devices in the field but is otherwise hard to reproduceIMPORTANT Error -34018 has other causes. Before posting here, make sure to read the Error -34018 errSecMissingEntitlement pinned post.Apple has been tracking an issue where Security framework APIs can return -34018 on some user devices in the field. The typical observed behaviour is:After running successfully for a while, your app starts receiving -34018 from various Security APIs, most commonly the keychain APIs.Those errors persist until the app is terminated and relaunched (or the device is restarted).The problem shows up intermittently on a small percentage of user devices in the field.The problem only affects iOS-based platforms (iOS, watchOS, tvOS).Apple has been working hard to investigate this issue and believes we have fixed some of its root causes. However, it is a complex problem and it’s possible that there could be others. If you’re still seeing this problem on the latest iOS release, feel free to post your experiences to this thread.Note This thread is the continuation of an older thread here on DevForums; I’ve locked that old thread for reasons explain in the last post on that thread.That thread was itself a continuation of an even older thread on the old DevForums, which became read-only when the old DevForums was decommissioned.Share and Enjoy — Quinn “The Eskimo!” Apple Developer Relations, Developer Technical Support, Core OS/Hardware let myEmail = "eskimo" + "1" + "@apple.com"
18
0
9.2k
Dec ’22
Multi-User Touch ID
Hi All,Just a quick question regarding the upgraded Touch ID and local authentication capabilities.I want to use the built-in fingerprint scanner on a iPad to allow multiple people to log into a custom application, what i want to do is to try and use the fingerprint scanner to save/recall user info that i want to store within my application.as example, an employee picks up an iPad, and by using the fingerprint scanner, while in the an application, the application should read the fingerprint of the employee and match that to a local database, if successful match, it will log the user into the application and display that user's specific information.Would something like this be possible? any other suggestions would really be appreciated as i have everything else working as needed , except for the biometric side.Thank you.
6
0
3.8k
Jul ’23
How to and When to uninstall a privileged helper
I had an application that needs to do very frequent privileged work.I used to achieve these work by AuthorizationExecuteWithPrivileges(). And I would like to follow the recommended way by using SMJobBless with XPC (a privileged helper over XPC communication). However, I got 2 questions about the unstalling the privileged helper (helper for short below).I noticed that SMJobRemove had been marked as deprecated and there is no other API as replacement of it now. So I would like to understand what is the supposed or recommended approach to unstall the helper now?More background of this question:My application can be installed by a simple drag from with the dmg packege. And the uninstall process is also just by draging to the Trash.The first time the app starts, it will try to bless the helper with asking the authentication/authorization from a user. Subsequently, it will not bother users next time startup or when communicating with the helper for privileged works.The reason that I need to uninstall the helper is for the helper version compatibility. There could be multiple versions of the application with potential different version of helpers co-existing in a user's system. So an idea is that each application with an exactly version number will install and communicate with a helper with a specified version as well (i.e. application 1.0.0 <-> helper-100 / application 2.0.1 <-> helper-201 ...). Therefore, to avoid leaking such a number of helpers in the disk when the applications are removed, I would like to unstall (remove) the helper[ver_num] when a specific version of applications are removed.Furthermore, when to trigger the uninstall process?My current idea is that when the first time the application starts, it will register the folder path where the application is in in the helper (over XPC) plist. The helper will then watch the folder change over the paths (if there are multi applications with that version exists). Once all the applications of that version with different paths registered in helper are removed, the helper will fork a subprocess to uninstall the helper (by SMJobRemove??).If the above thinking are not on a correct direction, could you have any suggestion about these 2 questions?
11
0
13k
Nov ’21
errSecInvalidOwnerEdit returned from SecItemDelete
Have an app I'm working on that stores an item in the keychain. Everything was was working fine. I have a button in the UI that allows the user to clear out the keychain item:NSDictionary *query = @{(__bridge id)kSecClass: (__bridge id)kSecClassGenericPassword, (__bridge id)kSecAttrService: service, (__bridge id)kSecAttrAccount: accountKey}; OSStatus status = SecItemDelete((__bridge CFDictionaryRef)(query));Status is -25244 which is errSecInvalidOwnerEdit. This app created the keychain item to begin with. What would be the appropriate way to handle this type of error?
16
0
4.4k
Nov ’23
evaluatedPolicyDomainState unique per app identifier
I have an app and extension (Siri) that I am trying to use TouchID to authenticate an action. The main app has an enrollment process that stores off the evaluatedPolicyDomainState hash value for comparison to ensure the figerprint storage has not changed. This works great for the main app. However in the extension when trying to validate the hash with a stored hash in group storage the hash comes back differently. So it appears that the evaluatedPolicyDomainState hash is different per bundle id. Is that correct. I would have assumed that apps in the same appgroup entitlement would get the same DomainState back. That is the evaluatedPolicyDomainState would be based off of the enclave and app group id and not just app bundle id. Has anyone else run accross this?
4
1
1.3k
Mar ’23
How to create an HTTPS server on IOS using cocoaHTTPServer?
