Scout24/cocoapods-keys

Name: cocoapods-keys

Owner: AutoScout24

Owner: AutoScout24

Description: A key value store for storing environment and application keys

Forked from: orta/cocoapods-keys

Created: 2015-09-28 12:25:41.0

Updated: 2016-08-04 15:50:03.0

Pushed: 2018-01-04 15:26:08.0

Homepage:

Size: 173

Language: Ruby

GitHub Committers

User	Most Recent Commit	# Commits

Other Committers

User	Email	Most Recent Commit	# Commits

README

A key value store for enviroment and application keys.

Its good security practice to keep production keys out of developer hands. CocoaPods-keys makes it easy to have per-user config settings stored securely in the developer's keychain, and not in the application source. It is a plugin that once installed will run on every pod install or pod update.

Requirements

Requires CocoaPods 0.36

Installation

$ gem install cocoapods-keys

How it works

Key names are stored in ~/.cocoapods/keys/ and key values in the OS X keychain. When you run pod install or pod update, an Objective-C class is created with scrambled versions of the keys, making it difficult to just dump the contents of the decrypted binary and extract the keys. At runtime, the keys are unscrambled for use in your app.

The generated Objective-C classes are stored in the Pods/CocoaPodsKeys directory, so if you're checking in your Pods folder, just add Pods/CocoaPodsKeys to your .gitignore file. CocoaPods-Keys supports integration in Swift or Objective-C projects.

Usage

Using the new Plugin API in CocoaPods we can automate a lot of the fiddly bits away. You define what keys you want inside your Podfile and Keys will detect what keys are not yet set. If you need to specify a different project name from the target name, use the key :target to specify it.

in 'cocoapods-keys', {
roject => "Eidolon",
eys => [
"ArtsyAPIClientSecret",
"ArtsyAPIClientKey",
"HockeyProductionSecret",
"HockeyBetaSecret",
"MixpanelProductionAPIClientKey",
...

Then running pod install will prompt for the keys not yet set and you can ensure everyone has the same setup.

Alternative Usage

You can save keys on a per-project basis by running the command:

$ pod keys set KEY VALUE

You can list all known keys by running:

$ pod keys

For example:

cd MyApplication
pod keys set "NetworkAPIToken" "AH2ZMiraGQbyUd9GkNTNfWEdxlwXcmHciEOH"
ved NetworkAPIToken to MyApplication.

pod keys set "AnalyticsToken" "6TYKGVCn7sBSBFpwfSUCclzDoSBtEXw7"
ved AnalyticsToken to MyApplication.

pod keys
ys for MyApplication
  NetworkAPIToken - AH2ZMiraGQbyUd9GkNTNfWEdxlwXcmHciEOH
  AnalyticsToken - 6TYKGVCn7sBSBFpwfSUCclzDoSBtEXw7

Fs - /Users/orta/dev/mac/GIFs
 redditAPIToken & mixpanelAPIToken

After the next pod install or pod update keys will add a new Keys pod to your Pods project, supporting both static libraries and frameworks. Note you have to include plugin 'cocoapods-keys' in the Podfile for Keys to register that it should work. This provides an API to your keys from Cocoa code. For example the application code above would look like:

ort "ORAppDelegate.h"
ort <Keys/MyApplicationKeys.h>
ort <ARAnalytics/ARAnalytics.h>

lementation ORAppDelegate

oid)applicationDidFinishLaunching:(NSNotification *)aNotification

MyApplicationKeys *keys = [[MyApplicationKeys alloc] init];
[ARAnalytics setupWithAnalytics:@{
    ARGoogleAnalyticsID : keys.analyticsToken;
}];

Some documentation is also available to use cocoapods-keys in Swift projects.

Other commands

CocoaPods-keys has 3 other commands:

• pod keys get [key] [optional project] Which will output the value of the key to STDOUT, useful for scripting.

• pod keys rm [key] [optional project] Will remove a key from a project.

• pod keys generate [optional project] Will generate the obfuscated Objective-C keys class (mainly used internally).

Continuous Integration

It's rarely a good idea to mess around with the keychain in your CI, so keys will look for an environment var with the same string before looking in the keychain.

Security

Key security is difficult. Right now even the biggest apps get their keys leaked. This is neatly summed up by John Adams of the Twitter Security Team on Quora.

Putting this in the context of, “should you be storing keys in software”, is more appropriate. Many companies do this. It's never a good idea.

When developers do that, other developers can use debuggers and string searching commands to extract those keys from the running application. There are numerous talks on how to do that, but leave that as an exercise to the reader to find those talks.

Many people believe that obfuscating these keys in code will help. It usually won't because you can just run a debugger and find the fully functional keys.

