It's also not hard to eavesdrop on the HTTP session using tcpdump, or
to debug or disassemble the app to recover the password.
In other words, putting a shared secret into an application
distributed to end-users is not secure.
Probably not a realistic fear in this particular case, but there are
many, many instances of web scripts like this being abused to send
spam, so I don't think I'm being overly paranoid :)
_______________________________________________
Cocoa-dev mailing list (email@hidden)
Please do not post admin requests or moderator comments to the list.
Contact the moderators at cocoa-dev-admins(at)lists.apple.com
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/cocoa-dev/email@hidden
This email sent to email@hidden
