Flawed iOS Security: Client-side obfuscation If you listen uncritically to everything you read on the internet, you might think you’re slick by obfuscating your strings. That’s certainly what I thought in 2019 when I first decided to be the resident security expert and added code like this to protect my Mixpanel API keys. While it’s a little harder to read than raw strings, it’s still straightforward for a sufficiently motivated hacker to steal your keys. If you use an insecure approach such as base-64 encoding or XORing, it’s trivial to reverse engineer. Even with a decent algorithm and salt, attackers can use tools like Frida to extract your API keys from device memory at runtime. Obfuscation provides security by obscurity, but this isn’t an effective approach. No matter how good your obfuscation is, that API key will eventually be decoded and sent across the network. See the full blog post here: