# Is storing data via property lists in an iPhone application's documents directory secure?

Is storing game state in plists in an iPhone application’s documents directory a secure method? Meaning, does anything other than the application have access to that directory?

AFAIK legally not, no one can access that directory, other than application itself. But if the device is jail-broken you can easily access and even change everyfile anywhere on iPhone. So if it's some critical data, you don't want any one to access it's contents, I suggest using some encryption before saving it.

• may I ask why did I get a down-vote? – Ali1S232 Apr 27 '12 at 22:57
• It's just game data that I will be storing. But because of the difficulty of the game, and the lenght of time I estimate it will take for the average person to complete it, I wanted to be certain that this data could not be read and changed in a "non-hacking" way. – Pluvius Apr 27 '12 at 23:24

An attack coming from another application on the same device is unlikely, I wouldn't worry about root. Since you want to avoid the user from tampering with the savegames, I would try to do everything as secure as possible, since any user (jailbroken or not) can use tools like iExplorer to retrieve files from the device and inspect them on their home machine.

As example, I'm attaching a capture of this application exploring a non-jailbroken ipod to retrieve a database from the game Spice Bandits, from which you can easily read the contents:

[~/Desktop]\$ sqlite3 greystripedb.sql
SQLite version 3.6.12
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> .schema
CREATE TABLE adTags('slotName' TEXT PRIMARY KEY, 'url' TEXT);
CREATE TABLE ads('slotName' TEXT, 'id' TEXT, 'dlTime' INTEGER, 'type' INTEGER, 'content' TEXT, 'trackers' TEXT, 'clickText' TEXT, 'clickthrough' TEXT, 'expiration' INTEGER, PRIMARY KEY ('slotName', 'dlTime'));
CREATE TABLE demographicAnswers('key' TEXT PRIMARY KEY, 'value' TEXT, 'skipCount' INTEGER default '0');
CREATE TABLE settings ('id' TEXT PRIMARY KEY, 'data' BLOB);
sqlite>


And of course, you can change the database and reupload it.

Maybe the best would be for you to avoid storing savegames on the machine (online services for iDevices and Android are spawning nowadays like hotcakes) and instead save the games on a server, or use tools like SQLCipher which encrypt sqlite databases to avoid quick and easy tampering of data.

• I downloaded iExplorer, and indeed I am able to clearly see the contents of my application's directories, which are PLists. However, unless I was doing something wrong I was able to view the files and their contents, delete the files, but I was unable to change their contents. When I open one of the PLists it gets assigned a temporary file name. I can make a change to the contents, but when I save the file it does not update the actual file on the iPhone. Am I just doing something wrong or is viewing and deleting files the only actions possible? – Pluvius Apr 28 '12 at 19:32
• The software is a file transfer tool. First copy something to your machine, change it there, delete it on the device, then upload your local copy (dragging works for me). – Grzegorz Adam Hankiewicz Apr 28 '12 at 20:49
• In short, the documents folder, when using pLists at least, is completely unsecure. SQLLite doesn't sound much better. I will have to look into encrypting the plists or something, unless there is a better approach. Thanks for you help. – Pluvius Apr 30 '12 at 17:45

I agree with @Gajet. Yes, an application is sandboxed, ie the app is limited to its files, preferences, etc and has limited network and hardware access. The link I have included even notes that developers should defend against attacks.

• I see from the link that there are three folders that can be used: Documents, Library, and tmp. I read somewhere that not all directories will persist if your app is upgraded, and that any data that needs to persist should be placed in the Library directory. That does not make sense to me, but it is just something I read. Do you have any insights on this? – Pluvius Apr 27 '12 at 23:28
• Documents and Library are fine for storing data and will copy over on updates. All other folders are not guaranteed to be copied. Documents is really where you'll store user data for your app and is where Core Data database files are stored. The Library folder is backed up by iTunes so that is something else to keep in mind. The documentation for this is under [developer.apple.com/library/ios/ipad/#documentation/… System Programming Guide) – Chris Apr 29 '12 at 7:47
• By the way iOS 4 and later can use the builtin on-disk encryption – Chris Apr 29 '12 at 7:56