Web Server Authentication in Windows Mobile 6.5

Windows Mobile 6.5 relied on the Windows CE networking stack, specifically the WinINet (Windows Internet) API and the Security Support Provider Interface (SSPI), to handle communication with secure web servers. Through Internet Explorer Mobile and underlying system services like Exchange ActiveSync, the operating system supported a range of standard HTTP authentication schemes, including Basic, Digest, NTLM, and Client Certificate authentication, while handling Negotiate (Kerberos) scenarios through specific fallback behaviors.

Basic Authentication

Windows Mobile 6.5 fully supported standard HTTP Basic Authentication (RFC 2617). When challenged by a web server with a 401 Unauthorized status and a WWW-Authenticate: Basic header, the operating system prompted the user for credentials or retrieved cached credentials. Because Basic Authentication transmits usernames and passwords as Base64-encoded plaintext, it was standard practice to use this protocol exclusively over SSL/TLS (HTTPS) connections.

Digest Authentication

Digest Authentication (RFC 2617) was supported natively by the WinINet stack in Windows Mobile 6.5. This challenge-response mechanism improved upon Basic Authentication by hashing user credentials using MD5 before transmission, ensuring that plain text passwords were never sent across the network.

NTLM Authentication (NTLMv1 and NTLMv2)

NTLM was the primary mechanism used by Windows Mobile 6.5 for Integrated Windows Authentication (IWA). When accessing Microsoft IIS servers, SharePoint sites, or internal intranets:

  • The device utilized the NTLM Security Support Provider (SSP) via SSPI.
  • Both NTLMv1 and NTLMv2 protocols were supported, allowing the operating system to comply with modern Windows Server security policies requiring NTLMv2 response levels.
  • Credential caching allowed domain credentials entered during the initial setup or initial network prompt to be reused automatically for subsequent HTTP requests.

Kerberos and Negotiate (SPNEGO)

Windows Mobile 6.5 supported the WWW-Authenticate: Negotiate header used in Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO). However, native Kerberos support over HTTP had significant limitations:

  • Native Windows domain joining was not a standard feature of Windows Mobile devices, meaning devices typically lacked a Kerberos Ticket Granting Ticket (TGT).
  • When a web server requested Negotiate, Windows Mobile 6.5's Negotiate SSP would attempt to establish security contexts, but in the absence of a Kerberos infrastructure on the handheld, it would systematically downgrade the authentication process to NTLM.
  • Direct Kerberos ticket handling for web traffic was generally not executed natively unless specialized third-party client software or enterprise infrastructure was deployed.

Client Certificate Authentication (Mutual TLS)

In addition to challenge-response mechanisms, Windows Mobile 6.5 supported client-side digital certificates (X.509) for mutual authentication over HTTPS. Users or IT administrators could install personal certificates into the device’s local certificate store. When a web server requested a client certificate during the TLS handshake, the operating system presented the installed certificate to authenticate the user without requiring interactive password prompts.