I made a javascript cloud app that runs on a webpage in a webview on my iPad app that communicates via WebSocket connection but it only works when im on my http site and not https or else I get an CFNetwork SSLHandshake failed (-9806) error in Xcode and on the website it says time out during handshake.Is this because the webserver on the iPad is running on HTTP instead of HTTPS?JAVASCRIPT CLOUD APPThis part in the cloud is working for HTTP when connecting to the web server on the iPad.var protocol = "ws"; if (this.useSecureConnection) protocol = "wss"; var url = protocol+'://localhost:'+this.port+'/service'; this.connection = new WebSocket(url);Xcode iOS iPad App (Objective-C)I thought that was the issue so I tried to enable HTTPS but I am not sure what to create for the "sslIdentityAndCertificates" method.- (BOOL)isSecureServer { HTTPLogTrace(); // Override me to create an https server... return YES; } /* * This method is expected to returns an array appropriate for use in kCFStreamSSLCertificates SSL Settings. * It should be an array of SecCertificateRefs except for the first element in the array, which is a SecIdentityRef. **/ - (NSArray *)sslIdentityAndCertificates{ HTTPLogTrace(); return nil; }Some of the other posts I have seen use APIs that are only available on Mac and not iOS.I tried several combinations of ATS permissions as well. All resulted in HTTPS not allowing for WebSocket connection.Any help is greatly appreciated! 🙂More Info:The cloud hosted webapp was built to be used on different devices as a webpage but we needed to add support for bluetooth to connect to a 3rd party hardware. To do that we needed to create a native "wrapper" for the webapp that would get bluetooth messages and process/send messages to the webapp in the webview via webSocket. This allows for the web app to use the bluetooth tool.
6
0
7.9k
Aug ’23
Access to Shared iOS Keychain with WatchOS
Hi,I'm crurently unable to access my app keychain after a long search these are the steps that I've tryed so farFirst of All I'm running on "real" devices not in simulators1. Key chain is enabled for a group, in here I will go for this group "appbundle.sharedkeychain" and the app prefix I'll say that's "1A2B3C4D5E"2. The keychain code is currently implemented on a Framework3. The Framework is a Pod that I've downloaded and tweaked so that worked with a shared keychain witch so far I was unable to.So I created a variable called kSAAGroup witch contains the following string "1A2B3C4D5E.appbundle.sharedkeychain"In the addKeychainFunction I have the following codeprivate func addKeychainItem(withAttributes attributes: [String: AnyObject]) throws -> Data { var mutableAttributes = attributes mutableAttributes[kSecClass as String] = kSecClassGenericPassword mutableAttributes[kSecReturnPersistentRef as String] = kCFBooleanTrue mutableAttributes[kSecAttrSynchronizable as String] = kCFBooleanTrue mutableAttributes[kSecAttrAccessible as String] = kSecAttrAccessibleAlways mutableAttributes[kSecAttrAccessGroup as String] = kSAAGroup as AnyObject? / / if mutableAttributes[kSecAttrAccount as String] == nil { mutableAttributes[kSecAttrAccount as String] = UUID().uuidString as NSString } var result: AnyObject? let resultCode: OSStatus = withUnsafeMutablePointer(to: &result) { SecItemAdd(mutableAttributes as CFDictionary, $0) } guard resultCode == errSecSuccess else { throw Keychain.Error.systemError(resultCode) } guard let persistentRef = result as? Data else { throw Keychain.Error.incorrectReturnType } return persistentRef }And to retrieve all the keychain itemsprivate func allKeychainItems() throws -> [NSDictionary] { let queryDict: [String : AnyObject] = [ kSecClass as String: kSecClassGenericPassword, kSecMatchLimit as String: kSecMatchLimitAll, kSecReturnPersistentRef as String: kCFBooleanTrue, kSecReturnAttributes as String: kCFBooleanTrue, kSecReturnData as String: kCFBooleanTrue, kSecAttrSynchronizable as String: kCFBooleanTrue, kSecAttrAccessible as String: kSecAttrAccessibleAlways, kSecAttrAccessGroup as String: kSAAGroup as AnyObject, ] var result: AnyObject? let resultCode = withUnsafeMutablePointer(to: &result) { SecItemCopyMatching(queryDict as CFDictionary, $0) } if resultCode == errSecItemNotFound { / return [] } guard resultCode == errSecSuccess else { throw Keychain.Error.systemError(resultCode) } guard let keychainItems = result as? [NSDictionary] else { throw Keychain.Error.incorrectReturnType } return keychainItems }I add the item to the keychain on the iPhone and if I close the app and reopen all the items are still there, so I assume everything it's working on the local level, I can add, delete, update and fetch all items.Now on the watchOS I get nothing, as if the keychain is empty.Any ideas?
