[firebase_cloud_messaging] iOS Keychain usage vulnerability #5586
Unanswered
VladimirKalinichenkoWeather
asked this question in
Feature request
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Throughout the firebase plugin,
kSecAttrAccessibleAlwaysThisDeviceOnlyaccessibility option is used for storing data in KeyChain. Items added to the KeyChain with an insecure accessibility option may be exposed to other applications on JailBroken devices or attackers with physical access.Currently, there is no API to change the accessibility options used by Firebase. Insecure data storage is a secure compliance violation of our company's policies. We would like to be able to override default Firebase keychain usage.
Beta Was this translation helpful? Give feedback.
All reactions