Can You Keep a Secret? What About Your App? | Secrets Management in iOS Apps |

Can you keep a secret? And what about your apps?
In this video, I explore the problem of storing and managing software secrets-API keys, tokens, certificates, and so on-in iOS apps.
If you know tips and tricks not mentioned in this video, please share them in the comments! Also subscribe to The Swift Bird and stay tuned for more tech stuff!
You can support me by…
• …buying me a coffee: www.buymeacoffee.com/SwiftBird
• …becoming a patron: / swiftbird
Links:
• Secret Management on iOS: nshipster.com/secrets/
• Xcode Build Configuration Files: nshipster.com/xcconfig/
• strings Tool Documentation: www.unix.com/man-page/osx/1/s...
• Identity Pinning: How to configure server certificates for your app: developer.apple.com/news/?id=...
• What is mutual authentication? | Two-way authentication (mTLS): www.cloudflare.com/learning/a...
• On-Demand Resources Essentials: developer.apple.com/library/a...
• Pushing Background Updates to Your App: developer.apple.com/documenta...
• CloudKit Documentation: developer.apple.com/documenta...
• How to Get Started With CloudKit: cocoacasts.com/how-to-get-sta...
Chapters:
• 0:00 Cinematic Intro
• 0:39 Actual Intro
• 1:36 You Don’t Have to Be an Expert
• 2:40 What Are Secrets
• 3:20 Why Keep Secrets
• 5:11 Secrets in Version-Control Systems (Git, etc.)
• 6:16 Xcode Build Configurations
• 7:29 Info.plist
• 9:31 Networking Security
• 10:29 Certificate & Key Pinning
• 11:47 No Back End? No Problem!
• 12:23 On-Demand Resources
• 12:47 Secrets in Push Notifications?
• 13:28 CloudKit
• 13:53 It’s Not About Technical Solutions (That Much)
• 14:57 Secrets Rotation
• 15:15 Summary & Recap
• 15:51 Outro
The Swift Bird is produced by / yakovmanshin .
#ios #security #secretsmanagement

[@iOSTechie]

Thank you for the video. I personally follow Certificate / Key pinning in my projects. I also use Encryption wherever needed.

[@SwiftBird]

Thanks for sharing!
I wonder, when you pin the certificate, it’s installed on a server you control, right? In my projects, I sometimes use serverless functions (Firebase et al.) but haven’t yet found a good way to set up pinning in such scenarios 🤔