Mac|Life iPhone Software 2.2 RSS Feed

Secure Your iPhone

Jason Whong — Fri, 12 Dec 2008 09:51:50 -0600

How to keep your personal info and communications private.

Once the iPhone connects online through Wi-Fi or the mobile network, it has all of the same vulnerabilities as any networked device; unencrypted data could be intercepted by casual hackers or proactive identity thieves. At press time, the iPhone hadn’t received any large-scale attacks or viruses, but you should still protect your data as a precaution.

Many iPhone features and Internet services offer ways to encrypt your data, but you have to turn them on (or make sure they’re already on) to stay safe. We’ll explain how to protect email, passwords, and other sensitive details no matter where you connect.

Use Email Securely

Internet email began as a trusted service, with both sides of a conversation expecting the recipient to be who he or she claimed to be. Encryption came as an add-on, and while common now, certain mail hosts offer different ways of enabling the feature.

When your iPhone (or any other device) checks your email, it can encrypt your login information as well as messages sent and received to prevent any snoopers from reading your email or intercepting your password. Use encryption, which the iPhone calls SSL (secure sockets layer), as long as your email provider supports it. The iPhone switches this on by default.

Some providers call SSL by its current, formal name, TLS, which stands for “transport layer security.” Check with your email provider to be sure it uses this protection, whatever name it goes by.

Of the preset account types recognized by the iPhone—Microsoft Exchange, apple’s MobileMe, Gmail, Yahoo Mail, and AOL— almost all offer SSL support to varying degrees. Exchange servers require complete SSL; MobileMe supports SSL for receiving and requires it for sending; Gmail requires it for both; and AOL requires it for sending but makes it optional for receiving. SSL doesn’t yet work with Yahoo Mail on the iPhone. The only reason not to use SSL would be because your email provider doesn’t support it; otherwise, verify that it’s on. From the home screen, tap Settings > Mail Contacts, Calendars, then tap the name of the account you want to check. To make sure you are receiving email securely, scroll down and tap Advanced. Under Incoming Settings, make sure that Use SSL is switched on.

To make sure you’re sending email securely, tap the account name to return to the previous screen, then scroll down to the Outgoing Mail Server, and tap on the server name (in case there are more than one). Make sure that Use SSL is switched on.

You can’t miss that SSL slider. Leave it on unless your mail provider doesn’t support it.

Yahoo Mail uses a proprietary login method called XYMPKI. In July 2007, security researcher Dave Cridland discovered that part of that method involved sending login name and password without encrypting them, which could enable a hacker to access your email by “sniffing” (recording) the login sequence, then replaying it later. Until SSL is enabled on the iPhone, avoid checking  Yahoo Mail on an open (that is, unencrypted) network until Apple and Yahoo announce an update.

Use Webmail to Retrieve Messages Securely

Look for the lock on the icon to verify security.

Occasionally, you might find that a Wi-Fi access point firewall won’t allow you to contact your mail server. Try using your email provider’s webmail interface in Safari, but keep the transmission secure with SSL. Two indicators that SSL is working in Safari are that the website’s URL begins with “https://” instead of “http://” and a lock icon appears to the right of the URL.

Not every webmail provider offers secure webmail. Of the main iPhone options—MobileMe, Gmail, Yahoo, and AOL—only Gmail offers a secure web connection at https://mail.google.com/mail/. (However, if you use Exchange or a different ISP, contact your administrator to see whether a secure webmail solution exists for you.)

Some websites, such as www.mail2web.com allow you to check another provider’s email with an SSL-encrypted connection. This can be secure as long as the website offering the service is also secure itself. Mail2web connects to all of the services we tried besides Yahoo, which doesn’t allow you to check your email with other programs unless you pay for to its Yahoo Mail Plus service ($19.99 a year, mailplus.mail.yahoo.com).

Encrypt Email

If you’re close enough to friends that you have a secret language, they can retrieve an encrypted mail by answering a question only they know.

