Has Nokia stopped piracy?
The Nokia 5800 I have runs on the Symbian S60 5th Edition operating system, and it seems to be a decent OS—but built into it is the most interesting anti-piracy system I’ve seen. So how does it work? Note: I am not an expert in this; this is my view after a few weeks of looking into it, so I may be wrong.
First, every application needs to specify what features it uses, and based on that, it can be flagged into one of three categories:
- Unprotected
- Protected
- Testing
Testing has no security and is just for testing. However, for the other two categories, applications must be signed with an SSL certificate. For unprotected applications, you can self-sign them—in other words, using the certificate on the phone to sign the app. For protected apps, you’ll need a certificate from a certificate-signing website—there are only a few of these, and these sites also require you to sign up as a publisher, which costs $200. So once you pay $200 and go through the process, you can sign an application—but it is locked to the IMEI of the phone. This means the application can only ever run on that specific phone.
Now, the security model falls apart if you go out and obtain publisher details, since you could take someone else’s application, strip out its existing certificate, and sign it with your own—but that still costs $200 (and you’re logging with a central company what software you’re signing, so they may be able to track it). Why I think this works is because almost every single application out there is far cheaper than $200. In fact, for $200, you could legally buy so many apps that I question who would pay $200 if they weren’t a legitimate publisher.
I think this process is far better than the iPhone’s app store—since you don’t need a company’s permission to sell software. You can build it, host it anywhere, and—voilà—it’s available.
A similar process is available in Windows Vista+ x64 for drivers, which must also be signed in a similar way. I’m wondering if this shouldn’t apply to all applications in Windows as well—but that would require many changes to be implemented.