10
1
6.1k
Feb ’23
RSA public/private key generates with swift does not compatible with any other platforms
I'm createing RSA public and private key pairs like below.var statusCode: OSStatus var publicKey: SecKey? var privateKey: SecKey? let publicKeyAttribute: [NSObject : NSObject] = [kSecAttrIsPermanent: true as NSObject, kSecAttrApplicationTag: "com.anu.keys.apppublic".data(using: String.Encoding.utf8)! as NSObject] let privateKeyAtrribute: [NSObject: NSObject] = [kSecAttrIsPermanent: true as NSObject, kSecAttrApplicationTag: "com.anu.keys.appprivate".data(using: String.Encoding.utf8)! as NSObject] var keyPairAttr = [NSObject: Any]() keyPairAttr[kSecAttrType] = kSecAttrKeyTypeRSA keyPairAttr[kSecAttrKeySizeInBits] = 2048 keyPairAttr[kSecReturnData] = true keyPairAttr[kSecPublicKeyAttrs] = publicKeyAttribute keyPairAttr[kSecPrivateKeyAttrs] = privateKeyAtrribute statusCode = SecKeyGeneratePair(keyPairAttr as CFDictionary, &publicKey, &privateKey)This generates two keys properly and keys are like below,public key<SecKeyRef algorithm id: 1, key type: RSAPublicKey, version: 4, block size: 2048 bits, exponent: {hex: 10001, decimal: 65537}, modulus: B4854E2DA6BA5EBC96C38BD44078D314E4504D130A03018ACD17D0F6679C3B6C9937B5D932A635AEAC32B9245EC400208C1F79932174EF804468D0DCE40DAF5B544CF9E4BCD7C49BA5D0BF3F8246B89B57A3A910CBB5200DCA6145E3EE216CE9C4A3283F1027AA15F7543BD3BEFF35BE24EE709CF8EB12545970AFFDA38CA11410ECA20A8F428D228ED07BF5399A2F55D93D7C143BAFA59A08E4FF932C3A689FA7F3F166B79A43837028319CB383F716B594F317ED6E20D7A8003190A13BC132D5B13708EDAEA3E2012B16CF37437BB617070D9A6DDFE55884A79BD530E4E654B823A8BBBF0AA777C8E46E94BD83E1C59EC6E1D34E69405640C309515243AA8D, addr: 0x608000420e80>private key<SecKeyRef algorithm id: 1, key type: RSAPrivateKey, version: 4, block size: 2048 bits, addr: 0x60000003b960>But I cannot use those keys with any other platforms such as .net or android. it says invalid key format. in android the key can see like below,Pubic key-----BEGIN RSA PUBLIC KEY----- MIIBCgKCAQEA0bipoOhkkvPxcsyOzcqsIUeVe0+iwe8W7N4EbHZMgujRERu1TPpy UcCO0uuKmm1TU09Kl40rRvDbtgB1YcGV3FPnNp3sOyFVsdyZ5bzxZtyyLrSWtj/n bLnGwaG9xJSwd2R/pTQLzOLV5KldwD2eUb3Z4Z4e9Z8II7eWgGaCLLqbrtEAa05N EqARckxrzJ1S3j+59h4AQovF72KI90/kRPryT2OGDiVlJ6CTjn2ZnTYcx65X6Rwf AeJKHZAGhw96j9tXyS+dJcXy4IBUTi3PXw0aEfhHQr/JsSHuMp/8mrhVJEokXb1C gKDZgJXujpGhCBdztHBAJxLBQMlODg7srwIDAQAB -----END RSA PUBLIC KEY-----Private key-----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAsfxMagVKY5++61Kot0esyhEOesqyQlZNvWbqMBcOoaOAb3pk LvwaGJ2YtD12u4yDEKcY5rpX7B/2t8GBHf+74NG47zAutf4Gf6qgQRUmIx2b7i4k WBt3KIifb/Zfs9KVJLhD4007bg1OtXA4kIhhXiuvhajDjDLOEthogF45CkJe+N67 JnH5hVW5CqBxPyRCrWCFbEHcXs5H515JV/Kz1+JVrB2/M03fW751wptO2GdGwsde ofqQzY+WUzqUihXigIjAVLFRemky3HpwuhzXUJn6A0ZD4tkk1JLstpSSJdBpH+L2 b9QlOitehxFgRsYmto+idpD1XrS9UyUtmpbTuwIDAQABAoIBAQCYvrAJcJ7lnmtn Ytm96LoF89tcT+Xpfk1bFR43xSHeYAXSJdQiamIu69joHbNuwuib+vsoz5Sy5L+D 9YHMb/MZvoIaa1w6/VUwbQr4r6C6FCgEoP65ymBZnd5OZL6/ASLTj3tbb6VoDe2V UkiI6TG+cnlAmJOxFsy5aZVNTQ9gmCMS0+AdpTbDsxTPg3y0EKFXeVRyKjq0lO9m p3G5yHkFjzWWY6s5XHx27gDTt8eXg/un72Qsz1rh5iUnAoxrga0Oco3Yk9DMvMwz a1I1Lo5fpB6FbTGX3k24heSnLDFEnlBvsBBg0g/n/qgwoZJ81MgG8Q4kAfeScuCI sYVnHEBpAoGBAOpnrKEkyhk1rXG4Md+z1/odhqx89mV7mF1ttW4IhFcwpJSMohsG r27Ic87whkpRxz2Mwj3B5WPGne4UkbvniH46n3jEW7ZIUF+ASVWkjMaGJWtOqSLC I19Snie9WvpREwaCVuvT2l4IeM1WL5gKotBwa3csZgGYH6gcyW5Ipbo/AoGBAMJh /+WXbohF4+A989q0jYjRRhKwUJAYeK8/AePrx8MnAXnRd09TiqeGn0Xig/RNZ0RE 96/TC1dTIBIHk5aDMy3vQhhYF0KbwcQWmCOnGo1qNTTaWTa3UitFMWf0hO0HuZtp RyD1YwhHP0W2tiK2GVjCreqIYASCpYKLq5Qq1K+FAoGARk2h8RLfqn/27UyZaMa/ 2DxS0BkKrZVMNXlaGQ5k4uGr+wHS/NgcddWZJk/tdwzf/Q3ilDM7YZmIdIemzfy7 a2CZw9bgyuMVeA85733S2xgQ0QZepBYmFcjptnGMf9chJaqh90krDVjtImjfDXLj MjEFilC+p2vA0uMPZwxS6HECgYAc5dLUQBoHmlRRTwSEvBjagToopxujAHBYpUZT qwbMpWzbvl89ZM8VLrdY/V7en+89P/+OnRJvjgUTiRrQ4npmVs59rgLvPRamXzGJ A1u4MFTuoZNnxgMqOaQprzlfv6lBSHpxlOl/HpByfcJAENBd2LtgRZv4r6+JY9hD M8bgvQKBgCDTSCLj5c1CYyuJMdrz9L5+xLFmrmL48djhK460ZcmcZ/gP808CyXx/ sDneow+JWt7Jb3p5zyUvvq1aDGNSsn4plB2rg7AqtoHcZYyFFZGI/K/b6JZna1yu FUYOfcanunabxY1wPQxuvR+AEuufBjB0aKg+qkLCCN1HYQtLs+N8 -----END RSA PRIVATE KEY-----why is this. why ios(Apple) cannot provide standard public/private keys that can use with rest APIs and with other platforms. I don't want to use any third party libraries. hope your help with this.
