Digital Edition

SYS-CON.TV
Who Would You Trust?
Sun, Microsoft, or a stranger on the train?

Everyone is looking for our trust at the moment. Schemes for digitally signing applications seem to be popping up like gophers across the mobile landscape, each of them confident that we'll place our trust in their authority. Microsoft, of course, has been trying to convince us to only trust applications and drivers signed by them on our desktops. Now Symbian will be signing applications for our phones while Nokia has launched their own scheme (called "Nokia OK") to demonstrate that the application meets with their approval.

While the lack of granular security in Symbian (once an application is running it can do anything) might make certification useful, Sun reckons that network operators would like to see their approval on Java applications (which generally don't have the same security issues), while the networks themselves are already preparing their own offerings.

So what will all these certificates tell us? Are any of these parties actually willing to take some responsibility for the application when things go wrong? When your digitally signed game starts sending out spam text messages to everyone in your address book will you have someone to sue? It seems not; while all these companies are happy to lend their names to say that the applications work properly, no one appears to be happy to accept the liability when it turns out they don't. Ultimately it's the network operators who will have to deal with irate customers, and blaming them for installing software (the normal defense in desktop support) isn't going to wash. Flashing warnings on the screen just doesn't work, as the recent My Doom and Bagel worms amply demonstrate; users will click "OK" no matter how many times they are told to take care, and it's not practical to educate all mobile phone users in the intricacies of device security.

BREW provides one alternative to pointless dialogs for the user to agree with; it just won't allow users to install an application unless QUALCOMM, or its partners, has approved that application. While that might seem draconian, it will be BREW users who are laughing when the first Symbian worm strikes.

With MIDP 2.0, the latest version of Java, applications are divided into domains including "vendor," "operator," and "trusted third party" with access to different APIs being restricted by who digitally signed the application. When messages are displayed to the user they are clear and action-related, such as: "This application wants to send a text message." The user is then free to make an informed choice to allow or disallow the action. Users understand actions, and an application that misbehaves will be given short shift. This mechanism allows informed choices from the users, while protecting them, and their network, from undue interference. But even this approach is fraught with problems. How do the certificates get onto the phone? What happens if a user changes networks? When an application manages to bypass this security who will be liable (Sun, the network, or the JVM vendor)?

A mobile phone is not a desktop computer, and the security it needs isn't the same. The sooner people start to recognize that fact the better.

Someone else asked me to trust them the other day, someone I had never met and will probably never meet. I was traveling on the subway, reading some documents on my Palm, when up popped a message saying that "Pug Ugly" was trying to connect and did I want to allow them. This was, obviously, a Bluetooth connection and I simply rejected it and continued reading. It seems that Mr. Ugly was a persistent soul, and tried another few times before I switched off my Bluetooth connectivity to be able to read in peace. I had heard about this use of Bluetooth (Bluejacking, as it's known), and while some Nokia handsets have had security issues, in general I leave all my devices advertising their presence and consider such approaches no different from someone walking up to me and talking. It occurred to me that I'm something of a gold mine for anyone playing with a new Bluetooth device, because I carry at least three active devices at any time. People sharing a carriage with me must think Bluetooth is everywhere.

Glancing around the carriage, I noticed a girl surreptitiously keying a Nokia 3650 and could only assume that the identity of Mr. Ugly had been established (though to be fair, the girl was neither Mr. nor Ugly). Checking my P900 later, I discovered dozens of messages sent over a period of months including graphics (like the skeleton pictured) and sounds. I've said several times that the best way to get users comfortable with a technology is to provide a silly application for it, the sillier the better. By playing with Bluetooth, users can gain confidence with this new wireless technology, so when they want a way to connect things together it's the obvious choice. Other than mobile telephones, wireless is still a novelty to most people, making this the perfect time to have some fun with it.

About Bill Ray
Bill Ray, former editor-in-chief (and continuing distinguished contributor to) Wireless Business & Technology magazine, has been developing wireless applications for over 20 ears on just about every platform available. Heavily involved in Java since its release, he developed some of the first cryptography applications for Java and was a founder of JCP Computer Services, a company later sold to Sun Microsystems. At Swisscom he was responsible for the first Java-capable DTV set-top box, and currently holds the position of head of Enabling Software at 02, a UK network operator.

In order to post a comment you need to be registered and logged in.

Register | Sign-in

Reader Feedback: Page 1 of 1

Get your facts straight Nokia DROPPED Nokia OK in favor of Symbian Signed after it launched, as did all of the other Symbian licensees.




ADS BY GOOGLE
Subscribe to the World's Most Powerful Newsletters

ADS BY GOOGLE

CI/CD is conceptually straightforward, yet often technically intricate to implement since it require...
Fact: storage performance problems have only gotten more complicated, as applications not only have ...
"We do one of the best file systems in the world. We learned how to deal with Big Data many years ag...
Traditional IT, great for stable systems of record, is struggling to cope with newer, agile systems ...
Containers, microservices and DevOps are all the rage lately. You can read about how great they are ...
Using new techniques of information modeling, indexing, and processing, new cloud-based systems can ...
When building large, cloud-based applications that operate at a high scale, it’s important to mainta...
While some developers care passionately about how data centers and clouds are architected, for most,...
"Peak 10 is a hybrid infrastructure provider across the nation. We are in the thick of things when i...
We are seeing a major migration of enterprises applications to the cloud. As cloud and business use ...
DevOps tends to focus on the relationship between Dev and Ops, putting an emphasis on the ops and ap...
With 10 simultaneous tracks, keynotes, general sessions and targeted breakout classes, @CloudEXPO an...
Containers and Kubernetes allow for code portability across on-premise VMs, bare metal, or multiple ...
In this presentation, you will learn first hand what works and what doesn't while architecting and d...
Bill Schmarzo, author of "Big Data: Understanding How Data Powers Big Business" and "Big Data MBA: D...
The now mainstream platform changes stemming from the first Internet boom brought many changes but d...
CloudEXPO New York 2018, colocated with DXWorldEXPO New York 2018 will be held November 11-13, 2018,...
The Internet of Things will challenge the status quo of how IT and development organizations operate...
The best way to leverage your Cloud Expo presence as a sponsor and exhibitor is to plan your news an...
More and more companies are looking to microservices as an architectural pattern for breaking apart ...