I mentioned previously that a certificate is a reasonably large and complex thing, certainly too complex to type in each time it is required. The result is that the certificate usually ends up being held on your computer, often without you even being aware that it is there, and the system will take card of presenting and validating certificates as and when required. While this is very convenient, it does have some security implications, in that anyone who gains access to your computer can make use of your certificates. The prerequisite is for the person to gain access to your computer. In many cases this is not that easy to achieve, requiring breaking and entering or something similar.
Mobile devices are different in that they are mobile and are therefore carried around.
This also leads to them being lost, left on trains, and so on. In 1999, Railtrack, the company responsible for the rail network in the UK, announced that for the first time this century the umbrella has been overtaken as the most popular item to leave on a train - by mobile phones. This gives us a feeling for the magnitude of the problem. Clearly, where access to data or services has to be strictly controlled it will not be an acceptable solution to store certificates on the phone if those certificates provide access to data and services. The most immediate way of tackling this problem is to accept that the certificate is going to be stored on the phone, and the phone may be lost.