Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Currently I'm in the middle of a developement process, and I have some security questions for you. I have a webservice, asp.net which is configured to run over https. The first authentication step for the cellphone is to retrieve the certificate from the server, public key ofc. The next step is to send the IMEI to a service to be sure that this particular phone is registered and allowed to send transactions to this webservice. My questions are:

  • Is it possible for someone to get the IMEI without having physical access to the phone?
  • Should I require the a client certificate from the cell phone?

Thanks!

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

On Android and Blackberry, applications can access the IMEI with no special privilege. On iOS, there is no documented API, and you may or may not get away with using undocumented APIs.

The IMEI isn't a terribly good way to identify a phone. Some exotic locales like North America have CDMA phones with no IMEI. All major platforms have a way to report a supposedly-unique identifier which doesn't change during the phone's lifetime (Android, iPhone), but they aren't always reliable. You can never know whether the reported ID is genuine (unless you make additional assumptions, such as your application being used on a non-jailbroken phone), so it isn't a method of authentication.

Unless you need a device identifier that survives uninstalling and reinstalling your application, generate a client certificate at provisioning time. You'll need something like that for authentication anyway, so you might as well use it to identify the device too.

If you want the ability to install your application to be tied to a particular piece of hardware, most smartphones today don't offer this. On any rootable phone, users can back up their installed applications and restore them on another device.

share|improve this answer
    
Thanks for the answer. Forgot to mention that this application is an android application which is not ment to be published in google play. –  Tobias Moe Thorstensen Feb 5 '13 at 9:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.