Security experts like to say that sending email is like using a postcard. Anyone can read it in transit. However, using encryption on an email message is like putting a letter into an envelope. It’s not totally unbreakable (otherwise, how would your recipient read it?), but very strong encryption provides good enough security for people who prefer their communications to be private. With well-encrypted email, even if someone intercepts a message, it could take years to decrypt the contents, if they’re successful at all. OpenPGP is the de facto standard for encrypted email, although most people call it PGP (Pretty Good Privacy for short).

Right now there’s no way to encrypt your email using PGP on the iPhone through the Mail program. Instead, consider using Hushmail, which supports PGP encryption. It’s a webmail service, so you can access it from Safari.

With PGP, a public key is used only to encrypt mail; it has no function for unlocking messages. Only the recipient’s private key can open the data. That way, anyone can protect a message sent to you, but only you can read it. Ordinarily, to send email to a PGP user, you tell your mail program about this person’s public key. Hushmail works a little differently, by keeping the encryption transparent to users.

Hushmail users can send encrypted messages to other Hushmail users or to people who have uploaded their public keys to Hushmail. A slightly less secure option hides encrypted messages on the Hushmail server and emails the recipient with instructions on how to retrieve the message by answering a security question correctly. After five incorrect guesses, access is denied.

There are some catches to using Hushmail on the iPhone’s version of Safari. Before starting, be sure to close all other open Safari pages. When composing a message, once you tap the Send button, you’re not done; tap the pages icon in the lower-right and switch to the main Hushmail page. If you don’t, the message won’t send.

Hushmail is free, but it also offers subscription services, enabling 250MB of storage, access to customer support, and assurance that your account won’t be deleted due to inactivity. Hushmail is also working on a mobile Web client, but nothing yet for the App Store.

Be Less Promiscuous On Wi-Fi

Use an uncommon network name to keep your iPhone from accidentally connecting to other routers.

When you connect to Wi-Fi, if no password is required to join the network, anyone can sniff your packets. This means that an eavesdropper within physical range of your network can listen in on anything that’s sent or received. If your iPhone is set to check email automatically, you might reveal sensitive data by joining such an open network, especially if you don’t use SSL. (If you do use SSL, intercepted communications will be garbled by that encryption.)

Under Settings > Wi-Fi, there’s an option called Ask to Join Networks. However, this option only does what it says the first time you connect; whether you have this option on or off, the iPhone will never ask before rejoining a network with the same name.
So, if you visit a network with a common name, like “linksys,” your iPhone will automatically join every network it discovers with that name. In a single cab ride, you could unintentionally expose your iPhone to dozens of networks with the same name.

If you use Wi-Fi at home, make sure your network has a unique name, so when you’re away from home, you don’t have to worry about someone else having the same name for their Wi-Fi network.

You can also tell the iPhone to stop automatically joining a nearby network by tapping Settings > Wi-Fi > The network’s name, then tapping Forget this Network.

If you plan to join an open network and aren’t using SSL in email, turn off automatic email checks by tapping Settings > Fetch New Data > Manually. Then join the network, and don’t check your email. Restrict your activity to things that don’t reveal sensitive data, like reading websites or playing Hold’Em.

Lock Your iPhone Access

Enable Show SMS Preview to see the beginning of an incoming text message before you’ve entered your passcode.

If you lose your iPhone, or if a thief manages to slip it out of your pocket, all of your email and data are in someone else’s hands. Stop them from peeking by locking your phone with a passcode.

It’s really easy to set up. Tap Settings > General > Passcode Lock, and set a 4-digit passcode by entering it twice. Just be sure to pick a different PIN than the one you use for your bank card.

Tap Require Passcode to change the duration of idle time before the iPhone asks for the passcode again, saving yourself from annoyance. As Apple suggests, a shorter time period is more secure. Chances are, you’ll be the one entering the code most frequently, so try to strike a balance between convenience and the need for security.

