Click here to get back home

Application Locking

 HomeNewsGroups | Search | About
 microsoft.public.smartphone    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Application Locking Harmonis 10-16-2005
---> Re: Application Locking Robert Levy [MS...10-16-2005
Posted by Harmonis on October 17, 2005, 10:35 am
Please log in for more thread options
I was informed recently that the device im using is vendor locked at the
application level. And that is is the policy of the vendor that all
applications need to be protected to prevent damage.

I'll be contacting the vendor and demanding the application lock removal or
returning the device and going elsewhere, I hear Apples new line of smart
devices are easier to deal with.

Procedures and Policies as you put aren't my problem. You stepped off the
train into this new adventure, and you (Microsoft) must now take all the
comes with it.

I can see from your comment made about surgery you did the typical Microsoft
tap dance around the question. Im not trying to change the world, just
trying to get to the GO sqaure while playing the Microsoft Monopoly game.

"Robert Levy [MS]" wrote:

> Inline
>
> --
>
> -Robert Levy
> Program Manager, Windows Mobile Developer Experience
> http://blogs.msdn.com/windowsmobile
>
>
>
> > Interesting response, considering I shelled out money for The OS and then
> > more for the Developer software, and then I purchased the device. Now you
> > want me to pay to write my own Apps?
>
> Absolutely not. There are thousands of great Smartphone apps out there that
> do not use the small handful of privileged APIs - those developers paid
> nothing extra to write those apps.
>
> > What was it you were saying about 99%
> > of the blah blah? Please use your canned responses somewhere else.
>
> This whitepaper explains the security model and the appendix lists the APIs
> & registry keys that are protected. Everything else is fair game.
>
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnppcgen/html/smartphone_security.asp
>
> > I have craeted Amazing Applications for the pocket PC, I use them everyday
> > at work. They make my job eaiser, sure be nice to have the same ability
> > on
> > my phone.
>
> That would be awesome - it's the 3rd party applications that really make our
> platform shine. Let's try to figure out why that isn't working for you.
> Can you compare your app against the list of APIs & regkeys listed in that
> whitepaper?
>
> > As for the high risk comment you made? Looks like someone needs to bite
> > the
> > bullet and take a chance, they dont want to have to worry about the
> > dangers
> > then they should get out of the market, not pass thier paranoia down to
> > the
> > consumer who gets hurt the most.
> > Every time a Surgeon preforms an operation he risks life or death on
> > someone, it's part of the job.
>
> Surgery is *very* risky but a lot of that risk is mitigated through various
> policies and procedures.
>
> On Smartphone the mitigation is simple: 3rd party apps are free to party on
> the platform but if they touch one of the few APIs that has the potential to
> damage the network, the developer needs to go to a signing process. The
> signing process ensures that if an application turns out to be malicious, 1)
> parties damaged by it can identify and prosecute the developer and 2)
> operators can send out a certificate revokation that stops the app from
> spreading to other devices.
>
> >
> > Harm |
> >
> > "Robert Levy [MS]" wrote:
> >
> >> There are a small set of programming interfaces which have a high risk of
> >> being used mailiciously impact the device or cellular network. Operators
> >> have the option of preventing uncertified applications from accessing
> >> those
> >> interfaces. Microsoft makes $0 on the certification process (it's done
> >> entirely by 3rd parties). Meanwhile, 99% of the programming interfaces
> >> are
> >> available to developers to run with and create amazing apps.
> >>
> >> --
> >> -Robert Levy
> >> Program Manager, Windows Mobile Developer Experience
> >> http://blogs.msdn.com/windowsmobile
> >>
> >> > As I see it application locking is Microsofts way of generating more
> >> > revenue,
> >> > and should be an insult to the development community. It's like they
> >> > are
> >> > saying "unless your pay 23842973432 dollars you aren't worthy of
> >> > writing
> >> > applications for mobile devices."
> >> >
> >> > It's like buying a car, then having the dealer telling you what roads
> >> > you
> >> > can only drive on.
> >> >
> >> > I bought the unit, I should be able to DO with it as I please. If this
> >> > doesn't policy doesn't change in the future I can see lot of people
> >> > shying
> >> > away from Mobile devices and in the end that would hurt the device more
> >> > than
> >> > help it.
> >> >
> >> > Just my .02 cents.
> >> >
> >> > (Let the flaming begin)
> >> >
> >> > Harm|
> >> >
> >>
> >>
> >>
>
>
>


Posted by si on October 18, 2005, 12:03 am
Please log in for more thread options
Agreed. Everyone touts that Microsoft makes $0 on the certification process
(it's done entirely by 3rd parties).

Well we all know that someone owns these companys and why should any company
give away free business when it can do it itself? I bet Microsoft has a
significant share in these companies or a great vested interest in them
doing well.

There are ways and means to make money indirectly as well as directly.




Posted by Robert Levy [MS] on October 17, 2005, 10:16 pm
Please log in for more thread options
These are the same 3rd parties that participate in the certification
processes used by our competitors.

The only sense in which we "profit from it is that by having a strong
security model, operators are willing to sell devices with our platform and
security conscious folks (like IT admins) are willing to buy those devices.