13
2
18k
Jul ’23
app keychain not getting backed up/restored using iCloud backup
Greetings,my app adds various items to its keychain and when doing an iTunes backup and restore, it successfully restores the keychain items provided the iTunes backup is encrypted. Works great!However I can't seem to be able to restore my app's keychain when doing an iCloud backup and then restoring to a different iPhone. Is there a way of specifying that the iCloud backup is encrypted in such a way that apps' keychains are backed up and restored properly when using iCloud backup/restore function?Is there a iCloud specific attribute that must be provided for keychain items to make this work?Thanks,Neal
17
0
13k
Mar ’23
Remote Debugging for Authorization Plugins
Hi all,We are developing a variety of login window plugins for macOS and are looking for greater control of the debugging process. I've followed the steps in Technical Note TN2108: Debugging An Authorization Plug-In With Xcode, but they don't seem to work on modern macOS, even with SIP disabled. It would seem that SecurityAgent has some anti-debug protection in it now as I can't connect to the running instance with lldb.As a work around we've resorted to caveman debugging with lots of log statements, but that's more than a bit of a pain to do as our products become more complex. Having debugging in Xcode would be best, but at this rate I'll even settle for lldb.Any ideas?Thanks,Josh
4
0
3.9k
Oct ’22
Privacy & Security Resources
General: Forums topic: Privacy & Security Privacy Resources Security Resources Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"
Replies
0
Boosts
0
Views
1.3k
Activity
Jul ’25
Changing a Keychain's password with Security.framework
I'm able to create a custom keychian using:OSStatus SecKeychainCreate(const char *pathName, UInt32 passwordLength, const void *password, Boolean promptUser, SecAccessRef initialAccess, SecKeychainRef *keychain);Once that keychain is created however, I want to be able to change the password used to unlock the keychain periodically. So far, I have not found the corresponding SecKeychain* method to do that.The following command works in terminal "/usr/bin/security set-keychain-password ...." but how to in the Security framework?
Replies
3
Boosts
0
Views
1.3k
Activity
Nov ’21
Keychain write errSecNotAvailable
What could cause the errSecNotAvailable error (-25291) to be returned from a keychain write? I see from the documentation "No trust results are available," [1]. Is that something that can be remedied on a retry of the same keychain query, is there some action that can be taken to fix the error programmatically, or does the user have to do something on the device to fix this? I see one comment indicating the device would need to be restarted [2].[1] https://developer.apple.com/library/ios/documentation/Security/Reference/keychainservices/#//apple_ref/c/econst/errSecNotAvailable[2] http://fossies.org/linux/fpcbuild/fpcsrc/packages/univint/src/SecBase.pas
Replies
12
Boosts
0
Views
10k
Activity
Feb ’23
SecIdentityRef without importing (SecPKCS12Import) into the keychain
How can I get an SecIdentityRef without adding to the keychain?Running a secure web server using CocoaAsyncSocket requires an array of certificates where the first item is a SecIdentityRef. (The 2nd item is a SecCertificateRef which I can succesfully obtain using SecCertificateCreateWithData from my .pfx file containing the public and private keys).The examples I have seen add the certificate to the keychain (using SecPKCS12Import) in order to get a SecIdentityRef, but I don't want to modify the keychain at all. (Note: my certificate is trusted by a root certificate which is already in the keychain).Any advice is welcome. Thanks.
