Hi,
In my app, user can upload files to a ftp server. To open the connection and write to the server, I need to use username and password. Having FTP username and password in the code looks like a security issue.
Can someone please tell me how can I securely store this in my code and use it to connect to the server?
Thanks a lot!
If this is FTP, then you are sending the credentials over the network unencrypted. If you expect to protect these credentials, you've already lost, because anyone with any interest can easily sniff the password off of the wireless network. I have a simple rig set up all the time for just this kind of network sniffing from iPhone.
If FTP is your only option, then you should acknowledge that these credentials are public, and either make the connection anonymous, or strongly limit what the credentials you provide can do.
In particular, you should ensure that the credentials (or the anonymous account) can only write and not read. If you have an FTP server that has well-known credentials that can both read and write, then it will quickly become a host for copies of software and porn.
If you can use another protocol (HTTPS, SFTP, etc.) then that's good, but it won't actually save you. If you send your login credentials out with the software, and they have any value, they will be reverse engineered. So while I recommend using HTTPS for uploading files, you still can't rely on the security of credentials you send out in your program. You still have to make sure your web server is tolerant of attackers sending it random things.
Having FTP username and password in the code looks like a security issue.
That is because it is :-)
Can someone please tell me how can I securely store this in my code and use it to connect to the server?
There is no way to do so - you are looking for the security equivalent of a perpetual motion machine here. Anything you do will be security through obscurity and will be reverse engineered. Also, when you embed secrets in code, any failure will be catastrophic and there is no easy way to recover.
What are you trying to achieve with these credentials? Are you looking to enforce that the server is only accessed with your code? If so, this is also an impossible quest, and again you should simply forget about attempting it.
You would most likely be better off trying to authenticate the users, i.e. have them use individual usernames and passwords - it really depends what your actual business level security requirement is here.
As others have said, since FTP is clear text over the wire, you're at a loss there.
However, there are secure ways of storing information on the device, whatever it may be. This mechanism is commonly referred to as a Keychain, and you can follow the steps outline here to do it. You will also want to read through the Security Overview too. Both the GenericKeychain and CryptoExcercise code examples here are good references.