So in summary, the ideal way to store keys is to not store keys. In reality though most Apps embed keys, and this does that and adds some rudimentary obfuscation to the keys. A well motivated app cracker could probably extract this within a few minutes however.

Thanks

This was built with a lot of help from @segiddins and @ashfurrow.

A key value store for enviroment and application keys.

Its good security practice to keep production keys out of developer hands. CocoaPods-keys makes it easy to have per-user config settings stored securely in the developer's keychain, and not in the application source. It is a plugin that once installed will run on every pod install or pod update.

Requirements

Requires CocoaPods 0.36

Installation

$ gem install cocoapods-keys

How it works

Key names are stored in ~/.cocoapods/keys/ and key values in the OS X keychain. When you run pod install or pod update, an Objective-C class is created with scrambled versions of the keys, making it difficult to just dump the contents of the decrypted binary and extract the keys. At runtime, the keys are unscrambled for use in your app.

The generated Objective-C classes are stored in the Pods/CocoaPodsKeys directory, so if you're checking in your Pods folder, just add Pods/CocoaPodsKeys to your .gitignore file. CocoaPods-Keys supports integration in Swift or Objective-C projects.

Usage

Using the new Plugin API in CocoaPods we can automate a lot of the fiddly bits away. You define what keys you want inside your Podfile and Keys will detect what keys are not yet set. If you need to specify a different project name from the target name, use the key :target to specify it.

in 'cocoapods-keys', {
roject => "Eidolon",
eys => [
"ArtsyAPIClientSecret",
"ArtsyAPIClientKey",
"HockeyProductionSecret",
"HockeyBetaSecret",
"MixpanelProductionAPIClientKey",
...

Then running pod install will prompt for the keys not yet set and you can ensure everyone has the same setup.

Alternative Usage

You can save keys on a per-project basis by running the command:

$ pod keys set KEY VALUE

You can list all known keys by running:

$ pod keys

For example:

cd MyApplication
pod keys set "NetworkAPIToken" "AH2ZMiraGQbyUd9GkNTNfWEdxlwXcmHciEOH"
ved NetworkAPIToken to MyApplication.

pod keys set "AnalyticsToken" "6TYKGVCn7sBSBFpwfSUCclzDoSBtEXw7"
ved AnalyticsToken to MyApplication.

pod keys
ys for MyApplication
  NetworkAPIToken - AH2ZMiraGQbyUd9GkNTNfWEdxlwXcmHciEOH
  AnalyticsToken - 6TYKGVCn7sBSBFpwfSUCclzDoSBtEXw7

Fs - /Users/orta/dev/mac/GIFs
 redditAPIToken & mixpanelAPIToken

After the next pod install or pod update keys will add a new Keys pod to your Pods project, supporting both static libraries and frameworks. Note you have to include plugin 'cocoapods-keys' in the Podfile for Keys to register that it should work. This provides an API to your keys from Cocoa code. For example the application code above would look like:

ort "ORAppDelegate.h"
ort <Keys/MyApplicationKeys.h>
ort <ARAnalytics/ARAnalytics.h>

lementation ORAppDelegate

oid)applicationDidFinishLaunching:(NSNotification *)aNotification

MyApplicationKeys *keys = [[MyApplicationKeys alloc] init];
[ARAnalytics setupWithAnalytics:@{
    ARGoogleAnalyticsID : keys.analyticsToken;
}];

Some documentation is also available to use cocoapods-keys in Swift projects.

Other commands

CocoaPods-keys has 3 other commands:

• pod keys get [key] [optional project] Which will output the value of the key to STDOUT, useful for scripting.

• pod keys rm [key] [optional project] Will remove a key from a project.

• pod keys generate [optional project] Will generate the obfuscated Objective-C keys class (mainly used internally).

Continuous Integration

It's rarely a good idea to mess around with the keychain in your CI, so keys will look for an environment var with the same string before looking in the keychain.

Security

Key security is difficult. Right now even the biggest apps get their keys leaked. This is neatly summed up by John Adams of the Twitter Security Team on Quora.

Putting this in the context of, “should you be storing keys in software”, is more appropriate. Many companies do this. It's never a good idea.

When developers do that, other developers can use debuggers and string searching commands to extract those keys from the running application. There are numerous talks on how to do that, but leave that as an exercise to the reader to find those talks.

Many people believe that obfuscating these keys in code will help. It usually won't because you can just run a debugger and find the fully functional keys.

So in summary, the ideal way to store keys is to not store keys. In reality though most Apps embed keys, and this does that and adds some rudimentary obfuscation to the keys. A well motivated app cracker could probably extract this within a few minutes however.

Thanks

This was built with a lot of help from @segiddins and @ashfurrow.