Security Manager for WM5

Though the Device Security Manager PowerToy for Windows Mobile 5.0 has been available since June 6th, 2006, it's such an important application that it deserves mention even a year after its release. For one thing, it allows developers to easily bypass the incessant prompting that occurs every time a binary is changed and loaded on the device. And for two, it allows you as a developer to test different security policies on one device.

The website says:

Device Security Manager helps developers test various security policies for Windows Mobile devices. It is designed as a desktop application that ships w ith a preset list of “security configurations”. A security configuration can be thought of as a template, which contains a collection of individual policies and settings. For example, a security configuration could define policies such as whether unsigned applications are allowed to execute, whether RAPI is disabled etc. Using this tool, the developer can provision a Windows Mobile device with different configurations, and then test the application’s behavior under these configurations. This tool can be used either on an emulator or an unlocked Windows Mobile device.

Signing SmartPhone Apps

The security model for Smartphone applications is based on certificates. A device can be configured by the device manager (usually the network operator) to allow only signed applications to run. Whether an application can run or not depends on:

• If the device has a one- or two-tiered security model
• The current security mode of the device: Open, Locked, or Prompt
• How the application was signed: with a privileged certificate, unprivileged certificate, or not at all

One-tiered devices give access to all APIs for applications that are allowed to run. On two-tiered devices, there are APIs that cannot be access unless the application was signed with a privileged certificate.

If the device has:

• Open security mode, all applications can run, signed and unsigned.
• Locked security mode, only signed applications run on the device.
• Prompt security mode, all signed applications run without a prompt, and the user is prompted to reject or accept all unsigned applications.

(from MSDN).