×

Discussion Board

Page 1 of 2 12 LastLast
Results 1 to 15 of 16
  1. #1
    Registered User
    Join Date
    Nov 2006
    Posts
    14

    Pushregistry, Security Alert after signing the midlet?

    Hello Forum,

    i questioned the Verisign Support to disable the security alert when automatically launching a midlet by the pushregistry.

    The Support says that it is not possible to disable the security alerts by code signing the midlet or rather to disable a prompt that asks the user to accept the midlet, which comes after the signing process.

    Is this true???

    It is really important for me to use the autostart function from the push registry without asking the user for permission. It´s ok, to ask the user after the installation process once but after that it have to launch without such a prompt.

    Here my originally question to the verisign support:

    I need a clear statement about, that midlets, which are signed with the Verisign Code Java ID Certificates, can use the autostart - function of the PushRegistry WITHOUT confirmation of the user. The midlet will specifically be activated through a timer or an incoming SMS-messages. So it should be possible after signing the midlet, to start a midlet through a timer or an incoming SMS - without confirming before a security warning.

    and here the answer:

    Your end-users will still be prompted to accept your midlet, but instead of a security warning message where the publisher of the midlet is unknown, your users will see a message asking them if they would like to run the midlet which has been signed by you.
    There is no way to disable the prompt asking the end-user to accept your midlet. The manner in which midlets, signed and unsigned, are handled is programmatically determined by the OS on the handset and there is no way for us to change that. Your users will still receive a prompt, but as I mentioned above, it will be one asking them to accept the midlet which has been signed by you instead of a security warning telling them that the publisher is unknown.

    Please help me quickly, i have a big problem if the conclusion from verisign is true....

    We will use the following devices:
    Nokia 6230i, 6230 and 5140

    Thanks a lot!
    Juppi

  2. #2
    Nokia Developer Champion
    Join Date
    Mar 2003
    Posts
    4,105
    Do you have a VeriSign/thawte certificate already or are we discussion theory?

  3. #3
    Registered User
    Join Date
    Nov 2006
    Posts
    14

    Re: Pushregistry, Security Alert after signing the midlet?

    Hi Troud,

    thanks a lot for you interest, its very important for me to find a solution..

    I don´t have a verisign certificate yet, but i want to buy one if I know that it will help me...

    The fact is, that i have to develop an application that launches automatically without asking the user to start.
    So it doesn´t make any difference for me if there comes a security prompt or a prompt, which shows the user the owner of the midlet....both have to confirm by the user before starting the midlet!

    How can i solve this problem?

  4. #4
    Nokia Developer Champion
    Join Date
    Apr 2003
    Location
    USA, CA
    Posts
    7,192

    Re: Pushregistry, Security Alert after signing the midlet?

    juppi, please check this item as your target devices are Series 40 devices
    http://www.forum.nokia.com/Technical...40_MIDlets.htm

    Hartti

  5. #5
    Registered User
    Join Date
    Nov 2006
    Posts
    14

    Re: Pushregistry, Security Alert after signing the midlet?

    Hello Hartti,

    thanks for your answer, this describes the problem very exact...
    So if there is no workaround available, its very hard for our project...

    Has everyone experience values with pushregitry and Series 60 Devices???

    Thanks a lot...

  6. #6
    Registered User
    Join Date
    Nov 2006
    Posts
    14

    Re: Pushregistry, Security Alert after signing the midlet?

    Hello again,

    it seems to me as nokia disabled their own features, so there is a menu where i can choose "always allow" the autostart function in signed midlets but there is no effect...

    In hartti´s link is explained that there is no workaround, but i won´t believe this!
    We are a big company, has everyone experience values if it is possible to receive a special firmware for the devices to enable this "feature", so that the menu takes effect? Why else does nokia implement such a menu, which irritated the user???

    Is it possible to connect nokia for these concern? Does everyone have a good contact?
    Last edited by juppi; 2006-11-10 at 13:26.

  7. #7
    Nokia Developer Champion
    Join Date
    Apr 2003
    Location
    USA, CA
    Posts
    7,192

    Re: Pushregistry, Security Alert after signing the midlet?

    juppi,

    In the technical library note it is stated:
    "This is a Series 40 Java UI design decision based on the serious usability implications of MIDlets auto-launching themselves without the user’s knowledge."

    As one example of the usability implications: You have to remember that Series 40 does not support multiple simultaneous applications. Launching you midlet through PushRegistry without getting a confirmation from the user that this is indeed desired, would cause the active application to be closed.

    There is no special firmware available for Series 40 devices to overcome this.

    This has been discussed a couple of times earlier on these boards, here is a link to page 2 of another thread (check the comment by Nokia Ron)
    http://discussion.forum.nokia.com/fo...t=74068&page=2

    Hartti

  8. #8
    Registered User
    Join Date
    Nov 2006
    Posts
    14

    Re: Pushregistry, Security Alert after signing the midlet?

