confidentiality protection for J2ME resource files

[zglozik]

Hi All,

I would like to store sensitive data in a resource file of a J2ME MIDlet. I know that the phones do not protect this data, but my question is how difficult it is for somebody who steals my phone to get access to this information? How can it be retrieved from the phone? A special hardware required or they could get access to my data using only software?

Regards,
Zoltan

[jalev]

Hello

I think it would be not so good way to store any confidental data
without encrypting it. To keep confideltal information
in resource file is actually bad way because in some cases MIDLet ca be taken out from device, and if it contains confidental data, it can be opened, or course encrypting would make this a little bit harder.
But if that data is stored into RMS, persistent memory of MIDlet, that can not be extacted so easily especially if the content is encrypted.
this information will be removed when MIDlet is removed, but remains if newer version is installed over.

One choice would be use network connection, SSL with MIDP 2.0 devices.

[zglozik]

Hello,

Thanks for the reply, I will consider using the RMS. My problem with RMS is that as far as I know SSL cannot be used with MIDP1.0 devices and I do not want to download that sensitive information from a server in clear text. With the resource solution I think I can deploy the MIDlet over serial cable from the PC. Of course, it is not worth too much if it is easy to extract it from the phone :-(

I would not mind using encryption, but where can I store the encryption key? It would be very inconvenient for users to type in a long passphrase every time they want to access the encrypted information.

Regards,
Zoltan

[jackofall]

can you tell me ,how can i modify and access these resource file in my application
using netbeans.
i want to develop an application using these files ..thanks in advance