diff --git a/cellular.cc b/cellular.cc
index 7a1825a..272f863 100644
--- a/cellular.cc
+++ b/cellular.cc
@@ -163,26 +163,27 @@
       allow_roaming_(false),
       scanning_(false),
       scan_interval_(0) {
-  store_.RegisterConstString(flimflam::kCarrierProperty, &carrier_);
-  store_.RegisterConstString(flimflam::kDBusConnectionProperty, &dbus_owner_);
-  store_.RegisterConstString(flimflam::kDBusObjectProperty, &dbus_path_);
-  store_.RegisterBool(flimflam::kCellularAllowRoamingProperty, &allow_roaming_);
-  store_.RegisterConstString(flimflam::kEsnProperty, &esn_);
-  store_.RegisterConstString(flimflam::kFirmwareRevisionProperty,
+  PropertyStore *store = this->store();
+  store->RegisterConstString(flimflam::kCarrierProperty, &carrier_);
+  store->RegisterConstString(flimflam::kDBusConnectionProperty, &dbus_owner_);
+  store->RegisterConstString(flimflam::kDBusObjectProperty, &dbus_path_);
+  store->RegisterBool(flimflam::kCellularAllowRoamingProperty, &allow_roaming_);
+  store->RegisterConstString(flimflam::kEsnProperty, &esn_);
+  store->RegisterConstString(flimflam::kFirmwareRevisionProperty,
                              &firmware_revision_);
-  store_.RegisterConstString(flimflam::kHardwareRevisionProperty,
+  store->RegisterConstString(flimflam::kHardwareRevisionProperty,
                              &hardware_revision_);
-  store_.RegisterConstStringmap(flimflam::kHomeProviderProperty,
+  store->RegisterConstStringmap(flimflam::kHomeProviderProperty,
                                 &home_provider_.ToDict());
-  store_.RegisterConstString(flimflam::kImeiProperty, &imei_);
-  store_.RegisterConstString(flimflam::kImsiProperty, &imsi_);
-  store_.RegisterConstString(flimflam::kManufacturerProperty, &manufacturer_);
-  store_.RegisterConstString(flimflam::kMdnProperty, &mdn_);
-  store_.RegisterConstString(flimflam::kMeidProperty, &meid_);
-  store_.RegisterConstString(flimflam::kMinProperty, &min_);
-  store_.RegisterConstString(flimflam::kModelIDProperty, &model_id_);
-  store_.RegisterConstUint16(flimflam::kPRLVersionProperty, &cdma_.prl_version);
-  store_.RegisterConstString(flimflam::kSelectedNetworkProperty,
+  store->RegisterConstString(flimflam::kImeiProperty, &imei_);
+  store->RegisterConstString(flimflam::kImsiProperty, &imsi_);
+  store->RegisterConstString(flimflam::kManufacturerProperty, &manufacturer_);
+  store->RegisterConstString(flimflam::kMdnProperty, &mdn_);
+  store->RegisterConstString(flimflam::kMeidProperty, &meid_);
+  store->RegisterConstString(flimflam::kMinProperty, &min_);
+  store->RegisterConstString(flimflam::kModelIDProperty, &model_id_);
+  store->RegisterConstUint16(flimflam::kPRLVersionProperty, &cdma_.prl_version);
+  store->RegisterConstString(flimflam::kSelectedNetworkProperty,
                              &selected_network_);
 
   HelpRegisterDerivedStrIntPair(flimflam::kSIMLockStatusProperty,
@@ -192,10 +193,10 @@
                                 &Cellular::EnumerateNetworks,
                                 NULL);
 
-  store_.RegisterConstBool(flimflam::kScanningProperty, &scanning_);
-  store_.RegisterUint16(flimflam::kScanIntervalProperty, &scan_interval_);
+  store->RegisterConstBool(flimflam::kScanningProperty, &scanning_);
+  store->RegisterUint16(flimflam::kScanIntervalProperty, &scan_interval_);
 
-  VLOG(2) << "Cellular device " << link_name_ << " initialized: "
+  VLOG(2) << "Cellular device " << this->link_name() << " initialized: "
           << GetTypeString();
 }
 
