Question

I am pretty new in iOS development and I have the following question: In my code I have a UIViewController with a UIText field that will hold a password when user will type in the view. The password is used for authentication in front a server:

UItextField* txtPassword;
[myClass loginWithPassword:txtPassword.text];

使用后，我想确保内存中没有剩余的密码，这样攻击者就无法对iPhone执行内存转储并从中提取密码。

例如，在windows中，我可以使用SeucreZeroMemory函数来用零填充内存块。

iOS的最佳方式是什么？谁负责释放UItextField*字符串，这足够吗？

Answer 1

What you want is really not needed, you don t need to write zeros over you allocated data to be sure that it is secure. The reason is that no one but you can access the memory and iOS uses address space randomization so even if it would be possible to get your memory, its hard to guess where your data is (and if one don t know where the data is, it is hard to guess what exactly the data is, luckily the RAM has no filesystem that helps in such a case). The second thing is, if you use [foo release] and you textfield gets deallocated in this process, the OS reclaims the memory. Now the OS will always fill new memory pages with zeroes before giving it to the asking process, so you don t have to fear that there is an malicious app that just allocates memory in the hope it finds the password this way.

Answer 2

ok, Release your object which store the password in your class by going into the dealloc methods. Or release when ever the use that object is finished.by writing this [object release]; I hope it will help you .

友情链接