Currently I'm in the middle of a developement process, and I have some security questions for you. I have a webservice, asp.net which is configured to run over
https. The first authentication step for the cellphone is to retrieve the certificate from the server, public key ofc. The next step is to send the
IMEI to a service to be sure that this particular phone is registered and allowed to send transactions to this webservice. My questions are:
- Is it possible for someone to get the IMEI without having physical access to the phone?
- Should I require the a client certificate from the cell phone?