Presentation made on the event Barcelona iOS developers by Ronan O'Ciosoig

1. BARCELONA IOS DEVEOPERS
Ronan O Ciosoig
Show and Tell
14th May 2012
Thursday, May 16, 13

2. Thursday, May 16, 13

3. Why do we need it?
Thursday, May 16, 13

4. What is wrong with other solutions?
Thursday, May 16, 13

5. What is it that is being offered here?
Thursday, May 16, 13

6. FOOD SAFETY PLATFORM
• Food safety web site (for reference hospital)
• Manufacturers web site
• Web only widget to embed in manufacturer’s and food
regulatory or safety web sites
• Consumers web site
• Mobile app for iOS and Android
Thursday, May 16, 13

7. APP - KEY FEATURES
• Simple to read
• Downloadable database
• Customized user profile
• Allergen information provided by a leading hospital
• Apple Push to update
• Secure
Thursday, May 16, 13

8. DEMO
Thursday, May 16, 13

9. USINGTHE APP
• Use anonymously - no registration is required
• Register and define intolerances / allergies
• Download database
• Select by
• Brand
• Barcode scanning
• Text search
Thursday, May 16, 13

10. INTERNAL FEATURES
• English and Spanish supported
• Voice support (deactivated)
• Image cache
• System-wide logging and usage tracking
• not using any 3rd party lib.
• Encryption
Thursday, May 16, 13

11. SECURITY INTHE APP
Thursday, May 16, 13

12. SECURITY INTHE APP
Why do you need security here?
Gives manufacturers confidence in the platform
Thursday, May 16, 13

13. CORE DATA ENCRYPTION
Thursday, May 16, 13

14. CORE DATA ENCRYPTION
• Add 2 classes (from Pro Core Data book):
• EncryptedStringTransformer
• NSData+Encryption
Thursday, May 16, 13

15. CORE DATA ENCRYPTION
• Add 2 classes (from Pro Core Data book):
• EncryptedStringTransformer
• NSData+Encryption
• Change properties to ‘transformable’
Thursday, May 16, 13

16. CORE DATA ENCRYPTION
• Add 2 classes (from Pro Core Data book):
• EncryptedStringTransformer
• NSData+Encryption
• Change properties to ‘transformable’
• Set the name to “EncryptedStringTransformer”
Thursday, May 16, 13

17. CORE DATA ENCRYPTION
• Add 2 classes (from Pro Core Data book):
• EncryptedStringTransformer
• NSData+Encryption
• Change properties to ‘transformable’
• Set the name to “EncryptedStringTransformer”
• Set the key in the EncryptedStringTransformer.m class
Thursday, May 16, 13

18. CORE DATA ENCRYPTION
Thursday, May 16, 13

19. CORE DATA ENCRYPTION
Thursday, May 16, 13

20. CORE DATA ENCRYPTION
Thursday, May 16, 13

21. THE KEY?
Thursday, May 16, 13

22. THE KEY?
• Add it into the code?
Thursday, May 16, 13

23. THE KEY?
• Add it into the code? Not a good idea
Thursday, May 16, 13

24. THE KEY?
• Add it into the code?
• Can you store it in the Key Chain?
Not a good idea
Thursday, May 16, 13

25. THE KEY?
• Add it into the code?
• Can you store it in the Key Chain?
Not a good idea
Not secure
Thursday, May 16, 13

26. THE KEY?
• Add it into the code?
• Can you store it in the Key Chain?
• Don’t store it.
Not a good idea
Not secure
Generate it!
Thursday, May 16, 13

27. SECURE CODING
Thursday, May 16, 13

28. SECURE CODING
... is about increasing the complexity
demanded for an attack against the
application to succeed.
Thursday, May 16, 13

29. SECURE CODING
Don’t make it easy
Thursday, May 16, 13

30. KEY GENERATION
Complex non-
obvious operation
Seed
Seed
Seed
Read Core
Data DB
Thursday, May 16, 13

31. NON-OBVIOUS OPERATION
Thursday, May 16, 13

32. SECURITY INTHE APP
• Core Data SQLite entries are encrypted
• Key is generated and never stored
• Seed for key stored in KeyChain
Thursday, May 16, 13

33. Thursday, May 16, 13

34. Thursday, May 16, 13

35. SIMPLICITY
Thursday, May 16, 13

36. SIMPLICITY
Thursday, May 16, 13

37. SIMPLICITY
...is about subtracting the obvious and adding the
meaningful.”
Thursday, May 16, 13

38. QUESTIONS?
Thursday, May 16, 13

39. REFERENCES
Pro Core Data 2nd Edition (Michael Privat,
Robert Warner)
Hacking and securing iOS Applications, Jonathan
Zdziarski
The Laws of Simplicity, John Maeda
Thursday, May 16, 13