IOS Keychain Service

Question

I'm new to iOS development and programming, so please bear with me.

Correct me if I'm wrong but, conceptually, an app can access any items in the Keychain that are associated with the app. It is my understanding that hackers can manipulate the code of an application like "Jailbreaking" to do the hacker's bidding.

In that case, is it possible for the hacker to simply access all the elements of the Keychain by adding additional code?

For example, if my app is checking authorization by comparing the inputted value with the Keychain stored password, could the hacker simply modify the code to get the Keychain stored password? If so, how do you guard against this?

Answer 1

Yes. Anyway, you should be storing the password hash, not the password.

You cannot protect the user against themselves. It's their data. You can't keep them from reading their own data.

The alternative is to store data on your server instead of on the device.