7

One of the enterprise-y features of Blackberry that some organizations I work with are drawn to is data encryption. The theory being that the all user data is encrypted by the operating system, and not left to app developers.

Does Windows Phone do this now, or is encryption entirely dependent on the App Developer? What about the built-in apps? Is data stored encrypted by say, the Mail App?

5

This is only a partial answer, and hopefully someone can improve on it.

I can't answer if data is encrypted for Mail and the other built in apps, but each application does get a sandboxed local data store. The weather app you download can't access the saved data from your mail app, and so on.

Now, for 3rd party applications it is up to the developer to encrypted the data should they wish. By default what is put in Isolated Storage (that is what they call the sandboxed data store) is in clear text.

Thankfully, short of some unknown exploit, the only way to get the data would be having it developer unlocked, and also in the hands of the un-trusted person. They could run the Isolated Storage browser or some other homebrew application, and see what is on the phone, and possibly get sensitive data. If you are worried about this there are a few safeguards you can enable:

  1. Put a PIN on your lock screen. After 3 incorrect tries the phone is restored to factory settings*. Settings > Lock and Wallpaper > Password
  2. Enable "Find my Phone". Not only will you be able to see where the phone is, you can send an "erase" signal to it forcing all the data to be wiped. Settings > Find my Phone

I will use this answer as an example as to why you should be careful when installing homebrew applications. The applications you download via the official Marketplace undergo extensive review and certification. They are also limited as to what they can do. For instance, I can not write an application that will take over the default browser on the phone.

However, homebrew applications are not "official", and do not undergo the same process. In a homebrew application I can use what they call "Native Code". Doing so gives me much more flexibility on what I can do, but also put you, the user, at risk. I could secretly be monitoring your email, or sending browsing history back to the cloud. Always be cautious when installing homebrew.

If you don't know what I am talking about, then most likely you don't need to worry about it. Currently, you need to have your phone "developer unlocked" which means you are able to create applications for you phone. You can not get these homebrew applications from the marketplace.


* Only if the phone is synced to an Exchange account. Otherwise it just creates a "timeout", and you must wait to try again

  • I believe that it will force a factory reset only if you're synced with an Exchange account. If you are not, it will just lock the phone for a specified period of time, after which you can try again. – Ben Richards Apr 27 '12 at 21:14
  • @sidran32 I can't answer to that. I am synced to several exchange accounts now, and don't want to test it. If anyone is brave enough to, please let us know :) – Joe Apr 27 '12 at 21:20
  • I have. I used to sync to Exchange at my old job, but now I do not at my new one. After my brother tried guessing my PIN about 5 times, it said "try again in 1 minute", locked the phone, and only let me make emergency calls (it put the "emergency call" button on the lock screen). I just tested it right now. It is still playing music, though. :) – Ben Richards Apr 27 '12 at 21:22
  • I would also assume that subsequent attempts will increase the time from 1 minute to greater values. I haven't tested that though. – Ben Richards Apr 27 '12 at 21:23
  • @sidran32 Thank you, I will update the answer with the new information – Joe Apr 27 '12 at 22:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.