Understanding iOS Provisioning Profiles

Question

My understanding is that Provisioning Profiles are used to prevent your app from being installed and used on devices not authorized by you. However, I don't see how this can be enforced since anyone can create the profile they need.

If I wanted to run app com.company.app, all I need to create the profile is the app id, which I have(com.company.app), the UUID of the phone I want to run it in, which I have because it's my phone, and the certificate of the developer which is not supposed to be secret since it holds the public key.

So, what's keeping me from creating my own profile, installing it on my phone and run the app without the developer's authorization?

Answer 1

You misunderstand the point of the provisioning profiles. The point is not to prevent unauthorized users from running your app. The point is to make it difficult for you to distribute your app outside of the App Store by limiting the number of devices you can install it on.