How secure is NSUserDefaults on iOS 8,9?

In-App Purchase Programming Guide suggests you can persist In-App purchase in NSUserDefaults here. However I found this article saying that it is insecure and data in it are easily accessed and modified:

NSUserDefaults are stored in plist in binary format, with no encryption, and is stored in your app’s directory. This means that any user, even the “noobiest” one, can tinker with your NSUserDefaults with 5 minutes of their time.

If it is true user can easily get for free anything provided as in-app purchase that is persisted using NSUserDefaults.

Is the article still correct for iOS 8,9? If so how do you persist your in-app purchases? I prefer some simple solution. I do not (nor want to) validate receipts etc.

As others have said, it's probably better to not save sensitive data in UserDefaults such as in-app purchases or obviously things such as passwords. Even things like high scores are better saved in keychain so people cannot cheat.

I think that part of the Apple Documentation is outdated and should be changed as UserDefaults are not the way to store sensitive data, which in app purchases definitely are IMO.

Just save basic stuff in UserDefaults like language settings, volume settings etc.

If you want to save sensitive data you should use Keychain. Now the keychain API I think is very tricky but there are 2 great helpers on GitHub you can use

1) https://github.com/jrendel/SwiftKeychainWrapper

2) https://github.com/matthewpalmer/Locksmith

I personally use the first one as its more straight forward and easier to use. It literally makes the task of saving your data identical to UserDefaults. Just copy the swift file into your project or use CocoaPods and you are ready.

The second one is more advanced and complex but still great. It's just a choice of what you need and how well you understand the Keychain API.

One thing to bear in mind with keychain is that data persists even if you delete your app, which I actually consider a good thing.

All credit goes to both authors of their respective wrappers.

Hope this helps