@@ -336,11 +337,11 @@
   proxy_.reset();
   simple_proxy_.reset();
   cdma_proxy_.reset();
-  manager_->DeregisterService(service_);
+  manager()->DeregisterService(service_);
   service_ = NULL;  // Breaks a reference cycle.
   SelectService(NULL);
   SetState(kStateDisabled);
-  RTNLHandler::GetInstance()->SetInterfaceFlags(interface_index_, 0, IFF_UP);
+  RTNLHandler::GetInstance()->SetInterfaceFlags(interface_index(), 0, IFF_UP);
   Device::Stop();
 }
 
@@ -467,7 +468,7 @@
 }
 
 void Cellular::HandleNewRegistrationState() {
-  dispatcher_->PostTask(
+  dispatcher()->PostTask(
       task_factory_.NewRunnableMethod(
           &Cellular::HandleNewRegistrationStateTask));
 }
@@ -477,7 +478,7 @@
   const string network_tech = GetNetworkTechnologyString();
   if (network_tech.empty()) {
     if (state_ == kStateLinked) {
-      manager_->DeregisterService(service_);
+      manager()->DeregisterService(service_);
     }
     service_ = NULL;
     if (state_ == kStateLinked ||
@@ -542,7 +543,7 @@
   VLOG(2) << __func__;
   CHECK(!service_.get());
   service_ =
-      new CellularService(control_interface_, dispatcher_, manager_, this);
+      new CellularService(control_interface(), dispatcher(), manager(), this);
   switch (type_) {
     case kTypeGSM:
       service_->set_activation_state(flimflam::kActivationStateActivated);
@@ -597,7 +598,7 @@
   // TODO(petkov): Setup apn and "home_only".
 
   // Defer connect because we may be in a dbus-c++ callback.
-  dispatcher_->PostTask(
+  dispatcher()->PostTask(
       task_factory_.NewRunnableMethod(&Cellular::ConnectTask, properties));
 }
 
@@ -613,22 +614,22 @@
   VLOG(2) << __func__;
   CHECK_EQ(kStateConnected, state_);
   unsigned int flags = 0;
-  if (manager_->device_info()->GetFlags(interface_index_, &flags) &&
+  if (manager()->device_info()->GetFlags(interface_index(), &flags) &&
       (flags & IFF_UP) != 0) {
     LinkEvent(flags, IFF_UP);
     return;
   }
   // TODO(petkov): Provide a timeout for a failed link-up request.
   RTNLHandler::GetInstance()->SetInterfaceFlags(
-      interface_index_, IFF_UP, IFF_UP);
+      interface_index(), IFF_UP, IFF_UP);
 }
 
 void Cellular::LinkEvent(unsigned int flags, unsigned int change) {
   Device::LinkEvent(flags, change);
   if ((flags & IFF_UP) != 0 && state_ == kStateConnected) {
-    LOG(INFO) << link_name_ << " is up.";
+    LOG(INFO) << link_name() << " is up.";
     SetState(kStateLinked);
-    manager_->RegisterService(service_);
+    manager()->RegisterService(service_);
     // TODO(petkov): For GSM, remember the APN.
     if (AcquireDHCPConfig()) {
       SelectService(service_);
@@ -638,7 +639,7 @@
     }
   } else if ((flags & IFF_UP) == 0 && state_ == kStateLinked) {
     SetState(kStateConnected);
-    manager_->DeregisterService(service_);
+    manager()->DeregisterService(service_);
     SelectService(NULL);
     DestroyIPConfig();
   }
@@ -661,7 +662,7 @@
     return;
   }
   // Defer connect because we may be in a dbus-c++ callback.
-  dispatcher_->PostTask(
+  dispatcher()->PostTask(
       task_factory_.NewRunnableMethod(&Cellular::ActivateTask, carrier));
 }
 
