Is storing data via property lists in an iPhone application's documents directory secure?

Question

Is storing game state in plists in an iPhone application’s documents directory a secure method? Meaning, does anything other than the application have access to that directory?

Answer 1

AFAIK legally not, no one can access that directory, other than application itself. But if the device is jail-broken you can easily access and even change everyfile anywhere on iPhone. So if it's some critical data, you don't want any one to access it's contents, I suggest using some encryption before saving it.

Answer 2

An attack coming from another application on the same device is unlikely, I wouldn't worry about root. Since you want to avoid the user from tampering with the savegames, I would try to do everything as secure as possible, since any user (jailbroken or not) can use tools like iExplorer to retrieve files from the device and inspect them on their home machine.

As example, I'm attaching a capture of this application exploring a non-jailbroken ipod to retrieve a database from the game Spice Bandits, from which you can easily read the contents:

[~/Desktop]$ sqlite3 greystripedb.sql 
SQLite version 3.6.12
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> .schema
CREATE TABLE adTags('slotName' TEXT PRIMARY KEY, 'url' TEXT);
CREATE TABLE ads('slotName' TEXT, 'id' TEXT, 'dlTime' INTEGER, 'type' INTEGER, 'content' TEXT, 'trackers' TEXT, 'clickText' TEXT, 'clickthrough' TEXT, 'expiration' INTEGER, PRIMARY KEY ('slotName', 'dlTime'));
CREATE TABLE demographicAnswers('key' TEXT PRIMARY KEY, 'value' TEXT, 'skipCount' INTEGER default '0');
CREATE TABLE settings ('id' TEXT PRIMARY KEY, 'data' BLOB);
sqlite> 

And of course, you can change the database and reupload it.

Maybe the best would be for you to avoid storing savegames on the machine (online services for iDevices and Android are spawning nowadays like hotcakes) and instead save the games on a server, or use tools like SQLCipher which encrypt sqlite databases to avoid quick and easy tampering of data.

Answer 3

I agree with @Gajet. Yes, an application is sandboxed, ie the app is limited to its files, preferences, etc and has limited network and hardware access. The link I have included even notes that developers should defend against attacks.