Replies
11
Boosts
0
Views
6.2k
Activity
Apr ’23
Create an X.509 certificate progamatically
Hi,Is it possible to create an X.509 certificate using only the system security frameworks? Basically I would like to implement a CA locally.The docs say it's "possible to create X.509 certificates", quote: Certificate, Key, and Trust Services Certificate, Key, and Trust Services is a C API for managing certificates, public and private keys, symmetric keys, and trust policies in iOS and OS X. You can use these services in your app to:Create certificates and asymmetric keysBut in the reference docs all I can find is reading existing certificates from DER/PEM/PKCS#12 sources. I would like to avoid using OpenSSL to do this.Kind Regards,Alex
Replies
4
Boosts
0
Views
1.6k
Activity
Mar ’23
App Transport Security due date
There seems to be an unclear statement on whether ATS is going to be required to be ON in order to continue submitting to the app store. Do we know if there is a date for ATS to be a requirement? Or did they just leave it at "Opt-out" for the time being?
Replies
8
Boosts
0
Views
7.7k
Activity
Jan ’22
App Integrity
Hi,Is there any means by which i can identify or get the hash value of the certificate with which Apple signed my application before uploading it on AppStore? So that i can use this value to verify appliation integrity at runtime.
Replies
10
Boosts
0
Views
14k
Activity
Mar ’22
Intermittent -34018 errors from users in the field
This thread is the place to post if:you’re encountering -34018 errors being returned by the Security frameworkthe problem is intermittent, that is, it shows up very occasionally on user devices in the field but is otherwise hard to reproduceIMPORTANT Error -34018 has other causes. Before posting here, make sure to read the Error -34018 errSecMissingEntitlement pinned post.Apple has been tracking an issue where Security framework APIs can return -34018 on some user devices in the field. The typical observed behaviour is:After running successfully for a while, your app starts receiving -34018 from various Security APIs, most commonly the keychain APIs.Those errors persist until the app is terminated and relaunched (or the device is restarted).The problem shows up intermittently on a small percentage of user devices in the field.The problem only affects iOS-based platforms (iOS, watchOS, tvOS).Apple has been working hard to investigate this issue and believes we have fixed some of its root causes. However, it is a complex problem and it’s possible that there could be others. If you’re still seeing this problem on the latest iOS release, feel free to post your experiences to this thread.Note This thread is the continuation of an older thread here on DevForums; I’ve locked that old thread for reasons explain in the last post on that thread.That thread was itself a continuation of an even older thread on the old DevForums, which became read-only when the old DevForums was decommissioned.Share and Enjoy — Quinn “The Eskimo!” Apple Developer Relations, Developer Technical Support, Core OS/Hardware let myEmail = "eskimo" + "1" + "@apple.com"
Replies
18
Boosts
0
Views
9.2k
Activity
Dec ’22
App crashes when changing privacy settings
I have an application recording audio in background, but when I go to settings and change some permissions like photos, the application crashes and audio recording is stopped.
Replies
8
Boosts
1
Views
11k
Activity
Mar ’22
Multi-User Touch ID
Hi All,Just a quick question regarding the upgraded Touch ID and local authentication capabilities.I want to use the built-in fingerprint scanner on a iPad to allow multiple people to log into a custom application, what i want to do is to try and use the fingerprint scanner to save/recall user info that i want to store within my application.as example, an employee picks up an iPad, and by using the fingerprint scanner, while in the an application, the application should read the fingerprint of the employee and match that to a local database, if successful match, it will log the user into the application and display that user's specific information.Would something like this be possible? any other suggestions would really be appreciated as i have everything else working as needed , except for the biometric side.Thank you.
Replies
6
Boosts
0
Views
3.8k
Activity
Jul ’23
How to and When to uninstall a privileged helper
I had an application that needs to do very frequent privileged work.I used to achieve these work by AuthorizationExecuteWithPrivileges(). And I would like to follow the recommended way by using SMJobBless with XPC (a privileged helper over XPC communication). However, I got 2 questions about the unstalling the privileged helper (helper for short below).I noticed that SMJobRemove had been marked as deprecated and there is no other API as replacement of it now. So I would like to understand what is the supposed or recommended approach to unstall the helper now?More background of this question:My application can be installed by a simple drag from with the dmg packege. And the uninstall process is also just by draging to the Trash.The first time the app starts, it will try to bless the helper with asking the authentication/authorization from a user. Subsequently, it will not bother users next time startup or when communicating with the helper for privileged works.The reason that I need to uninstall the helper is for the helper version compatibility. There could be multiple versions of the application with potential different version of helpers co-existing in a user's system. So an idea is that each application with an exactly version number will install and communicate with a helper with a specified version as well (i.e. application 1.0.0 <-> helper-100 / application 2.0.1 <-> helper-201 ...). Therefore, to avoid leaking such a number of helpers in the disk when the applications are removed, I would like to unstall (remove) the helper[ver_num] when a specific version of applications are removed.Furthermore, when to trigger the uninstall process?My current idea is that when the first time the application starts, it will register the folder path where the application is in in the helper (over XPC) plist. The helper will then watch the folder change over the paths (if there are multi applications with that version exists). Once all the applications of that version with different paths registered in helper are removed, the helper will fork a subprocess to uninstall the helper (by SMJobRemove??).If the above thinking are not on a correct direction, could you have any suggestion about these 2 questions?
Replies
11
Boosts
0
Views
13k
Activity
Nov ’21
errSecInvalidOwnerEdit returned from SecItemDelete
Have an app I'm working on that stores an item in the keychain. Everything was was working fine. I have a button in the UI that allows the user to clear out the keychain item:NSDictionary *query = @{(__bridge id)kSecClass: (__bridge id)kSecClassGenericPassword, (__bridge id)kSecAttrService: service, (__bridge id)kSecAttrAccount: accountKey}; OSStatus status = SecItemDelete((__bridge CFDictionaryRef)(query));Status is -25244 which is errSecInvalidOwnerEdit. This app created the keychain item to begin with. What would be the appropriate way to handle this type of error?
