Bluetooth: confirmation message on incoming RFCOMM connections

[pracucci]

Hi,

I have developed a MIDP Bluetooth-based application, that listens for remote connections on a RFCOMM channel and serves each connection.

I have noticed that some Nokia phones, like 6233 and 6288, show a confirmation message ("Accept connection from... ?") before accept the incoming RFCOMM connection. The connectivity application privileges are set as "accept always" and I can't understand why the phone shows the confirmation message every time it receive an incoming RFCOMM connection.

I would like to bypass the confirmation request message, because this application should work without any user interaction.

Do you have any idea and/or suggestion?

This problem has already been explained http://discussion.forum.nokia.com/fo...ad.php?t=93164, but no one has replied.

Marco Pracucci

[matrix241]

problem seen also on Nokia 6131. -> probably all s40 3rd ed. devices are affected?
On s0 3rd ed. dev. the behaviour is different: no cofirmation pop-up is shown.

[matrix241]

did you try to test the application after having authorized manually the device that is trying to connect on the phone that is used to acceptandopen the connection?

[pracucci]

On s0 3rd ed. dev. the behaviour is different: no cofirmation pop-up is shown.

What do you mean with "s0"?

did you try to test the application after having authorized manually the device that is trying to connect on the phone that is used to acceptandopen the connection?

It seems that the "confirmation message" is shown for all incoming connections from devices that are not in the associated devices list.

Marco Pracucci

[luis-junior]

Marco,
Your midlet must be signed (Java Verified) to stop annoying you with those messages. It happens for all actions your midlet are going to do (Http connections, using camera, etc) not only Bluetooth.
Signing your midlet is a process, but you can use signing tools to test it.

[matrix241]

Marco, "s0" is an error typing s60.

As regard signing, I don't think it solves this problem. I've an application signed and installed on a 6131 device: the message is shown when accepting a bt connection from another device.
It's a difference of implementation between s60 and s40 3rd ed. phones. I think the s60's is the right way because instead the parameter "authorize=false" would be useless!

[luis-junior]

I've an application signed and installed on a 6131 device: the message is shown when accepting a bt connection from another device.

Did you make pairing before connect devices? I believe pairing and setting as trusted devices you won't receive those messages anymore if your application is signed.

[matrix241]

Did you make pairing before connect devices? I believe pairing and setting as trusted devices you won't receive those messages anymore if your application is signed.

In that way it's ok, but so what would be the meaning of "authorize = false" , "authenticate = false" ??

I think this is a bug of s40's implementation.

BR

[luis-junior]

...so what would be the meaning of "authorize = false" , "authenticate = false" ??

I would say you are working at 3rd level security in Bluetooth - not recognized (authorize) and not trusted (authenticate). So you might enforce security and maybe alerting user is the good strategy for that.

In 2nd level you may be recognized but still untrusted. Bluetooth SIG recommends you to just mark a connection as really reliable (without alerts) when first pairing and then trusting. So, specially keeping Java security principles, maybe that's fine still keep alerting users (even your midlet is signed)

And 1st level you are recognized and trusted. So, the only thing now is make sure you aren't going to run a malicious code, and Java Verified stamp would ensure that for you. You shouldn't receive any alerts.

In the 2nd level securtity, it's a recommendation implicit for vendors that I believe may follow or not... But I don't think it can be a bug for S40.
It would prevents Bluesnarfing and Bluebugging as well.

Best Regards!

[matrix241]

sorry but I don't agree with you. the parameters authorize, authenticate are set to false in order to leave the connection opened to non authorized or authenticated devices. If a message is shown, these settings to "false" are useless.
If not a bug , it's surely a difference from s60 implementation.

[luis-junior]

Hi,
Yes, yes, you are correct about the parameters and S40. I'm not sure if it can be related as a bug, as it is only a "recommendation" from SIG, but it is really a difference implementation from S60.
I made myself confused merging security levels and "false" parameter. Sorry about that. Anyway scenario is:

paired, signed = No alerts (ok)
not paired, auth = false, signed = alert (and should not ask for it)
not paired, auth = false, not signed = alert

I got something related, but opposite for Symbian 8.0.
Best Regards