How to securely include secret key/signature in iOS/Cocoa apps

Question

I want to include a secret key into an iOS app so that the app can \"prove\" to a certain server that a request is coming from the app itself and not some other system. I k

Answer 1

Since the attacker would be in complete control of the client, the only method would be security through obscurity. You can implement a challenge/response model, but you must make it impervious to many other factors (replay attacks, etc).

This question contains one approach to hide a secret key in binary code.

Don't assume that by simply using https you can't have packet sniffing. What if the attacker changed their URLs inside your executable to point to their server? Then they can act as a relay.

A better way would be to provide some identity management inside the app (user picks a username, password is user/machine generated), and use those credentials for your service calls.