Replies
16
Boosts
0
Views
4.4k
Activity
Nov ’23
how to detect the locked/unlocked screen status with swift
I need to detect if the screen il locked or unlocked when my app is running in background.I can't find documentation regarding this matter for swift programming.Some source reference ?
Replies
16
Boosts
0
Views
22k
Activity
Dec ’21
evaluatedPolicyDomainState unique per app identifier
I have an app and extension (Siri) that I am trying to use TouchID to authenticate an action. The main app has an enrollment process that stores off the evaluatedPolicyDomainState hash value for comparison to ensure the figerprint storage has not changed. This works great for the main app. However in the extension when trying to validate the hash with a stored hash in group storage the hash comes back differently. So it appears that the evaluatedPolicyDomainState hash is different per bundle id. Is that correct. I would have assumed that apps in the same appgroup entitlement would get the same DomainState back. That is the evaluatedPolicyDomainState would be based off of the enclave and app group id and not just app bundle id. Has anyone else run accross this?
Replies
4
Boosts
1
Views
1.3k
Activity
Mar ’23
How to create an HTTPS server on IOS using cocoaHTTPServer?
I made a javascript cloud app that runs on a webpage in a webview on my iPad app that communicates via WebSocket connection but it only works when im on my http site and not https or else I get an CFNetwork SSLHandshake failed (-9806) error in Xcode and on the website it says time out during handshake.Is this because the webserver on the iPad is running on HTTP instead of HTTPS?JAVASCRIPT CLOUD APPThis part in the cloud is working for HTTP when connecting to the web server on the iPad.var protocol = "ws"; if (this.useSecureConnection) protocol = "wss"; var url = protocol+'://localhost:'+this.port+'/service'; this.connection = new WebSocket(url);Xcode iOS iPad App (Objective-C)I thought that was the issue so I tried to enable HTTPS but I am not sure what to create for the "sslIdentityAndCertificates" method.- (BOOL)isSecureServer { HTTPLogTrace(); // Override me to create an https server... return YES; } /* * This method is expected to returns an array appropriate for use in kCFStreamSSLCertificates SSL Settings. * It should be an array of SecCertificateRefs except for the first element in the array, which is a SecIdentityRef. **/ - (NSArray *)sslIdentityAndCertificates{ HTTPLogTrace(); return nil; }Some of the other posts I have seen use APIs that are only available on Mac and not iOS.I tried several combinations of ATS permissions as well. All resulted in HTTPS not allowing for WebSocket connection.Any help is greatly appreciated! 🙂More Info:The cloud hosted webapp was built to be used on different devices as a webpage but we needed to add support for bluetooth to connect to a 3rd party hardware. To do that we needed to create a native "wrapper" for the webapp that would get bluetooth messages and process/send messages to the webapp in the webview via webSocket. This allows for the web app to use the bluetooth tool.
Replies
6
Boosts
0
Views
7.9k
Activity
Aug ’23
Access to Shared iOS Keychain with WatchOS
Hi,I'm crurently unable to access my app keychain after a long search these are the steps that I've tryed so farFirst of All I'm running on "real" devices not in simulators1. Key chain is enabled for a group, in here I will go for this group "appbundle.sharedkeychain" and the app prefix I'll say that's "1A2B3C4D5E"2. The keychain code is currently implemented on a Framework3. The Framework is a Pod that I've downloaded and tweaked so that worked with a shared keychain witch so far I was unable to.So I created a variable called kSAAGroup witch contains the following string "1A2B3C4D5E.appbundle.sharedkeychain"In the addKeychainFunction I have the following codeprivate func addKeychainItem(withAttributes attributes: [String: AnyObject]) throws -> Data { var mutableAttributes = attributes mutableAttributes[kSecClass as String] = kSecClassGenericPassword mutableAttributes[kSecReturnPersistentRef as String] = kCFBooleanTrue mutableAttributes[kSecAttrSynchronizable as String] = kCFBooleanTrue mutableAttributes[kSecAttrAccessible as String] = kSecAttrAccessibleAlways mutableAttributes[kSecAttrAccessGroup as String] = kSAAGroup as AnyObject? / / if mutableAttributes[kSecAttrAccount as String] == nil { mutableAttributes[kSecAttrAccount as String] = UUID().uuidString as NSString } var result: AnyObject? let resultCode: OSStatus = withUnsafeMutablePointer(to: &result) { SecItemAdd(mutableAttributes as CFDictionary, $0) } guard resultCode == errSecSuccess else { throw Keychain.Error.systemError(resultCode) } guard let persistentRef = result as? Data else { throw Keychain.Error.incorrectReturnType } return persistentRef }And to retrieve all the keychain itemsprivate func allKeychainItems() throws -> [NSDictionary] { let queryDict: [String : AnyObject] = [ kSecClass as String: kSecClassGenericPassword, kSecMatchLimit as String: kSecMatchLimitAll, kSecReturnPersistentRef as String: kCFBooleanTrue, kSecReturnAttributes as String: kCFBooleanTrue, kSecReturnData as String: kCFBooleanTrue, kSecAttrSynchronizable as String: kCFBooleanTrue, kSecAttrAccessible as String: kSecAttrAccessibleAlways, kSecAttrAccessGroup as String: kSAAGroup as AnyObject, ] var result: AnyObject? let resultCode = withUnsafeMutablePointer(to: &result) { SecItemCopyMatching(queryDict as CFDictionary, $0) } if resultCode == errSecItemNotFound { / return [] } guard resultCode == errSecSuccess else { throw Keychain.Error.systemError(resultCode) } guard let keychainItems = result as? [NSDictionary] else { throw Keychain.Error.incorrectReturnType } return keychainItems }I add the item to the keychain on the iPhone and if I close the app and reopen all the items are still there, so I assume everything it's working on the local level, I can add, delete, update and fetch all items.Now on the watchOS I get nothing, as if the keychain is empty.Any ideas?