@@ -763,7 +764,7 @@
     const string &name,
     Stringmaps(Cellular::*get)(void),
     bool(Cellular::*set)(const Stringmaps&)) {
-  store_.RegisterDerivedStringmaps(
+  store()->RegisterDerivedStringmaps(
       name,
       StringmapsAccessor(
           new CustomAccessor<Cellular, Stringmaps>(this, get, set)));
@@ -773,7 +774,7 @@
     const string &name,
     StrIntPair(Cellular::*get)(void),
     bool(Cellular::*set)(const StrIntPair&)) {
-  store_.RegisterDerivedStrIntPair(
+  store()->RegisterDerivedStrIntPair(
       name,
       StrIntPairAccessor(
           new CustomAccessor<Cellular, StrIntPair>(this, get, set)));
diff --git a/cellular_service.cc b/cellular_service.cc
index a6c1140..bc27c5b 100644
--- a/cellular_service.cc
+++ b/cellular_service.cc
@@ -27,20 +27,21 @@
       strength_(0),
       cellular_(device),
       type_(flimflam::kTypeCellular) {
-  store_.RegisterConstString(flimflam::kActivationStateProperty,
+  PropertyStore *store = this->store();
+  store->RegisterConstString(flimflam::kActivationStateProperty,
                              &activation_state_);
-  store_.RegisterStringmap(flimflam::kCellularApnProperty, &apn_info_);
-  store_.RegisterConstStringmap(flimflam::kCellularLastGoodApnProperty,
+  store->RegisterStringmap(flimflam::kCellularApnProperty, &apn_info_);
+  store->RegisterConstStringmap(flimflam::kCellularLastGoodApnProperty,
                                 &last_good_apn_info_);
-  store_.RegisterConstString(flimflam::kNetworkTechnologyProperty,
+  store->RegisterConstString(flimflam::kNetworkTechnologyProperty,
                              &network_tech_);
-  store_.RegisterConstString(flimflam::kPaymentURLProperty, &payment_url_);
-  store_.RegisterConstString(flimflam::kRoamingStateProperty, &roaming_state_);
-  store_.RegisterConstStringmap(flimflam::kServingOperatorProperty,
+  store->RegisterConstString(flimflam::kPaymentURLProperty, &payment_url_);
+  store->RegisterConstString(flimflam::kRoamingStateProperty, &roaming_state_);
+  store->RegisterConstStringmap(flimflam::kServingOperatorProperty,
                                 &serving_operator_.ToDict());
-  store_.RegisterConstUint8(flimflam::kSignalStrengthProperty, &strength_);
-  store_.RegisterConstString(flimflam::kTypeProperty, &type_);
-  store_.RegisterConstString(flimflam::kUsageURLProperty, &usage_url_);
+  store->RegisterConstUint8(flimflam::kSignalStrengthProperty, &strength_);
+  store->RegisterConstString(flimflam::kTypeProperty, &type_);
+  store->RegisterConstString(flimflam::kUsageURLProperty, &usage_url_);
 }
 
 CellularService::~CellularService() { }
diff --git a/cellular_service.h b/cellular_service.h
index 67b6a92..c1636a8 100644
--- a/cellular_service.h
+++ b/cellular_service.h
@@ -63,6 +63,11 @@
  protected:
   virtual std::string CalculateState() { return "idle"; }
 
+ private:
+  static const char kServiceType[];
+
+  virtual std::string GetDeviceRpcId();
+
   // Properties
   std::string activation_state_;
   Cellular::Operator serving_operator_;
@@ -75,11 +80,6 @@
   std::map<std::string, std::string> apn_info_;
   std::map<std::string, std::string> last_good_apn_info_;
 
- private:
-  static const char kServiceType[];
-
-  virtual std::string GetDeviceRpcId();
-
   CellularRefPtr cellular_;
   const std::string type_;
 
diff --git a/default_profile.cc b/default_profile.cc
index 3a3269d..025c258 100644
--- a/default_profile.cc
+++ b/default_profile.cc
@@ -22,13 +22,14 @@
                                const Manager::Properties &manager_props)
     : Profile(control, glib, manager, Identifier(kDefaultId), "", true),
       storage_path_(storage_path) {
-  store_.RegisterConstString(flimflam::kCheckPortalListProperty,
+  PropertyStore *store = this->store();
+  store->RegisterConstString(flimflam::kCheckPortalListProperty,
                              &manager_props.check_portal_list);
-  store_.RegisterConstString(flimflam::kCountryProperty,
+  store->RegisterConstString(flimflam::kCountryProperty,
                              &manager_props.country);
-  store_.RegisterConstBool(flimflam::kOfflineModeProperty,
+  store->RegisterConstBool(flimflam::kOfflineModeProperty,
                            &manager_props.offline_mode);
-  store_.RegisterConstString(flimflam::kPortalURLProperty,
+  store->RegisterConstString(flimflam::kPortalURLProperty,
                              &manager_props.portal_url);
 }
 
diff --git a/device.h b/device.h
index cd3aeeb..3a7d6f6 100644
--- a/device.h
+++ b/device.h
@@ -121,23 +121,11 @@
                                   Strings(Device::*get)(void),
                                   bool(Device::*set)(const Strings&));
 