Keep in mind, however, that if someone wants to return your lost phone or contact your family in an emergency, they’ll be stuck at that input screen. To fix this, on your computer, use an image editor to create a picture containing your contact info. Email the graphic to your phone, and set it as wallpaper. Those details will appear behind the passcode prompt.

Use A VPN

If VPN setup gets too complicated, talk to your job’s IT administrator or VPN provider for help.

Suppose you’ve found Wi-Fi access that you don’t trust, but you really need to check your email. As with a computer, you can encrypt your traffic by using a Virtual Private Network. The VPN sends all incoming and outgoing data to a server on another network, all while using encryption. Most people use this to pretend that they are on a network that they’re otherwise not connected to, such as reaching an internal office file server while away. But it has the added benefit of encrypting the connection, making it useful for people that use lots of open Wi-Fi networks.

The iPhone supports three VPN protocols (each of which are good): Cisco IPSec, L2TP over IPSec, and PPTP. If you are already running one of these at home—great! But, if like most people, you’re not, you may want to consider renting a VPN. Some iPhone-friendly VPN providers are listed in VPN Providers Love the iPhone.

Securely Erase the iPhone

On the reset screen, only tap Erase All Content and Settings if you really mean it.

One of the features Apple touted about the iPhone 2.0 firmware update was the ability to remotely wipe all of the data from a missing or otherwise compromised iPhone, at least for corporate users. As we went to press, the only way to remotely wipe the iPhone was from a Microsoft Exchange server, and then only by an administrator on that server. For residential customers in the united States, there’s no way to remotely erase an iPhone by asking AT&T to do it.

If you decide to sell or give away your iPhone, it’s smart to erase it manually first. Tap General > Reset > Erase All Content and Settings. Connect your iPhone to a power supply first, because the process will eat up a lot of battery power as it overwrites the data. Apple says it takes about an hour per 8GB of space on the iPhone, so plan accordingly.

VPN Providers Love the iPhone

The iPhone’s built-in VPN client supports common VPN standards. Here are some VPN providers that cater specifically to iPhone users. Renting a VPN is not the same as getting Internet access. Rather, it provides a secure connection from your iPhone (or any other networked computer) to a VPN server somewhere else on the Internet, confounding any snoopers on an unsecured Wi-Fi network.

Company: Secure-Tunnel
Service: Secure-Tunnel VPN Mobile
Cost: $5.95 per month or $59.95 per year
www.secure-tunnel.com

Company: HotSpotVPN
Service: HotSpotVPN-1
Cost: $8.88 a month or $88.80 a year
www.hotspotvpn.com

Company: WiTopia
Service: PPTP VPN
Cost: $39.99 per year as part of additional VPN bundle
www.witopia.net

Podcast #68: Hidden SDK Features and Steve Jobs' Celebrity Playlist

Roberto Baldwin — Tue, 09 Dec 2008 21:19:29 -0600

The iPhone's super-secret TV out feature gets the staff all excited about future possibilities. We learn that, allegedly, Steve Jobs hand picks the music featured in iPod commercials and we wonder if Steve could work his magic on the iTunes free single of the week.

Yet another holiday song is chosen for our weekly, "Keep or Delete." Each week we download and review the free iTunes song of the week and decide whether we're going to keep or delete the file. This week's artist:

Faith Hill - O Holy Night

Don't forget, the Mac|Life staff would love to hear your thoughts, comments and ideas for the new podcast. Just leave a message on the Mac|Live question/comment line: (877) 404-1337, extension 622. Please limit the length of your messages to 1 minute max. We'll review these calls each week and feature our favorites, along with responses, on that week's podcast.

To subscribe to the Mac|Live podcast series through an RSS feed, click here; if you want to subscribe through the iTunes Store, click here.

Super-Secret SDK Video Out Feature Demoed

Roberto Baldwin — Fri, 05 Dec 2008 17:01:01 -0600

After finding some interesting undocumented features in the iPhone SDK, Ars Technica decided to get a hold of Freeverse and see if the company was willing to apply the MPTVOutWindow class to Moto Chaser.