Replies
10
Boosts
1
Views
6.1k
Activity
Feb ’23
RSA public/private key generates with swift does not compatible with any other platforms
I'm createing RSA public and private key pairs like below.var statusCode: OSStatus var publicKey: SecKey? var privateKey: SecKey? let publicKeyAttribute: [NSObject : NSObject] = [kSecAttrIsPermanent: true as NSObject, kSecAttrApplicationTag: "com.anu.keys.apppublic".data(using: String.Encoding.utf8)! as NSObject] let privateKeyAtrribute: [NSObject: NSObject] = [kSecAttrIsPermanent: true as NSObject, kSecAttrApplicationTag: "com.anu.keys.appprivate".data(using: String.Encoding.utf8)! as NSObject] var keyPairAttr = [NSObject: Any]() keyPairAttr[kSecAttrType] = kSecAttrKeyTypeRSA keyPairAttr[kSecAttrKeySizeInBits] = 2048 keyPairAttr[kSecReturnData] = true keyPairAttr[kSecPublicKeyAttrs] = publicKeyAttribute keyPairAttr[kSecPrivateKeyAttrs] = privateKeyAtrribute statusCode = SecKeyGeneratePair(keyPairAttr as CFDictionary, &publicKey, &privateKey)This generates two keys properly and keys are like below,public key<SecKeyRef algorithm id: 1, key type: RSAPublicKey, version: 4, block size: 2048 bits, exponent: {hex: 10001, decimal: 65537}, modulus: B4854E2DA6BA5EBC96C38BD44078D314E4504D130A03018ACD17D0F6679C3B6C9937B5D932A635AEAC32B9245EC400208C1F79932174EF804468D0DCE40DAF5B544CF9E4BCD7C49BA5D0BF3F8246B89B57A3A910CBB5200DCA6145E3EE216CE9C4A3283F1027AA15F7543BD3BEFF35BE24EE709CF8EB12545970AFFDA38CA11410ECA20A8F428D228ED07BF5399A2F55D93D7C143BAFA59A08E4FF932C3A689FA7F3F166B79A43837028319CB383F716B594F317ED6E20D7A8003190A13BC132D5B13708EDAEA3E2012B16CF37437BB617070D9A6DDFE55884A79BD530E4E654B823A8BBBF0AA777C8E46E94BD83E1C59EC6E1D34E69405640C309515243AA8D, addr: 0x608000420e80>private key<SecKeyRef algorithm id: 1, key type: RSAPrivateKey, version: 4, block size: 2048 bits, addr: 0x60000003b960>But I cannot use those keys with any other platforms such as .net or android. it says invalid key format. in android the key can see like below,Pubic key-----BEGIN RSA PUBLIC KEY----- MIIBCgKCAQEA0bipoOhkkvPxcsyOzcqsIUeVe0+iwe8W7N4EbHZMgujRERu1TPpy UcCO0uuKmm1TU09Kl40rRvDbtgB1YcGV3FPnNp3sOyFVsdyZ5bzxZtyyLrSWtj/n bLnGwaG9xJSwd2R/pTQLzOLV5KldwD2eUb3Z4Z4e9Z8II7eWgGaCLLqbrtEAa05N EqARckxrzJ1S3j+59h4AQovF72KI90/kRPryT2OGDiVlJ6CTjn2ZnTYcx65X6Rwf AeJKHZAGhw96j9tXyS+dJcXy4IBUTi3PXw0aEfhHQr/JsSHuMp/8mrhVJEokXb1C gKDZgJXujpGhCBdztHBAJxLBQMlODg7srwIDAQAB -----END RSA PUBLIC KEY-----Private key-----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAsfxMagVKY5++61Kot0esyhEOesqyQlZNvWbqMBcOoaOAb3pk LvwaGJ2YtD12u4yDEKcY5rpX7B/2t8GBHf+74NG47zAutf4Gf6qgQRUmIx2b7i4k WBt3KIifb/Zfs9KVJLhD4007bg1OtXA4kIhhXiuvhajDjDLOEthogF45CkJe+N67 JnH5hVW5CqBxPyRCrWCFbEHcXs5H515JV/Kz1+JVrB2/M03fW751wptO2GdGwsde ofqQzY+WUzqUihXigIjAVLFRemky3HpwuhzXUJn6A0ZD4tkk1JLstpSSJdBpH+L2 b9QlOitehxFgRsYmto+idpD1XrS9UyUtmpbTuwIDAQABAoIBAQCYvrAJcJ7lnmtn Ytm96LoF89tcT+Xpfk1bFR43xSHeYAXSJdQiamIu69joHbNuwuib+vsoz5Sy5L+D 9YHMb/MZvoIaa1w6/VUwbQr4r6C6FCgEoP65ymBZnd5OZL6/ASLTj3tbb6VoDe2V UkiI6TG+cnlAmJOxFsy5aZVNTQ9gmCMS0+AdpTbDsxTPg3y0EKFXeVRyKjq0lO9m p3G5yHkFjzWWY6s5XHx27gDTt8eXg/un72Qsz1rh5iUnAoxrga0Oco3Yk9DMvMwz a1I1Lo5fpB6FbTGX3k24heSnLDFEnlBvsBBg0g/n/qgwoZJ81MgG8Q4kAfeScuCI sYVnHEBpAoGBAOpnrKEkyhk1rXG4Md+z1/odhqx89mV7mF1ttW4IhFcwpJSMohsG