-  // Properties
-  bool powered_;  // TODO(pstew): Is this what |running_| is for?
-  bool reconnect_;
-  const std::string hardware_address_;
-
-  PropertyStore store_;
-
-  std::vector<ServiceRefPtr> services_;
-  const int interface_index_;
-  bool running_;
-  const std::string link_name_;
-  const std::string unique_id_;
-  ControlInterface *control_interface_;
-  EventDispatcher *dispatcher_;
-  Manager *manager_;
-  IPConfigRefPtr ipconfig_;
-  ConnectionRefPtr connection_;
+  // Property getters reserved for subclasses
+  ControlInterface *control_interface() const { return control_interface_; }
+  EventDispatcher *dispatcher() const { return dispatcher_; }
+  Manager *manager() const { return manager_; }
+  std::vector<ServiceRefPtr> *services() { return &services_; }
 
  private:
   friend class DeviceAdaptorInterface;
@@ -157,6 +145,23 @@
   std::vector<std::string> AvailableIPConfigs();
   std::string GetRpcConnectionIdentifier();
 
+  // Properties
+  bool powered_;  // TODO(pstew): Is this what |running_| is for?
+  bool reconnect_;
+  const std::string hardware_address_;
+
+  PropertyStore store_;
+
+  std::vector<ServiceRefPtr> services_;
+  const int interface_index_;
+  bool running_;
+  const std::string link_name_;
+  const std::string unique_id_;
+  ControlInterface *control_interface_;
+  EventDispatcher *dispatcher_;
+  Manager *manager_;
+  IPConfigRefPtr ipconfig_;
+  ConnectionRefPtr connection_;
   scoped_ptr<DeviceAdaptorInterface> adaptor_;
 
   // Maintain a reference to the connected / connecting service
diff --git a/dhcp_config.cc b/dhcp_config.cc
index e9661e0..581528b 100644
--- a/dhcp_config.cc
+++ b/dhcp_config.cc
@@ -57,8 +57,8 @@
       task_factory_(this),
       dispatcher_(dispatcher),
       glib_(glib) {
-  store_.RegisterConstString(flimflam::kAddressProperty,
-                             &(properties().address));
+  store()->RegisterConstString(flimflam::kAddressProperty,
+                               &(properties().address));
   VLOG(2) << __func__ << ": " << device_name;
 }
 
diff --git a/ephemeral_profile.cc b/ephemeral_profile.cc
index 1d452d8..0469daf 100644
--- a/ephemeral_profile.cc
+++ b/ephemeral_profile.cc
@@ -27,7 +27,7 @@
 EphemeralProfile::~EphemeralProfile() {}
 
 void EphemeralProfile::Finalize() {
-  services_.clear();
+  services()->clear();
 }
 
 }  // namespace shill
diff --git a/ethernet.cc b/ethernet.cc
index f1149f7..86cbd56 100644
--- a/ethernet.cc
+++ b/ethernet.cc
@@ -53,15 +53,15 @@
 
 void Ethernet::Start() {
   Device::Start();
-  RTNLHandler::GetInstance()->SetInterfaceFlags(interface_index_, IFF_UP,
+  RTNLHandler::GetInstance()->SetInterfaceFlags(interface_index(), IFF_UP,
                                                 IFF_UP);
 }
 
 void Ethernet::Stop() {
-  manager_->DeregisterService(service_);
+  manager()->DeregisterService(service_);
   DestroyIPConfig();
   Device::Stop();
-  RTNLHandler::GetInstance()->SetInterfaceFlags(interface_index_, 0, IFF_UP);
+  RTNLHandler::GetInstance()->SetInterfaceFlags(interface_index(), 0, IFF_UP);
 }
 
