title: Sending Device Token Safely for APNs
body: <p>For iOS applications that require push notifications, it must first request the user for permission to do so. After that, a device token is generated and with this, the remote server may communicate to the user through this token.</p>
  
  <p>I have read a similar question <a href="https://stackoverflow.com/questions/9448948/should-apns-tokens-be-encrypted">here</a> and I do not feel it is enough. The picture below is a trusted certificate, it allows me to view all traffic that happens on this device.</p>
  
  <p><img src="https://i.stack.imgur.com/LxGUA.png" alt=""></p>
  
  <p>With <a href="http://fiddler2.com/" rel="nofollow noreferrer">Fiddler2</a> as well as <a href="http://fiddler2.com/add-ons" rel="nofollow noreferrer">CertMaker</a>, I can sniff HTTPS traffic, which means the client can probably know what data they are sending, and to where.</p>
  
  <p>My question is, knowing that SSL is not secure from protecting my clients from seeing what I send to the remote server, should I simply encypt with a secret key found within my application?</p>
  
  <p>Such as <code>encrypt("device_token","secretkey_a0a0a0a")</code> (pretend this is Objective-C)?</p>
  
  <p>Couldn't someone just find that key within my application? I also read <a href="https://stackoverflow.com/questions/6305808/is-it-possible-to-trace-back-a-string-inside-an-ipa-binary">this</a> question, and it seems that it would be possible to get back the secret key.</p>
  
  <p>My plan for this goes like this:</p>
  
  <ol>
  <li>Within the iOS application, Generate a random string named <code>activate</code>.</li>
  <li>Encrypt (not hash), the token by the random string <strong>and</strong> a secret key that I only know. (secretkey_a0a0a0)</li>
  <li>Send the encrypted string along with the generated randomly generated string (active).</li>
  <li>Within serverside, I check if I can decrypt a valid token from using the <code>active</code> and my secret key.</li>
  <li>I save the token in my database if it is valid.</li>
  </ol>
  
  <p>This prevents people from random entering tokens yes, however, <code>secretkey_a0a0a0</code> is a string literal. It's very possible to get this within the application binary itself.</p>
  
  <p>My question is, how do I protect this secret key? The answer can also be, how can I prevent people from sending invalid tokens to my server as well.</p>
  
  <p>I have heard of encryption, but doesn't that only apply to resource files?</p>
  
  <p>How should I approach this?</p>