r27Ic87whkpRxz2Mwj3B5WPGne4UkbvniH46n3jEW7ZIUF+ASVWkjMaGJWtOqSLC I19Snie9WvpREwaCVuvT2l4IeM1WL5gKotBwa3csZgGYH6gcyW5Ipbo/AoGBAMJh /+WXbohF4+A989q0jYjRRhKwUJAYeK8/AePrx8MnAXnRd09TiqeGn0Xig/RNZ0RE 96/TC1dTIBIHk5aDMy3vQhhYF0KbwcQWmCOnGo1qNTTaWTa3UitFMWf0hO0HuZtp RyD1YwhHP0W2tiK2GVjCreqIYASCpYKLq5Qq1K+FAoGARk2h8RLfqn/27UyZaMa/ 2DxS0BkKrZVMNXlaGQ5k4uGr+wHS/NgcddWZJk/tdwzf/Q3ilDM7YZmIdIemzfy7 a2CZw9bgyuMVeA85733S2xgQ0QZepBYmFcjptnGMf9chJaqh90krDVjtImjfDXLj MjEFilC+p2vA0uMPZwxS6HECgYAc5dLUQBoHmlRRTwSEvBjagToopxujAHBYpUZT qwbMpWzbvl89ZM8VLrdY/V7en+89P/+OnRJvjgUTiRrQ4npmVs59rgLvPRamXzGJ A1u4MFTuoZNnxgMqOaQprzlfv6lBSHpxlOl/HpByfcJAENBd2LtgRZv4r6+JY9hD M8bgvQKBgCDTSCLj5c1CYyuJMdrz9L5+xLFmrmL48djhK460ZcmcZ/gP808CyXx/ sDneow+JWt7Jb3p5zyUvvq1aDGNSsn4plB2rg7AqtoHcZYyFFZGI/K/b6JZna1yu FUYOfcanunabxY1wPQxuvR+AEuufBjB0aKg+qkLCCN1HYQtLs+N8 -----END RSA PRIVATE KEY-----why is this. why ios(Apple) cannot provide standard public/private keys that can use with rest APIs and with other platforms. I don't want to use any third party libraries. hope your help with this.
Replies
13
Boosts
2
Views
18k
Activity
Jul ’23
Accessing dot projector IOS
Can a developer access the dot projector and other hardware used by faceid in order to scan objects?
Replies
2
Boosts
0
Views
2.8k
Activity
Mar ’22
Not possible to show an NSWindow over screensaver the screensaver
We displayed a custom unlocking NSWindow over the screensaver. On El Capitan and Sierra it was working perfectly.Starting from High Sierra, it stopped working at all.The NSWindow simply never shows up. Setting the windows level to NSScreenSaverWindowLevel or higher has no effect.Is there any way to resolve that issue?
Replies
5
Boosts
0
Views
1.9k
Activity
Jan ’22
app keychain not getting backed up/restored using iCloud backup
Greetings,my app adds various items to its keychain and when doing an iTunes backup and restore, it successfully restores the keychain items provided the iTunes backup is encrypted. Works great!However I can't seem to be able to restore my app's keychain when doing an iCloud backup and then restoring to a different iPhone. Is there a way of specifying that the iCloud backup is encrypted in such a way that apps' keychains are backed up and restored properly when using iCloud backup/restore function?Is there a iCloud specific attribute that must be provided for keychain items to make this work?Thanks,Neal
Replies
17
Boosts
0
Views
13k
Activity
Mar ’23
Remote Debugging for Authorization Plugins
Hi all,We are developing a variety of login window plugins for macOS and are looking for greater control of the debugging process. I've followed the steps in Technical Note TN2108: Debugging An Authorization Plug-In With Xcode, but they don't seem to work on modern macOS, even with SIP disabled. It would seem that SecurityAgent has some anti-debug protection in it now as I can't connect to the running instance with lldb.As a work around we've resorted to caveman debugging with lots of log statements, but that's more than a bit of a pain to do as our products become more complex. Having debugging in Xcode would be best, but at this rate I'll even settle for lldb.Any ideas?Thanks,Josh
Replies
4
Boosts
0
Views
3.9k
Activity
Oct ’22