I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself.
Now, my question is, how do I identify that the web service request is coming from the mobile application I developed? On normal web applications, one can make use of a combination of certificates and digital signatures to ensure the identity of the caller.
The main problem is that Silverlight does not allow the developer to load the certificates installed on the mobile phone and get the private key to sign the data. I thought of hardcoding the private key into the application, however this is not secure at all as the application can be easily disassembled and reverse-engineered.
What else can I do to make sure that the web service request came from the mobile application I developed rather than from a normal web application?