4
Passwords and other sensitive user data should be stored in the keychain. The API for the keychain is plain C and available by linking agains the Security framework.
This API is somewhat cumbersome to work with. I usually use the excellent Objective-C wrapper by Buzz Andersen available at github...