The MPTVOutWindow class allows the iPhone to push its screen to a TV instead of its display. The iPhone accelerometer continues to work normally, the touch screen, in theory, should still be usable, but for this demo it was disabled.

Freeverse did a little coding magic and got Moto Chaser to display on a TV using a AV cable connected to the iPhone. The game plays at 20 FPS on a 2G iPod touch. That rate means the game is "nearly playable" according to Freeverse Producer Bruce Morrison.

You can check out the video below, and check out the full Ars Technica article here.

iPhone 2.2 Issues Surface

Danny Estrada — Mon, 01 Dec 2008 12:42:57 -0600

Some iPhone users up in arms over the 2.2 update. Many have reported a number of issues after the install, while others are gloating about how good their lives have become since the 2.2 update. Rumors of iPhone Civil War have begun to spread, mainly by us, right now.

Some of the major problems reported include the disappearance of 3rd party apps, the loss of Wi-Fi connection, loss of 3G and/or EDGE signal, and the inability to sync with iTunes.

So how can you go about fixing these issues instead of using your iPhone to draw first blood from your smug iPhone 2.2-rocks neighbor?

A possible fix for missing apps is to try setting up your iPhone up as a new phone, then re-installing the missing applications. This requires you to preform a restore in iTunes, then choose "setup as a new phone." We hope you have nothing to do today, since it may take a while.

The fine folks over at iPhone Atlas have put together an extensive list of fixes and problems associated with the latest update. Good luck, and don't be hating on the lucky ones.

First Look: iPhone/iPod touch Software Update 2.2

Roberto Baldwin — Mon, 24 Nov 2008 16:04:14 -0600

Now we know that REI sells paddle accessories. Hopefully for kayaking.

Apple released firmware 2.2 Friday upon an unsuspecting public. Okay, we were totally expecting the update and the features it brought with it.

For the most part the latest update, while not Earth shattering, is another reason why the iPhone has been stealing market share from more experienced smart phone makers. What follows is what the Mac|Life staff thinks of the latest update.

Google Maps with street view has the best transition animation of any app on the iPhone right now. You zoom from an overhead shot to a view of the street in question. We found ourselves enacting Street View for the sole purpose of this animation. Once in Street View, the pictures of the street load quicker than we expected with Wi-Fi and 3G. Edge, well Edge is Edge, it's serviceable. We have heard from users that figuring out how to use Google Street View on the iPhone can be confusing. For those folks, we have a handy video tutorial below.

Street View sounds great until iPod touch users realize they've been left out of the Street View party. iPod touch users weren't charged for this latest update, but they also got the short end of the stick. We're puzzled at the decision to keep Street View off the iPod touch. It makes sense considering the iPod touch has integrated Nike+. You want to know where you're running right?

The ability to disable auto-correction is nice for those who have mastered the onscreen keyboard. Some users have remarked that typing seems to respond quicker with auto-correction off. We didn't notice a marked difference.

The new menu bar in Safari saves us exactly one tap. Which in the grand scheme of things could lead to hours of gained tapping that could be used to learn a foreign language, start a correspondence with a stranger in a far-away land, or we could play more Line Rider. The menu bar makes Safari seem busier than it needs to be, but it follows the look of desktop browsers.

The App Store app categories face lift is nice. We do wonder how long an app will be utilized to signify a category and how does an app qualify for the coveted spot.

Podcast on the go is great for podcast enthusiasts. Hopefully in the next update we'll be able to download TV shows and music videos while on the go. Also, the podcasts are now arranged with the latest episode on the bottom, so when one is finished and it skips to the next in the list, it's skipping to a LATER episode and not an earlier one. That used to bug the heck out of us.

Google Map walking and public transit are helpful for urbanites looking to get around without a car. Some of the transit recommendations seemed to take us out of our way, but we still ended up where we needed to be. For added fun we decided to see how long it would take to walk from the Mac|Life compound to Mammoth Lakes for some snowboarding. Turns out it's going to take us four days to get there if we walked for 16 hours a day at a brisk four miles an hour. It also had us walking along a few roads that are closed for the winter. In town walking directions are much better. Like Street View, iPod touch owners are missing the walking and transit information.Why does Google and Apple hate iPod touch owners?

