I am designing offline features for an app which caches data in offline mode and provides them to users. The app also needs to support the login feature in the offline mode.
I am seeing Sqlicipher as a better option than Core data security with File Protection because only when data protection is enforced in iOS device the security of the data is ensured.
And I am also afraid of the hardware encryption of iOS due to this incident.
As part of my design for Sqlicipher, I have planned the below staregy:
- Use SqlCipher for storing the sensitive data.
- Make the user's credentials as the key for the SqlCipher DB access.
- Store the credentials of user in keychain access.
Questions:
- Is storing credentials in keychain access a safer option and foolproof. if not, what is the alternative?
- Is my understanding on Core data's security in light of data protection correct?