Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite
  1. Is anyone aware of any mobile (iPhone, Android, Windows mobiles and Blackberry) Operating System that support multi users? I am not aware but I thought it is worth double checking. Off course, in case yes, please tell me in case how many user groups do they allow and whether they are daemons or human users.
  2. If I need to store information that are confidential or not to be shared among other users, whether in the same application or on the mobile in case different user groups are allowed. Please, can you list for the me the safest way to store these data on an:
    • iPhone,
    • Android
    • Windows mobiles and
    • Blackberry

One thing I can think of for instance is a home directory specific to a the user logged in. I know that Android might be different. Any additional details is very much appreciated.

share|improve this question
1  
I think this perhaps needs to be split into at least two questions, and at least one of them should be moved to SuperUser or another site. – Iszi Jan 18 '11 at 16:07
1  
the purpose of this question is to know where to store confidential information. The detailed questions are simply to cover all types of users. Users of the OS and users of the application.IMHO answering both the questions make the answer complete. – Phoenician-Eagle Jan 18 '11 at 16:15
1  
@Paul - This question is quite distinctly (you've even numbered it) two-part. In most SE communities, it is considered good form to break these into two separate questions. "Do any of the mobile OS's support multiple users?" is one question, and better suited for the SuperUser environment. "How can multiple users privately and individually store information on a shared mobile device?" is another question, which may be considered more relevant here. – Iszi Jan 18 '11 at 17:42
1  
The security model in android, iphone, etc is very different from a desktop os. You typically rely on each app to store data appropriately, and apps often store them in the cloud or in storage that may be hidden from even the user. E.g. think of an app for medical data, which aims to ensure that you only use the data appropriately. See e.g. Nick's message about android: groups.google.com/group/android-security-discuss/browse_thread/… – nealmcb Jan 18 '11 at 17:45
1  
on most any system, a "home directory" is no more secure than any other directory, though it may be configured differently by default. So I agree that moving or closing this question makes sense. And I don't think android or iphone has a particularly useful notion of a home directory, and certainly not many of them. – nealmcb Jan 18 '11 at 17:49
show 1 more comment

3 Answers

up vote 4 down vote

On Android, the notion of a home directory is not apparent to the user, and it is designed for only one user.

The userid and groupid mechanisms are used to enhance application security. Each application has its own userid, and it is the job of the application to appropriately secure the data, which may be in the cloud or stored locally.

The model is intended to work even for applications which need to protect the data from the user. Think of a medical records application, which tries to prevent inappropriate use of the data.

Android makes it pretty easy to store data pretty securely, avoiding many of the pitfalls of traditional desktop systems. Android also makes it pretty easy to authenticate and share data with other applications. See details at:

share|improve this answer
So, in short it seems the answers (for Android) are "No" and "Not for user data"? – Iszi Jan 18 '11 at 18:18
1  
@Iszi Indeed. Of course, you can always write an app that requires a username/password combo and encrypts all the data it stores. – Matthew Read Jan 18 '11 at 19:32
up vote 4 down vote

On iPhone, there's no concept of multiple users. Each application has its own home directory, which sandboxes its data away from all the other applications (actually, it's the mandatory access controls that do the sandboxing, but they work on the app home directories).

You need to look at specific applications that provide multiple-user behaviour, and deploy them. For example, CameraSafe lets users create multiple accounts with passwords, then because the storage is encrypted no user can access another's files without knowing the other user's password. As a disclaimer I should point out that I am one of the developers on CameraSafe.

share|improve this answer
up vote 2 down vote

Windows Mobile does not support multiple users. Here is the security model: http://download.microsoft.com/download/9/3/5/93565816-AD4E-4448-B49B-457D07ABB991/Windows%20Phone%207%20Security%20Model_FINAL_122010.pdf

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.