--
-Robert Levy
Program Manager, Windows Mobile Developer Experience
http://blogs.msdn.com/windowsmobile

> Agreed. Everyone touts that Microsoft makes $0 on the certification
> process
> (it's done entirely by 3rd parties).
>
> Well we all know that someone owns these companys and why should any
> company
> give away free business when it can do it itself? I bet Microsoft has a
> significant share in these companies or a great vested interest in them
> doing well.
>
> There are ways and means to make money indirectly as well as directly.
>
>




Posted by Prof. Mobile on October 18, 2005, 8:39 am
Please log in for more thread options

The REAL problems you have with code signing which nobody tells you:
====================================================

- the limited access to privileged functions is NOT included in the 3rd
party signatures. They only provide signatures which allow you to
install normal software which don't need a signature at all. In most
cases the OEM/operator removes all 3rd party roots for privileged
access. This means you would have to purchase a signature from each
OEM/operator. But in most cases they simply refuse to sign privileged
(e.g. Orange never issued a privileged signature to a single ISV)

- you have to pay for every update/bug fix you want to release (even if
you only add a workaround in your application for a new firmware version
which screws up something) The signature verification model implemented
in WindowsMobile uses normal certificates and PKI chains. This means a
normal certification of a company would be possible to issue a standard
code signing certificate. However the scheme implemented by the so
called 3rd parties is only to make a lot of $. They request a fee for
each signature for no reason.

- there is no security gain by charging for every signature. The
process involved does NOT check anything of the application to ensure
that it is no malware.

Conclusions:

- nobody needs to sign his applications.
- you only can get expensive NON-privileged signatures which are
useless (they only suppress a warning message at installation time /
first execution).
- there is no standard way for privileged signing since some
OEM/operators do not include the 3rd party privileged access root
certificates
- the implemented scheme of charging per signature is a rip off. A
normal certification of the developer and issuing a code signing
certificate (well known and working procedure from PC Software
development) is possible but would not bring them enough money. Any
other reasons you can imagine why it is not implemented?
- today only Microsoft has a privileged root ceritifcate present in all
devices. So the only point to ask for privileged signatures is
Microsoft.


--
Prof. Mobile
------------------------------------------------------------------------
Prof. Mobile's Profile: http://www.mobilejoe.de/joeforums/member.php?userid=357
View this thread: http://www.mobilejoe.de/joeforums/showthread.php?t=15752



Posted by Robert Levy [MS] on October 18, 2005, 9:28 am
Please log in for more thread options
For privileged signing, things have gotten much beter over the past year.
Fewer and fewer devices are shipping without the Mobile2Market privileged
certificate as operators come to see the value of supporting a standardized
signing program. And we finally posted info on the web explaining the
requirements for getting signed with that certificate.

The cost issue is more complex, but we're working with CAs to improve that
as well.

--
-Robert Levy
Program Manager, Windows Mobile Developer Experience
http://blogs.msdn.com/windowsmobile

>
> The REAL problems you have with code signing which nobody tells you:
> ====================================================
>
> - the limited access to privileged functions is NOT included in the 3rd
> party signatures. They only provide signatures which allow you to
> install normal software which don't need a signature at all. In most
> cases the OEM/operator removes all 3rd party roots for privileged
> access. This means you would have to purchase a signature from each
> OEM/operator. But in most cases they simply refuse to sign privileged
> (e.g. Orange never issued a privileged signature to a single ISV)
>
> - you have to pay for every update/bug fix you want to release (even if
> you only add a workaround in your application for a new firmware version
> which screws up something) The signature verification model implemented
> in WindowsMobile uses normal certificates and PKI chains. This means a
> normal certification of a company would be possible to issue a standard
> code signing certificate. However the scheme implemented by the so
> called 3rd parties is only to make a lot of $. They request a fee for
> each signature for no reason.
>
> - there is no security gain by charging for every signature. The
> process involved does NOT check anything of the application to ensure
> that it is no malware.
>
> Conclusions:
>
> - nobody needs to sign his applications.
> - you only can get expensive NON-privileged signatures which are
> useless (they only suppress a warning message at installation time /
> first execution).
> - there is no standard way for privileged signing since some
> OEM/operators do not include the 3rd party privileged access root
> certificates
> - the implemented scheme of charging per signature is a rip off. A
> normal certification of the developer and issuing a code signing
> certificate (well known and working procedure from PC Software
> development) is possible but would not bring them enough money. Any
> other reasons you can imagine why it is not implemented?
> - today only Microsoft has a privileged root ceritifcate present in all
> devices. So the only point to ask for privileged signatures is
> Microsoft.
>
>
> --
> Prof. Mobile
> ------------------------------------------------------------------------
> Prof. Mobile's Profile:
> http://www.mobilejoe.de/joeforums/member.php?userid=357
> View this thread: http://www.mobilejoe.de/joeforums/showthread.php?t=15752
>




Similar ThreadsPosted
SMT 5600 Locking Up after charging November 16, 2005, 5:10 pm
Locking down 3G/EDGE on the Blackjack2 August 14, 2008, 7:47 pm
Can VB.net application use in O2 Xphone October 20, 2005, 8:44 pm
Certified application October 30, 2005, 10:13 pm
application unlocking August 25, 2005, 4:31 am
How to actually exit an application? January 30, 2006, 8:49 pm
Lost Application June 21, 2006, 2:07 pm
Application signing... September 27, 2008, 4:12 pm
Auto-off application for MPX200 July 17, 2005, 10:18 am
ActiveSync application error July 21, 2005, 2:59 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap