[aerogear-dev] Security for "Device Registration"

Hi, once the app is installed on the phone (or launched in a browser), we (as discussed in the spec/mailing list) need to upload the "device token" (or channelID) from the actual device/channel to the Unified Push Server. My questions: Is it safe, if every "Mobile Variant" has a Private/Public Key ??? The UP server keeps the private one. Once we register a new mobile variant (e.g. HR for Android, HR for iPad, HR for iPhone, ...) EACH variant has ONE Private/Public key The Public Key of this combo would be "coded" into the actual mobiel application... On EVERY iOS app, it would use the PubKey from the iOS Variant, on EVERY JS-app, it would use the PubKey from the SimplePush Variant, etc So, that means EVERY installation (on the devices) would have that pbulci key... Would that be (extremely) odd, if "1 Mio Russian hacker" would have that public key, used on the device, to perform some sort of "auth" (e.g. via HTTP BASIC (just saying.....)) against the server, in order to upload the "device token" ?? Note: This Private/Public key would/should be EXCLUSIVE for "device registration". And really ONLY.. :-) So that this "Private/Public key" pair can NOT be used (==invalid) for sending messages to the installations, or creating the Push-Applications / Mobile Variant Constructs. Greetings, Matthias -- Matthias Wessendorf blog: http://matthiaswessendorf.wordpress.com/ sessions: http://www.slideshare.net/mwessendorf twitter: http://twitter.com/mwessendorf