transferring data from iPad

[marksmithhfx]

Hi, I have a question about transferring data from an iPad. If I use LC to write a data collection program, storing the data in SQlite and enabling encryption on the device AND on the backups, how can I subsequently get copies of the un-encrypted data off the iPad? Since security is an issue, are there ways to transfer the data from the iPad securely? Thanks for any suggestions.

-- Mark

[Mark]

Hi Mark,

You could upload the data to a server using https or encrypt the data before uploading it to a server where it is decrypted.

Kind regards,

Mark

[marksmithhfx]

You could upload the data to a server using https or encrypt the data before uploading it to a server where it is decrypted.

Mark

Thanks Mark, I was going to say "I guess I could format an email message and then let iOS allow me to include a file attachment" however I'm not even sure that is possible (never having tried it). I guess I'll just have to play around with the https command a bit to see how it works. Thanks for that suggestion. One concern I have is this... if the file is encrypted on the iPad (by Apple), what good will it do me to email or https the file? It should still be encrypted, right, and essentially unaccessible to me? I just don't want to paint myself into a corner where even I cannot access the file anymore (if you see what I mean).

OR, and maybe this is just me being stupid but I re-read the docs and RR does not address it: Does Apple decrypt the file for you when you send it https? Also all the https examples seem to be 'getting' url data and there aren't any of putting url data. I hope this works equally well both ways?

Thanks for any advice,

-- Mark

[Mark]

Mark,

You'll have to decrypt the data on the iPad first or find a way to decrypt them on the server. Since you know how to encrypt data, you probably also know how to decrypt it. Since https is encrypted by itself, it is still secure, even if you decrypt the data before sending.

Best,

Mark

[marksmithhfx]

Hi Mark, I thought about it a bit more and realized that Apples encryption has to be transparent to the user (the documentation says that every file on an iPad is encrypted and you cannot disable it) so yes, the iPad must automatically decrypt the file when you try and email or send it by some method (ftp might be another option although as you point out https is probably a more secure way of sending the file). I guess I have enough to get started and the next bit will be trying to figure out the correct syntax to send a file (I'm not generally an internet programmer so this will be new to me). Thanks for the help.

-- Mark

[Jellicle]

I send SQLite databases from iOS devices to a server. The databases are not encrypted on the device by Apple. I'm not sure where you read that they were - perhaps you are referring to encrypted device backups, which are an optional feature in iTunes?

Gerry

[marksmithhfx]

I send SQLite databases from iOS devices to a server. The databases are not encrypted on the device by Apple. I'm not sure where you read that they were - perhaps you are referring to encrypted device backups, which are an optional feature in iTunes?

Gerry

Hi Gerry, I read it here: http://images.apple.com/ipad/business/p ... erview.pdf

The relevant section was:

Encryption
iPad offers 256-bit AES encoding hardware-based encryption to protect all data on the device. Encryption is always enabled and cannot be disabled by users.
Additionally, data backed up in iTunes to a user’s computer can be encrypted. When an encrypted configuration profile is stored on the user’s device, this capability is enforced automatically. And to further protect application data, developers have access to APIs that enable them to encrypt data within their own application data stores.

(my own interpretation of this somewhat confusing paragraph is: (a) Apple encrypts all of the data on the device and you cannot disable it and, I guess by definition, Apple automatically handles the decryption as well when you access or transfer the files (so this all happens transparently?) PLUS (b) if you want to encrypt files that Apple won't automatically decrypt, there are API's for that too. However, I might be misinterpreting this. Let me know if you think so).

-- Mark

PS would you mind posting an example of sending an SQLite file from an iphone/ipad to a server? Just wondering how difficult the syntax is. Thanks a bunch.

[Jellicle]

Ugh. I'm sorry, I was thinking of an experiment I'd done to do copy the db files with ftp to the server. That worked fine but I changed to a remotely updated db using POST and I don't think I ever tested the files on the server to see if I could read them. I just did, and the files are not readable

So I stand corrected, and am better informed

Gerry

[marksmithhfx]

Ugh. I'm sorry, I was thinking of an experiment I'd done to do copy the db files with ftp to the server. That worked fine but I changed to a remotely updated db using POST and I don't think I ever tested the files on the server to see if I could read them. I just did, and the files are not readable
Gerry

Hi Gerry, no worries and thanks for the quick response but you lost me on the "remotely updated db using POST" If I understand correctly you are somehow copying files from an iOS platform to a server and then subsequently trying to read them and they are unreadable? From a security perspective that is great news. From a usability perspective not so great. I think you have just defined the corner that I was hoping not to paint myself into.

So, since we are considering using the iPad as a data collection tool (with iTunes encryption enabled for the backups) it remains to be seen how we can subsequently get the data off the iPad and onto a server for processing. If you have figured out a way to do that please let me know. If I had everything here I would test this, but I'm hoping Marks earlier suggestion of using https (or some URL mechanism) will allow us to do the transfer? I apologize for my ignorance on this topic, but as I mentioned earlier I'm pretty new to the internet programming game.

Cheers,

Thanks

-- Mark

[CALL-151]

Very interesting. I was not aware that data on the iPad are automatically encrypted with AES-256 and have been waiting for LiveCode to add iOS support for the Encrypt/Decrypt commands. The Apple document does seem a bit ambiguous as you point out. To make sure I understand, let me pose a scenario:

I have a LiveCode created iPad app which I use to create a text file of confidential information. That file is saved to the app's documents folder. Because the App supports File Sharing, I can access that file via iTunes by syncing my iPad with my computer.

Someone steals my iPad. I've neglected to enable a passcode or find my iPhone, so they can run my apps and I can't remotely lock or wipe it. Unless they also steal my iTunes account info and use it to set up their computer to sync to my iPad, they have no access to my precious text file short of breaking the AES-256 encryption.

True or False?

[Jellicle]

I think you have just defined the corner that I was hoping not to paint myself into.

Sorry

To clarify, I am using a php script on my server that accepts post commands from the app. The post commands include the data to be written to the MySQL database on my server, one record at a time. You could step through your SQLite database and "upload" the data to a remote database in the same way.

Gerry

[marksmithhfx]

I have a LiveCode created iPad app which I use to create a text file of confidential information. That file is saved to the app's documents folder. Because the App supports File Sharing, I can access that file via iTunes by syncing my iPad with my computer.

My understanding is the file will be unencrypted in iTunes unless you enable the iTunes encryption option. The documentation implies you can also force this with an encryption profile on the iPad (so the user cannot disable it on the backup)

Someone steals my iPad. I've neglected to enable a passcode or find my iPhone, so they can run my apps and I can't remotely lock or wipe it. Unless they also steal my iTunes account info and use it to set up their computer to sync to my iPad, they have no access to my precious text file short of breaking the AES-256 encryption.

True or False?

More or less true. It depends on whether your livecode created app is still on the iPad, in which case they would have access to your text file through the iPad application. In that case I would password protect the stack so that it can't be run, read or modified without the correct pw. I haven't worked with pw's in lc so that is something I might try this weekend, just to see how securely you can lock a stack down.

[CALL-151]

Thanks. I believe the encryption profile option applies to enterprise environments where devices are managed centrally. If I distribute my app and claim that it's data files are automatically AES encrypted, I can't rely on an additional encryption profile which may or may not be on the end user's device. I also have not tried password protecting stacks in LC, but for my purposes it may not be necessary. If my code can create and save files to be accessed via iTunes but can't read them, I think I'm good to go.