 bool Ethernet::TechnologyIs(const Device::Technology type) const {
@@ -71,9 +71,9 @@
 void Ethernet::LinkEvent(unsigned int flags, unsigned int change) {
   Device::LinkEvent(flags, change);
   if ((flags & IFF_LOWER_UP) != 0 && !link_up_) {
-    LOG(INFO) << link_name_ << " is up; should start L3!";
+    LOG(INFO) << link_name() << " is up; should start L3!";
     link_up_ = true;
-    manager_->RegisterService(service_);
+    manager()->RegisterService(service_);
     if (service_->auto_connect()) {
       if (AcquireDHCPConfig()) {
         SelectService(service_);
@@ -84,7 +84,7 @@
     }
   } else if ((flags & IFF_LOWER_UP) == 0 && link_up_) {
     link_up_ = false;
-    manager_->DeregisterService(service_);
+    manager()->DeregisterService(service_);
     SelectService(NULL);
     DestroyIPConfig();
   }
diff --git a/ethernet_service.cc b/ethernet_service.cc
index 9479535..8db66cb 100644
--- a/ethernet_service.cc
+++ b/ethernet_service.cc
@@ -39,7 +39,7 @@
       type_(flimflam::kTypeEthernet) {
   set_auto_connect(true);
 
-  store_.RegisterConstString(flimflam::kTypeProperty, &type_);
+  store()->RegisterConstString(flimflam::kTypeProperty, &type_);
 }
 
 EthernetService::~EthernetService() { }
diff --git a/ipconfig.h b/ipconfig.h
index db0bc17..08a7c19 100644
--- a/ipconfig.h
+++ b/ipconfig.h
@@ -92,8 +92,6 @@
   // to its associated device.
   std::string GetStorageIdentifier(const std::string &id_suffix);
 
-  PropertyStore store_;
-
  private:
   friend class IPConfigAdaptorInterface;
   friend class ConnectionTest;
@@ -110,6 +108,7 @@
   static const char kType[];
   static uint global_serial_;
 
+  PropertyStore store_;
   const std::string device_name_;
   const std::string type_;
   const uint serial_;
diff --git a/profile.h b/profile.h
index 520664c..34417fc 100644
--- a/profile.h
+++ b/profile.h
@@ -95,13 +95,9 @@
   virtual bool GetStoragePath(FilePath *path);
 
  protected:
-  Manager *manager_;
-
-  // Properties to be get/set via PropertyStore calls that must also be visible
-  // in subclasses.
-  PropertyStore store_;
-
-  std::map<std::string, ServiceRefPtr> services_;
+  // Protected getters
+  Manager *manager() const { return manager_; }
+  std::map<std::string, ServiceRefPtr> *services() { return &services_; }
 
  private:
   friend class ProfileAdaptorInterface;
@@ -120,6 +116,13 @@
                                   Strings(Profile::*get)(void),
                                   bool(Profile::*set)(const Strings&));
 
+  // Data members shared with subclasses via getter/setters above in the
+  // protected: section
+  Manager *manager_;
+  std::map<std::string, ServiceRefPtr> services_;
+
+  // Shared with subclasses via public getter
+  PropertyStore store_;
 
   // Properties to be gotten via PropertyStore calls.
   Identifier name_;
diff --git a/service.cc b/service.cc
index 075bc13..2740065 100644
--- a/service.cc
+++ b/service.cc
@@ -35,6 +35,8 @@
 const char Service::kCheckPortalFalse[] = "false";
 const char Service::kCheckPortalTrue[] = "true";
 
+const int Service::kPriorityNone = 0;
+
 const char Service::kStorageAutoConnect[] = "AutoConnect";
 const char Service::kStorageCheckPortal[] = "CheckPortal";
 const char Service::kStorageEapAnonymousIdentity[] = "EAP.AnonymousIdentity";
@@ -352,4 +354,12 @@
              true);
 }
 
+const string &Service::GetEAPKeyManagement() const {
+  return eap_.key_management;
+}
+
+void Service::SetEAPKeyManagement(const string &key_management) {
+  eap_.key_management = key_management;
+}
+
 }  // namespace shill
diff --git a/service.h b/service.h
index b4e60a6..8ad5132 100644
--- a/service.h
+++ b/service.h
@@ -81,6 +81,8 @@
     std::string key_management;
   };
 
+  static const int kPriorityNone;
+
   // A constructor for the Service object
   Service(ControlInterface *control_interface,
           EventDispatcher *dispatcher,
@@ -134,8 +136,6 @@
   PropertyStore *store() { return &store_; }
 
  protected:
-  static const int kPriorityNone = 0;
-
   // Returns true if a character is allowed to be in a service storage id.
   static bool LegalChar(char a) { return isalnum(a) || a == '_'; }
 
@@ -161,23 +161,10 @@
   void LoadEapCredentials(StoreInterface *storage, const std::string &id);
   void SaveEapCredentials(StoreInterface *storage, const std::string &id);
 
-  // Properties
-  ConnectState state_;
-  ConnectFailure failure_;
-  bool auto_connect_;
-  std::string check_portal_;
-  bool connectable_;
-  std::string error_;
-  bool favorite_;
-  int32 priority_;
-  std::string proxy_config_;
-  bool save_credentials_;
-  EapCredentials eap_;  // Only saved if |save_credentials_| is true.
-
-  ProfileRefPtr profile_;
-  PropertyStore store_;
-
-  EventDispatcher *dispatcher_;
+  // Property accessors reserved for subclasses
+  EventDispatcher *dispatcher() const { return dispatcher_; }
+  const std::string &GetEAPKeyManagement() const;
+  void SetEAPKeyManagement(const std::string &key_management);
 
  private:
   friend class ServiceAdaptorInterface;
@@ -218,6 +205,22 @@
     return "";  // Will need to call Profile to get this.
   }
 
+  ConnectState state_;
+  ConnectFailure failure_;
+  bool auto_connect_;
+  std::string check_portal_;
+  bool connectable_;
+  std::string error_;
+  bool favorite_;
+  int32 priority_;
+  std::string proxy_config_;
+  bool save_credentials_;
+  EapCredentials eap_;  // Only saved if |save_credentials_| is true.
+
+  ProfileRefPtr profile_;
+  PropertyStore store_;
+
+  EventDispatcher *dispatcher_;
   static unsigned int serial_number_;
   const std::string name_;
   bool available_;
diff --git a/wifi.cc b/wifi.cc
index 8b444bb..528c5da 100644
--- a/wifi.cc
+++ b/wifi.cc
@@ -57,19 +57,20 @@
       bgscan_signal_threshold_(0),
       scan_pending_(false),
       scan_interval_(0) {
-  store_.RegisterString(flimflam::kBgscanMethodProperty, &bgscan_method_);
-  store_.RegisterUint16(flimflam::kBgscanShortIntervalProperty,
+  PropertyStore *store = this->store();
+  store->RegisterString(flimflam::kBgscanMethodProperty, &bgscan_method_);
+  store->RegisterUint16(flimflam::kBgscanShortIntervalProperty,
                  &bgscan_short_interval_);
-  store_.RegisterInt32(flimflam::kBgscanSignalThresholdProperty,
+  store->RegisterInt32(flimflam::kBgscanSignalThresholdProperty,
                 &bgscan_signal_threshold_);
 
   // TODO(quiche): Decide if scan_pending_ is close enough to
   // "currently scanning" that we don't care, or if we want to track
   // scan pending/currently scanning/no scan scheduled as a tri-state
   // kind of thing.
-  store_.RegisterConstBool(flimflam::kScanningProperty, &scan_pending_);
-  store_.RegisterUint16(flimflam::kScanIntervalProperty, &scan_interval_);
-  VLOG(2) << "WiFi device " << link_name_ << " initialized.";
+  store->RegisterConstBool(flimflam::kScanningProperty, &scan_pending_);
+  store->RegisterUint16(flimflam::kScanIntervalProperty, &scan_interval_);
+  VLOG(2) << "WiFi device " << link_name() << " initialized.";
 }
 
 WiFi::~WiFi() {}
@@ -83,7 +84,7 @@
   try {
     std::map<string, DBus::Variant> create_interface_args;
     create_interface_args["Ifname"].writer().
-        append_string(link_name_.c_str());
+        append_string(link_name().c_str());
     create_interface_args["Driver"].writer().
         append_string(kSupplicantWiFiDriver);
     // TODO(quiche) create_interface_args["ConfigFile"].writer().append_string
@@ -93,7 +94,7 @@
   } catch (const DBus::Error e) {  // NOLINT
     if (!strcmp(e.name(), kSupplicantErrorInterfaceExists)) {
       interface_path =
-          supplicant_process_proxy_->GetInterface(link_name_);
+          supplicant_process_proxy_->GetInterface(link_name());
       // XXX crash here, if device missing?
     } else {
       // XXX
@@ -160,7 +161,7 @@
   // may require the the registration of new D-Bus objects. and such
   // registration can't be done in the context of a D-Bus signal
   // handler.
-  dispatcher_->PostTask(
+  dispatcher()->PostTask(
       task_factory_.NewRunnableMethod(&WiFi::ScanDoneTask));
 }
 
