Encryption/Password Protection of SQLite Database
Is there a way to encrypt a SQLite database in Titanium Mobile yet?
In the app I'm building, most of the value is from the structure and content of the database. I'd like to keep people from having easy access to it. I realize no encryption or password protection is 100% secure from a determined person, but encryption (something like SQLCipher) would help deter those who aren't hell-bent on cracking it.
I've heard vague references here and there about the possibility of adding this functionality in somewhere in the bowels of the Titanium sdk, but I can't seem to find any advice or starting points. Any ideas?
2 Answers
-
Accepted Answer
Mike, AFAIK support for this has only been mentioned on an outdated roadmap but I can't find references to it actually being scheduled for a near term implementation. So in terms of a starting point, my advice is:
-
Mike
Your best bet is to use a password salt, which you can learn about here and here. Both of these resources apply the technique in the context of PHP, but they also explain the theory behind it. It's a general approach, so you should be able to adapt it easily.
It looks like someone has used password salts for a javascript application here, but I cannot say whether they have done a good job (it was just the first salt-related javascript tutorial that google returned). ;)
In case none of the above articles mention it, you can also randomize the salt for each username/password. Store this unique salt either in the same database table row as the username or, possibly even better, store it in a secondary table and link them with a foreign key. It's up to you and your requirements.
Be aware that these techiques can be easily brute forced, especially as they are stored locally to the user (the database could simply be transferred to a more powerful machine and hacked/processed in a fraction of the time).
If security is important to you, put the authentication mechanism on a remote server and programme your app to send its password to it over SSL (https).
Hope this helps