    Ok,

    first thank you for your answer!
    I think i have to accept this design decision...

    If I understood this article right, a code-signed midlet with ie. a certificate from VeriSign allows to "always allow" the registration of a push-event not the autostart...

    So if this is right, the confirmation for registering the pushevent will not be prompted if i sign my midlet?

    What other advantages does it take to sign my midlet with such an (expensive) certificate? How about the user-prompts to allow sending sms- messages and using recordstores?

    Is it possible to deactivate all these prompts with a code-signing certificate?

    If yes i only want to receive the prompt when autostarting the midlet, this might be ok...another chance apperntly does not exist...

  9. #9
    Nokia Developer Champion
    Join Date
    Mar 2003
    Posts
    4,105
    No one can answer this, however, I recommend to play with the Nokia Series 40 Platform SDKs as these reflect all security questions. Just set it to 3rd party level and you will see how it works when signed. In most of these SDKs you can even add a self-signed certificate and try the whole process before you go out and buy a VeriSign and thawte certificate. Always buy two roots as many phones have only one.

    Nevertheless, the SDKs do not match all devices out there. There are some terrible configurations which will give more questions.

  10. #10
    Nokia Developer Champion
    Join Date
    Apr 2003
    Location
    USA, CA
    Posts
    7,192

    Re: Pushregistry, Security Alert after signing the midlet?

    As traud mentioned, answering all your questions would require a long response. I would recommend you to play with the SDK as traud suggested, and also read the MIDP security policy recommendation. (now part of the MIDP 2.1 spec - go to jcp.org web site)

    Hartti

  11. #11
    Regular Contributor
    Join Date
    Mar 2003
    Location
    Israel
    Posts
    119

    Re: Pushregistry, Security Alert after signing the midlet?

    Hi Juppi.

    Did you solve the problem ?

    I need my application to launch itself 60 seconds after it was destoyed (for example). to your understanding and feedbacks - will signing solve the prompt issues on this case ?

    My target handsets are Nokia S40 and S60.

    This might not be the place to ask this, but are you familier with a non-nokia handset that does not prompt the user on this case ?

    thanks !
    Shai . K

  12. #12
    Nokia Developer Champion
    Join Date
    Apr 2003
    Location
    USA, CA
    Posts
    7,192

    Re: Pushregistry, Security Alert after signing the midlet?

    shaikuny,

    On Series 40 devices, there will always be some kind of a prompt presented to the user. See here
    http://www.forum.nokia.com/document/...40_MIDlets.htm

    On S60 side, which can place application on the background, you need to sign your midlet and then manually change the settings for MIDlet autostart to "always allowed"

    Hartti

  13. #13
    Registered User
    Join Date
    Jun 2007
    Posts
    4

    Re: Pushregistry, Security Alert after signing the midlet?

    Quote Originally Posted by hartti
    shaikuny,

    On S60 side, which can place application on the background, you need to sign your midlet and then manually change the settings for MIDlet autostart to "always allowed"

    Hartti
    Do you actually mean that if I sign my midlet and set its autostart setting to "always allowed" I won't have any prompt at the launch of the app ?
    Neither will I (for sms, location ...) if I sign the midlet ?
    The midlet execution needs to be totally "transparent" for the user.

  14. #14
    Nokia Developer Champion
    Join Date
    Mar 2003
    Posts
    4,105
    Please read this excellent Wiki article created by Hartti first …

  15. #15
    Regular Contributor
    Join Date
    Aug 2005
    Posts
    86

    Re: Pushregistry, Security Alert after signing the midlet?

    hi
    i have small doubt in Push Registry...........
    Can i do autostart my midlet after switch "On" my mobile.......

    if is it possible to do like this, please tell me the solution as soon as possible......

    thanks in advance
    Senthilmurugan.R

Similar Threads

  1. MIDlet signing with Thawte cert for 6600
    By kersing in forum Mobile Java General
    Replies: 3
    Last Post: 2008-03-07, 05:41
  2. Midlet signing w/ Netbeans
    By browndrf in forum Mobile Java Tools & SDKs
    Replies: 5
    Last Post: 2007-12-15, 23:53
  3. PushRegistry, networking, security on s60 (friday classic)
    By HugoF in forum Mobile Java Networking & Messaging & Security
    Replies: 0
    Last Post: 2006-07-28, 17:15
  4. MIDlet Signing (URGENT -- PLEASE HELP ME NOKIA EXPERTS)
    By earamsey in forum Mobile Java General
    Replies: 0
    Last Post: 2004-10-25, 23:57
  5. Midlet Signing Questions
    By kcarlino in forum Mobile Java General
    Replies: 0
    Last Post: 2004-05-12, 18:17

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •