Develop Bugs

How to setup E-Mail Encryption (S/MIME)

Although PGP may be nice, the unfortunate fact is that it doesn't just "hook in" nicely to WM6 right now.
The track favored by the industrial giants is S/MIME, which is what Outlook and Netscape use. OpenSSL also includes the basic plumbing to do S/MIME stuff.
Let’s try to compile a simple step-by-step description with this thread, so as soon as it is complete we can create a wiki entry.
Step1: Setup Outlook utilize s/mine
Step1.1: Making a new X509 certificate
First, get and install the latest version of OpenSSL (if your OS doesn't already come with it). For M$ Windows you will find a installer here.
Next, you'll need to make a key pair so go to the bin folder and type:
% openssl genrsa -des3 -out keyfile 1024
This will make a key pair file. The private key will be encrypted with Triple DES. This means that anytime you do anything with the private key (like sign a message), you'll have to provide a passphrase (which you set at generation time). If you don't want to do this, then leave -des3 out, but just know that anyone who gets a copy of your key file can sign messages from you and read your encrypted mail.
To allow that everyone who received a signed email from you can verify the signature, you should create now a Certificate Signing Request, to get it signed by some root certificate, but this is optional, you can also create your own Certification Authority. But as long as the recipient has not imported your CA root certificate, one will be cluttered by warnings and error messages every time a signed and or encrypted email is displayed.
So I propose to get it signed by any common public CA. I choose
Thawte as an example as they offer the service for free. But you can choose any other you like.
So go sign up with Thawte's Freemail program and request a new certificate. At this point, go to the bottom of the form where it says "Developers of New Security Applications ONLY". Check the box that says "Paste in CSR Certificate Enrollment". Then click the button right below.
On the next screen there's probably nothing to do but hit "next>" when it asks about your name.
On the next screen there's probably nothing you should do but choose all of your e-mail addresses and hit "next>". Thawte advises that not all mail clients can handle having multiple e-mail addresses attached to a certificate, which means that if you send e-mail to someone using one of these clients, they may get a warning that the certificate doesn't match the message's From: line.
Same thing on the next screen.
On the next screen, accept the default extensions.
On the next screen, you'll see instructions telling you to make your certificate request, with a 16 character garbage string as the Common Name. At this point, you should go back to the shell window and do:
% openssl req -new -key keyfile
Answer all the questions that openssl asks, but be sure and paste in the 16 character garbage string Thawte gave you for the Common Name. Copy and paste the certificate request into the box on the Thawte form and hit "Next>".
Make sure everything looks ok on the last screen and hit "Finish".
A short time later, you should get an e-mail telling you your new certificate is done.
Go to the page (link) in the e-mail save it to a file in the openssl/bin folder.
The saved SPC file is a simply DER encoded PKCS#7 file containing the certificates.
Next, type:
openssl pkcs7 -print_certs -inform DER -out certs.pem -in file (where file is the name of the file with the PKCS7 stuff)
You should get out a bunch of certificates. You'll need to look at the text above each one to find the one that is your certificate. The rest are part of Thawte's Certifying Authority. It turns out that if you want your messages to verify correctly, you must also include Thawte's intermediate CA key.
There should be 3 certificates. The file certs.pem will then contain all the certificates in PEM form, you can manually cut and paste them. The one whose identity is your e-mail address is your certificate. The one whose subject and issue are identical is the Thawte CA root. You won't need that one, since we'll include it in the trusted root file later if it is not already there. The 3rd one will have the CA root as the issuer and something else as the subject (which will be the same as the issuer of your certificate). You need to save that certificate as an additional certificate for signing. We'll refer to the file containing this cert as othercert.
When you're done with all of that the pieces you need to keep are the key file you generated at the beginning (remembering the passphrase, if you set one), the intermediate cert between the Thawte CA root and your cert, and the certificate chunk for your e-mail address you got out of the last step. You're now ready to use S/MIME!
Step1.2: Importing in OUTLOOK
Outlook uses the pkcs12 format. OpenSSL can import and export certificates and private keys so that you can use the same cert and key pair on all your mail clients. To move a keypair and cert from OpenSSL to Outlook, you need to export it:
% openssl pkcs12 -export -inkey keyfile -certfile othercertfile -in certfile -out mycert.p12
This will ask you for a passphrase. This phrase locks the .p12 file. Outlook will ask this passphrase later.
Now open Outlook and go to Extras and open something called like Thrust center (I just have a German version so I can just guess).
Go to Email Security and click on Import, select your p12 file, enter your passphrase and click on OK.
In the next window you have the option the change the security level, medium means it will ask just for your permission, high it will additional ask for a passphrase, which will be defined if selected (not the same as used for protecting the keys).
On the same page section secure email (or something like that) you can change the settings concerning ciphering and signing algorithm.
You should choose for signing not MD5 as it is considered as broken, better is SHA1 even if this one is something like semi-broken.
Further you should prefer strong algorithm for instance 3DES instead of DES.
Select S/mime as format and give the settings a name before saving.
Now you are ready to use s/mime for signing and encrypting!
Step2: WM 6
Next step would be to import it in pocket outlook by just copy it to the Hermes and click on it.

I ll be honest, I didn't read your entire post
Just wanted to point out that in order to send an encrypted email to someone, you need to have his public key. Those keys are usually stored in a corporate directory, which need to be accessed in order to send the mail.

Thanks for your comment!
fun_key said:
I ll be honest, I didn't read your entire post
Just wanted to point out that in order to send an encrypted email to someone, you need to have his public key. Those keys are usually stored in a corporate directory, which need to be accessed in order to send the mail.
Click to expand...
Click to collapse
This is quit clear but for simply signing my own mail, just my privat key is required. As long as this is not working, encryption will also not work.
So the main problem is that Outlook is matching the certificate to email account, so most likely something with the certificate contained information
seems to be wrong...

Just for the records - as it seems I just soliloquise:
So I managed to get it working with Outlook!
I also successfully imported the same p12 certificate on my hermes.
For Pop3/SMTP accounts in WM6:
Receiving encrypted mails is working, the automatic s/mime decryption works fine.
But sending: under message options of a new email, encryption and signing is disabled !?!
Same for my synced outlook folder.
Could that be an issue with WMXL v0.21 ??
Maybe I should take BLACK 2.0 for a spin - it seems to be newer...
Or is s/mime encryption/signing only supported for exchange accounts?

... an other thing (outlook releated)
- please check the level of thrust for your own as well for imported certs
if the trustlevel is not set correctly outlook will refuse it (error: something
like certificate is invalid) - normaly that means a CA is missing the sequence
of signing CAs from the ROOT CA to the personal certificate
- If you receive a signed email: if you click left on the senders name and
select add to contects the cert is added to the new contact as well, as
soon as you save it, and the contact already exists select update.
Maybe this is the reason why using s/mime on WM6 is not supported as the contact database is not storing any certs ?!?
So its only working together with Exchange?

http://www.jacco2.dds.nl/networking/windowsmobile-smime.html

Hi,
I use WM 6.1 on my Hermes (CRCs stable version) and want to use e-mail encryption.
But it is not possible. Import of the private key was OK, now I tried to send a message to a user with a public key in GAL, but failure is "Error Crtifcates missing".
So I import the private key to my contact, but same failure.
Why does the device not find the public keys?
Karl

karlh said:
Hi,
I use WM 6.1 on my Hermes (CRCs stable version) and want to use e-mail encryption.
But it is not possible. Import of the private key was OK, now I tried to send a message to a user with a public key in GAL, but failure is "Error Crtifcates missing".
So I import the private key to my contact, but same failure.
Why does the device not find the public keys?
Karl
Click to expand...
Click to collapse
You need to import the certificate/public key of the recipient, also check the Key Usage extensions within the certificate, if they dont have the correct ones for e-mail encryption then your stuffed.

MrGAN said:
Just for the records - as it seems I just soliloquise:
So I managed to get it working with Outlook!
I also successfully imported the same p12 certificate on my hermes.
For Pop3/SMTP accounts in WM6:
Receiving encrypted mails is working, the automatic s/mime decryption works fine.
But sending: under message options of a new email, encryption and signing is disabled !?!
Same for my synced outlook folder.
Could that be an issue with WMXL v0.21 ??
Maybe I should take BLACK 2.0 for a spin - it seems to be newer...
Or is s/mime encryption/signing only supported for exchange accounts?
Click to expand...
Click to collapse
Answer find :
Sadly, Microsoft decided to not support S/MIME with SMTP, the Internet industry standard for e-mail. If your company or ISP uses another mail server than Exchange you will not be able to use the features "Encrypt message" and "Sign message" in Windows Mobile's "Messaging" application. The option "Security" is ghosted. This is clearly an example of vendor lock-in. It is an attempt by Microsoft to lock Windows Mobile users into Exchange and their other product offerings. I cannot think of a technical reason why Microsoft could not support SMTP for secure e-mail. Storing certificates on mobile devices takes valuable memory, but most certificates are only 1-2 KB. The least they could have done is use open standards such as LDAP for looking up certificates of recipients. (There is a "Check Names" option in WM6 where you can lookup names in an online server but I don't know if that means LDAP and if certificates are actually checked).
Click to expand...
Click to collapse
Grrr !!

Exchange Problems! 0x800072F17

I really didn't want to post this, honest. I have searched xda. I have searched the web. I have found other threads. I have followed the suggestions. But, it seems that my exgirlfriend may have been right, I'm an idiot.
I can't get my Hermes to connect to my office exchange server. The settings on my end are correct, the issue is on my office's end.
When I sync I get an error and support code 0x80072F17. I know that it's a certificate error.
IT is not going to help me on this one, so I'm on my own. I have tried to manually import the certificate. Didn't work. I tried making a regedit I found on another thread. Didn't work. I tried combinations of various settings. I only time I don't get an error code is when my device begins to endlessly prompt me for my password.
I'm sorry to post, but it's my last option. Does anyone have any work arounds for this error? Is there a way to have my device ignore the certificates? Is there anyone out there that can help??

There must be some way. My colleagues, both of them with HTC Trinity's, original WM5 roms came across this error when the certificate on our Outlook Web Access was about to expire. Me, however, with my HTC TyTN WM6 never got this issue. I'm not sure why. I know I've installed a couple of cert cabs, the one they call sdkcerts.cab and one more. Search for that cab and see if it helps. I always figured it made the device accept non signed software but maybe it helps for these kinds of issues as well.

You just must set correct date and time for you phone and try again.

I'll try and give you a hand...
First off, you need to know a few things to set this up.
(1) The FQDN of you company used to access the OWA (Outlook Web Access), for example, mail.mycompany.com/exchange
(2) The NetBIOS name of your local domain at your office (Right click the My Computer icon on your office pc and select Computer Name and note the Domain. If your IT dept did it the recomended way it'll have a .local extension, for instance, lawoffice.local. You'll use just the domain name without the extension, ie: lawoffice. (without the period, LOL)
(3) I absolutely never use my PC to configure my ActiveSync on my devices, just to initailly copy the certificate to the Storage Card.
Two ways to do the certificate. First is the method I always used until I discovered the second method, which is in my sig.
(BTW, substitute YOUR FQDN for mine, duhh! )
(1) Install the certificate on your PC by going to the FQDN of your OWA in Internet Explorer 7 on your PC, not your PDA (XP is much easier, Vista is quite difficult to do this)
For example, open IE7 and put mail.mycompany.com/exchange in the address bar. You should initially get a "There is a problem with this website's security certificate" error, click on "Continue to this Website" Now, next to the address bar at the top you'll see Certificate Error", click it, View, Install, Next, Next, Finish, Yes. Then you'll see "The import was sucessful" <damn, that took a while!)
Close IE 7 completely and reopen it, put "mail.mydomain.com/exchange" in the address bar and you'll go straight to the OWA page, meaning that your import WAS sucessful, yipee!
(2) Click on Start, Run and type "mmc" and OK. This opens the Microsoft Management Console and you'll see Console1 at the top. File, Add/Remove Snap-In, Add, Certificates, Finish, Close, OK. Now expand Certificates, Trusted Root Certification Authorities, Certificates. Find YOUR certificate in the list. Right click, All Task, Export, Next, DER encoded binary, Next, File name. I use c:\mail.mydomain.com so that I can find it easily. Now finish and you'll get the Export was sucessful message.
(3) Connect to your PDA via ActiveSync as a guest, kill your partnership if it exists, you don't need it), copy the cert to your Storage Card and execute it from there.
Now disconnect youR PDA AND open ActiveSync. Server address is the FQDN of you company without the /exchange, for example, mail.mycompany.com. Leave the check mark on the SSL. Next put your user name, password and the NetBIOS name of your domain. The configure you options for the number of days to sync, etc.
That's it!
Now... once you do that and it works, follow this thread, Auto-provisioning POP3 or Exchange mail via UC Mini how-to.
so you can create a cab to do this automatically!

I had this problem before.
For me, it was due to the fact that I installed CESTAR and it messed up my certs. Unintalling CESTAR won't fix it. You got to reload the rom.
From there, I used Leies' Chinese character support which is free and doesn't mess up the certs.

SOLVED
I have been at this issue for over 2 days now, dealing with the error 0x800072f17. About 5 min ago i fixed it. After narrowing the problem down to a certificate error i then proceeded to look at the certificates. There were two in the certificate store (personal) and both were self signed.
One was XXXX (server name) and the other was XXXX(company name) CA.
The server name one had expired. Seeing as how it is self signed, i had our it admin renew it. He forgot to re-assign it to the outlook web access, so i did it myself in the Internet Information Services console on the server.
This had solved only 1/2 of the problem.
The certificate was assigned to the exchange server, not the OWA web site. After discovering that i could not change the issued to name, or create a new certificate (not an admin) i decided to change the activesync settings to sync the INTERNAL OWA address, which is servername.internaldomain.externaldomain.com (this had not previously worked due to the expired certificate)
Now i have a fully functioning push email system.
Nearly all done without admin permissions.
Whilst im new to this site, feel free to pm me about it.
Solving this is the most satisfying thing i have done this year lol.

But does this allow you to get/check email from outside your location? Or do you have to establish a VPN first?

At my wits end...ActiveSync error 0x80072f0d

I have searched for 2 days all over the net on how to get rid of this error and have tried every way to import my owa certificate but no matter how i do it, the certificate will not install in the root folder which, from everything i have been reading, is why i can't get my sync to work.
Does anyone have any idea how to install the certificate to the ROOT folder and not the INTERMEDIATE folder?
Thank you

Ex2003 SP2 I gather..
Is the cert installed (and working!) on the server? can you access OWA?

Where did you get the .cert from?
Try grabbing the .cert from your OWA page...

yes i can get owa access however i dont know how to check on server as it is my work server. i am getting the cert from my owa page and am installing however it is installing the cert to the intermediate folder and the root folder thus it wont sync.

I had the same problem. I fixed it by turning *off* SSL (even though my office says they require it to be on).

buckaroo said:
I had the same problem. I fixed it by turning *off* SSL (even though my office says they require it to be on).
Click to expand...
Click to collapse
well ya that will work but isnt a very good idea at all for security purposed.

It's not the site cert you need, it's the Certificate Authority cert you need to install on the device, so the device will trust the body that issued the cert to OWA.
If you're the one running the Exchange Server, go to your Certificate Server (ie http://exchange/certsrv ) and click on the "Download a CA certificate, certificate chain, or CRL", then "Download CA Certificate". Install THAT certificate on your device.
Otherwise, direct your IT people to forward you a CA Certificate.
If you built the Exchange Server yourself, you might want to have a looksie here http://www.msexchange.org/tutorials/SSL_Enabling_OWA_2003.html

gregorypleau said:
It's not the site cert you need, it's the Certificate Authority cert you need to install on the device, so the device will trust the body that issued the cert to OWA.
If you're the one running the Exchange Server, go to your Certificate Server (ie http://exchange/certsrv ) and click on the "Download a CA certificate, certificate chain, or CRL", then "Download CA Certificate". Install THAT certificate on your device.
Otherwise, direct your IT people to forward you a CA Certificate.
If you built the Exchange Server yourself, you might want to have a looksie here http://www.msexchange.org/tutorials/SSL_Enabling_OWA_2003.html
Click to expand...
Click to collapse
thank you, this makes more sense now.

buckaroo said:
I had the same problem. I fixed it by turning *off* SSL (even though my office says they require it to be on).
Click to expand...
Click to collapse
Well, so much for your IT department. They shouldn't let the server authenticate w/o the certificate.

[Tips] Transfer files easily from your Windows 7 PC to your Android

Hello, i am new here, and i will begin with this post
What do you need:
Android phone (obviously)
Windows 7 PC (XP are not tested, testers welcome)
X-Plore File Manager
Home WiFi Network
Steps:
1. Download X-Plore file manager at Play Market. (i cannot post links now)
2. Go to Control Panel > Network and Sharing center > Advanced sharing settings > click all to on. (if you are unsure / have an unsecured network just do this everytime you want to transfer!)
3. Connect your phone to your wifi network
4. Open X-Plore
5. Set up the LAN (if hidden click show > show LAN)
6. Add server. (Scan is not working on me.)
7. fill in the blanks. path and domain do not need to be filled. Username is your windows username and password if you use (blank if not used).
8. fill the IP with 192.168.1.2 (you can try with 192.168.1.3 / 1.4 etc.. 1.2 usually works if you connect the PC first.)
9. click test. (if connection failure go back to step 8!)
10. now you can open your Users directory! (if you want to open the C:/ D:/.. open the settings in X-Plore and switch Show Hidden Files to on)
now you can upload and download files from or to your PC!
if there is any questions you can ask here. I will reply as soon as i can.

i do all the steps correct, i find my server, but when i try to enter in the server i get wrong username password, i enter my windows user id and i dont have any password to my account.

good advice, but i find the SGY screen too small for browsing my PC.
I prefer using Samba Filesharing (https://play.google.com/store/apps/details?id=com.funkyfresh.samba) and access my SD Card from my windows PC

wifi file transfr pro
Sent from my GT-S5360 using xda app-developers app

Just use airdroid )
Sent from my GT-S5360 using xda premium

blackjack1942 said:
Just use airdroid )
Sent from my GT-S5360 using xda premium
Click to expand...
Click to collapse
Yep. Airdroid is the best of all Ive tried!

for me this is the best,full Access and exchange data whenever I want and when tethering.:good:give it a try,its awesome.
http://forum.xda-developers.com/showthread.php?t=1752928

LoL I'm always using bluetooth D:

Airdroid is better.
With airdroid you don't need to install nothing in your computer. And it's better because you can install apps, read your messages, call to somebody and it's all in your web browser.

but with the method from my post u have full acces of all files on the device,you can install apps,full acces of system files,send sms,costomize your phone,you can make all what you want and many more and thats all in tethering mode.with airdroid it doesnt go.for me tha best.and its all in your webbrowser too.

Tested and fully working on vista
thanks

Confirmed working on Win 8.1
however my setting is different
in X-plore windows, the fields need to be filled are Server; Username; Password
[Server]
you can find the IP by opening up cmd and type "ipconfig"
look at IPv4 Address, that's what you have to type in server field
[Username]
this field, type your windows ID (the ID you use with windows store)
[Password]
the password of your windows ID
Hope it helps for Win 8.1 user

revomalik said:
Confirmed working on Win 8.1
however my setting is different
in X-plore windows, the fields need to be filled are Server; Username; Password
[Server]
you can find the IP by opening up cmd and type "ipconfig"
look at IPv4 Address, that's what you have to type in server field
[Username]
this field, type your windows ID (the ID you use with windows store)
[Password]
the password of your windows ID
Hope it helps for Win 8.1 user
Click to expand...
Click to collapse
Thank you for the ipconfig info; I couldn't get it to work because I didn't know what the server address was. X-plore should include this information in their wiki page.

I constantly get 0xC00000BB error from X-Plore eventhough i properly configured my Windows 7 to be logged in.
Is there anyone having problems related to X-Plore's LAN feature that is not working properly?

kimiraikkonen85 said:
I constantly get 0xC00000BB error from X-Plore eventhough i properly configured my Windows 7 to be logged in.
Is there anyone having problems related to X-Plore's LAN feature that is not working properly?
Click to expand...
Click to collapse
I was using X-plore on my Xiaomi mi Box 4s without any issues but after reset my router X-plore doesn't find my pc on Lan network....
I didn't find a solution yet....

Will this work for VPN...?

Install openvpn and then place your edited client vpn config files and certificate files on the storage of FireTV similar to the raspberry pi method in the thread below:
h**p xbmchub.com/forums/threads/24769-How-to-set-up-your-VPN-on-raspberry-pi-using-Brain-Hornsby-Openvpn-for-XBMC
Thanks for anyone that may know more than me that could maybe get this to work...

Hmm would be nice if that worked. Did u get a chance to try it?
Sent from my Nexus 5 using XDA Free mobile app

tdfsu said:
h**p xbmchub.com/forums/threads/24769-How-to-set-up-your-VPN-on-raspberry-pi-using-Brain-Hornsby-Openvpn-for-XBMC
Click to expand...
Click to collapse
I'm working on something like this just now. Here's the thing: in my logs for the simplest openvpn app to install (not straight openvpn, it turns out, as there's a windowing issue there that makes it difficult / impossible to navigate through setup, even with a keyboard and Droidmote) once I have a config, I get errors in logcat informing me
"Your image does not support the VPNService API, sorry "
There is a manually installable openvpn binary that I've looked at a bit but not yet configured. It is going to require adding a binary to /system/xbin directly, as the installer (at least on my phone) does not understand where /system/xbin really lives and issues a remount command to a nonexistent partition.
If you're running dd-wrt or similar configurable firewall, another option is to get an account with a provider who is set up to let you do a firewall to firewall connection, and then route either all of your traffic or the traffic from your firetv through that firewall-to-firewall connection.

I have a Private Internet Access vpn account.
Installed openvpn on FireTV--
http play.google.com/store/apps/details?id=de.schaeuffelhut.android.openvpn.installer&hl=en
Installed busybox on FireTV--
http play.google.com/store/apps/details?id=stericson.busybox&hl=en
I created a pass.txt file with my PIA username on the first line and password on the second line, nothing else, then saved the file as a text file (pass.txt).
Download the following to PC--
http privateinternetaccess.com/openvpn/openvpn.zip
Extracted the zip file.
Edited the location specific .ovpn file (see below), changing the 'remote', 'ca', 'crl' and 'auth' lines to the following--
client
dev tun
proto udp
remote us-florida.privateinternetaccess.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /storage/sdcard0/openvpn/ca.crt
tls-client
remote-cert-tls server
auth-user-pass /storage/sdcard0/openvpn/pass.txt
comp-lzo
verb 1
reneg-sec 0
crl-verify /storage/sdcard0/openvpn/crl.pem
Then, save the USFlorida.ovpn file.
Upload ca.crt, crl.pem, pass.txt, and .ovpn file to FireTV to /storage/sdcard0/openvpn/
Open terminal on FireTV. I use jackpal's terminal app below, but you can also use adb.
http play.google.com/store/apps/details?id=jackpal.androidterm
In terminal, type the following--
su
openvpn cd /storage/sdcard0/openvpn/USFlorida.ovpn
But I get several errors. Anyway, that's where I'm at. Maybe someone else more knowledgeable than me can figure it out. Sorry about the links, my low post-count will not allow me to post url's.
Also, you can sideload the following app to verify your external ip address, and it works great with the FireTV remote--
http play.google.com/store/apps/details?id=igit.WhatIsMyIp

The approach you've taken is where I'd be headed next on the client side.
One thing you might want to try is to do the same setup a less locked-down device and confirm that the config files work as expected there.
There's also a good discussion of the hardware approach (setting up a tunnel from your edge to a VPN provider) in the other VPN thread, http://forum.xda-developers.com/showthread.php?t=2797005
also, private internet access will sell a preconfigured router for this purpose!