Because Emoji is huge in Japan, only Japan got the enhanced test messaging which is a huge bummer for us. Maybe we can start one of those online petitions to get it over here in the United States.

The app rating feature that allows you to rate an app as you're deleting it is sure to create a slew of bad ratings. Usually you delete an app because it sucks. How often do you delete an app you actually use?

Tapping on the Home Button to return to the main Home screen is a feature we never knew we needed. This is especially helpful if you keep the Camera app on the main Home Screen and you need to take a quick pic of your friend's hat fashioned from bar coasters.

The staff member whose email suffered from the lack of real fetch email service has noticed that his work emails are syncing much quicker with his desktop machine. His MobileMe email still suffers from the 15 minute delay noted by Apple. We've also noticed that dropped calls have become less of a problem since the update.

Barring the mysterious omission of Street View and transit/walking info from Google Map from the iPod touch, we're happy with the new update and the features it has brought to our devices. Although, still no copy and paste.

iPhone 2.2 is Live - Let the Updating Commence

Roberto Baldwin — Fri, 21 Nov 2008 00:52:12 -0600

Hey, remember a few hours ago when we were all, "the new iPhone firmware will be available on November 21."

You were probably sitting there thinking, "Whatever Mac|Life, Friday updates are crazy talk." Well, who's crazy now?

The 246.4 MB download brings Google Street View, the ability to download podcasts on the go, improved Safari stability, decrease in call fails and drops, improved visual voicemail audio, the ability to turn auto-correction typing on and off, and if you press the Home button in any Home screen it brings you to the first Home screen.

We're installing the update and we'll have our impressions tomorrow morning after we've had some time to put the new features to the test.

Drop your impressions in the comments below.

iPhone 2.2 Tomorrow?

Roberto Baldwin — Thu, 20 Nov 2008 22:24:25 -0600

Appleinsider reports that a German security firm may have stumbled upon the release date for iPhone firmware 2.2. Lucky for us, that date could be tomorrow.

the Fraunhofer Institute for Secure information released information about security hole that would allow malicious code to be placed on a website and allow a phone number be dialed with the iPhone.

The institute noted that only three lines of code are necessary to exploit the security code. Apple was informed of the exploit a month ago, and Fraunhofer claims that security update will be available November 21.

Apple could just push a small security patch to the iPhone, but Appleinsider thinks Apple could go all out and release 2.2.

Let's keep our fingers crossed for Google Maps with street view and bus and walking directions, the ability to download podcasts directly to the iPhone, updated Safari and App Store face lifts, and emoji icons.

We're gonna use those emoji icons all weekend long. Oh, no word on copy and paste.

iPhone Direct Podcast Download Screenshots Emerge

Danny Estrada — Thu, 06 Nov 2008 11:56:59 -0600

More iPhone software 2.2 screenshots have leaked on to the web revealing not just one new feature, but two new features to get excited about.

The first being the Direct Podcast Downloads. The leaks was provided by German blog Flo's Weblog, a very exciting blog. We not only enjoyed the 2.2 firmware screenshots, but also the photo gallery of their Sunset Cruise.

Flo's Weblog seems to confirm reports that the next iPhone update will allow users to download podcasts via the mobile iTunes Store over 3G and Wi-Fi. Last month Appleinsider suggested these functions would be available, but like Google Street Viewer, the functions had not been activated by Apple during the seeding process until now. Apple placed a 10MB limit on items that could be downloaded over a cellular network. There is no word on how this limit will addressed with podcasts. Maybe you could download a lower bit-rate version of your favorite podcast while on the road.

The 2.2 facelift is taking place on the App Store categories as well. No longer will we be bored with simple text. Now we can look forward to fancy icons next to simple text.