List: websecurity@lists.webappsec.org
From: WebAppSec@CoreForm
Re: [WEB SECURITY] json, iphone, objectivec
Thu, Mar 10, 2011 1:45 AM
To mitigate potential man-in-the-middle attacks, pull the JSON data
over a secure channel (HTTP + SSL/TLS = https). iOS won't allow
connections using self-signed certificates, unless you add other
authorities.
The fat client should not trust data from the cloud, so it would be
best to validate data before using it within logic.