@@ -209,14 +210,14 @@
       // XXX key mode should reflect endpoint params (not always use
       // kSupplicantKeyModeNone)
       WiFiServiceRefPtr service(
-          new WiFiService(control_interface_,
-                          dispatcher_,
-                          manager_,
+          new WiFiService(control_interface(),
+                          dispatcher(),
+                          manager(),
                           this,
                           endpoint.ssid(),
                           endpoint.network_mode(),
                           kSupplicantKeyModeNone));
-      services_.push_back(service);
+      services()->push_back(service);
       service_by_private_id_[service_id_private] = service;
 
       LOG(INFO) << "new service " << service->GetRpcIdentifier();
diff --git a/wifi_service.cc b/wifi_service.cc
index 14105ac..bdfa6e7 100644
--- a/wifi_service.cc
+++ b/wifi_service.cc
@@ -37,20 +37,21 @@
       task_factory_(this),
       wifi_(device),
       ssid_(ssid) {
-  eap_.key_management = key_management;
+  SetEAPKeyManagement(key_management);
 
-  store_.RegisterConstString(flimflam::kModeProperty, &mode_);
-  store_.RegisterString(flimflam::kPassphraseProperty, &passphrase_);
-  store_.RegisterBool(flimflam::kPassphraseRequiredProperty, &need_passphrase_);
-  store_.RegisterConstString(flimflam::kSecurityProperty, &security_);
-  store_.RegisterConstUint8(flimflam::kSignalStrengthProperty, &strength_);
-  store_.RegisterConstString(flimflam::kTypeProperty, &type_);
+  PropertyStore *store = this->store();
+  store->RegisterConstString(flimflam::kModeProperty, &mode_);
+  store->RegisterString(flimflam::kPassphraseProperty, &passphrase_);
+  store->RegisterBool(flimflam::kPassphraseRequiredProperty, &need_passphrase_);
+  store->RegisterConstString(flimflam::kSecurityProperty, &security_);
+  store->RegisterConstUint8(flimflam::kSignalStrengthProperty, &strength_);
+  store->RegisterConstString(flimflam::kTypeProperty, &type_);
 
-  store_.RegisterConstString(flimflam::kWifiAuthMode, &auth_mode_);
-  store_.RegisterConstBool(flimflam::kWifiHiddenSsid, &hidden_ssid_);
-  store_.RegisterConstUint16(flimflam::kWifiFrequency, &frequency_);
-  store_.RegisterConstUint16(flimflam::kWifiPhyMode, &physical_mode_);
-  store_.RegisterConstUint16(flimflam::kWifiHexSsid, &hex_ssid_);
+  store->RegisterConstString(flimflam::kWifiAuthMode, &auth_mode_);
+  store->RegisterConstBool(flimflam::kWifiHiddenSsid, &hidden_ssid_);
+  store->RegisterConstUint16(flimflam::kWifiFrequency, &frequency_);
+  store->RegisterConstUint16(flimflam::kWifiPhyMode, &physical_mode_);
+  store->RegisterConstUint16(flimflam::kWifiHexSsid, &hex_ssid_);
 }
 
 WiFiService::~WiFiService() {
@@ -62,7 +63,7 @@
 
   // NB(quiche) defer handling, since dbus-c++ does not permit us to
   // send an outbound request while processing an inbound one.
-  dispatcher_->PostTask(
+  dispatcher()->PostTask(
       task_factory_.NewRunnableMethod(&WiFiService::ConnectTask));
 }
 
@@ -86,7 +87,7 @@
 }
 
 const string &WiFiService::key_management() const {
-  return eap_.key_management;
+  return GetEAPKeyManagement();
 }
 
 const std::vector<uint8_t> &WiFiService::ssid() const {