Ask HN: How do I ensure that a real iOS client is using an API

by evilswanon 2/14/2012, 1:22:20 PM with 3 comments
  • by saurikon 2/15/2012, 1:22:51 AM

    This is not possible. You should design your architecture so that this either does not matter or has a bounded cost.

  • by edleaon 2/14/2012, 2:34:11 PM

    This is something that the BBC did with iPlayer: http://po-ru.com/diary/device-discrimination-on-the-internet...

    I've not quite worked out how to implement it though

  • by toolmakeron 2/14/2012, 2:04:24 PM

    How about this:

    1. Use the current GMT date/time to generate an encrypted api point like adfa923asdf.yourdomain.com. 2. Make it change every day. 3. For all other hostnames besides the correct one for the day, dump random data so the fake app cannot tell whether or not the api is giving out the right results for sure. All your apps will be pining the right api end point where as the fake ones will have a hard time catching up.

    Also, use authentication on top of all of this.