Ship it Safe
summary
Practical checklist for shipping private iOS apps: avoid collecting unused data, prefer on-device processing and CloudKit private user database for serverless storage so servers never hold real names (example: Chibi Studio sends generic pushes and a push‑service extension fetches sender name from CloudKit for rich notifications). Protect files with iOS Data Protection (default completeUntilFirstAuthentication or change per-file), use OSLog (private by default) to avoid leaking PII, enforce HTTPS/ATS, consider SSL pinning, and use DeviceCheck token per request to block fake clients. Provide opt-out for analytics and full data export/delete.
AI-written summary · about
chapters (11)
- 0:00Introduction and setup
- 1:03Why privacy matters
- 3:34Data collection best practices
- 7:52CloudKit for privacy
- 11:29On-device data protection
- 16:08Secure logging techniques
- 18:58Backups and sensitive data
- 19:20Securing your own backend
- 23:17Transparent privacy policies
- 25:25User control over data
- 27:11Recap and key takeaways
related talks
37mOutsmarting Hackers before your App gets pwn'ed
44mPractical Security
27miOS Attack Vectors and how to protect your app
24mSecurity : protect the body of your app
28mApp Security Essentials
45mTen Secrets to Secure Mobile Applications
47mSecurity Threats & Mitigations for iOS Developers
48mRemoving Secrets To Make Your Mobile Apps More MASVS-Secure