One of my predictions in Flattening The Cellphone Market came true today. It suggests that the iPhone’s Android-induced troubles are about to get much worse.
I had written:
Back to Apple. Anybody want to bet that Steve Jobs hasn’t already been on the horn to AT&T demanding that they allow the iPhone 4G to ship with tethering enabled? From his point of view this is now a must-have if the 4G isn’t going to look like a weak second-best. But AT&T is going to push back, oh yes they will, because they’re already notorious for iPhone service problems stemming from network underprovisioning and congestion. Hilarity, and possibly some bloodletting, will ensue. There are only three possible outcomes here: (a) iPhone 4G fails to ship with tethering, in which case Apple and AT&T both take a hit, (b) iPhone 4G ships with tethering and it sucks, in which case AT&T takes a hit and Apple may dodge a bullet or not, or (c) AT&T ponies up a gigabuck or three to upgrade to 4G at record speed.
It looks like we got outcome (b). Apple AT&T announced today that the 4G will allow tethering for an extra $20 per month, but there’s a sting in the tail: only with a new data plan that has a 2G-per-month cap, and the iPhone unlimited-data plan is being scrapped. I think we can deduce from what wasn’t announced that there will be no mobile-Wifi-hotspot support, especially since multiple WiFi clients would hit that cap in no time at all.
And yes, iPhone tethering is going to suck. We learn from Business Week that iPhone users average 7 times the data load of non-iPhone users on AT&T’s network. This means the usage cap will hit them 7 times as hard.
It’s pretty clear that Jobs’s reality-distortion-field failed and AT&T won this round with Apple. The net effect will be to decrease the data load on AT&T’s creaking, underprovisioned network while increasing the toll charged for it. Unfortunately for Apple, this probably also means that the iPhone 4G is not going to achieve feature parity with Android 2.2. Of course it’s possible that Jobs is going to pull the mobile-Wifi-hotspot feature out of the air at WWDC in 5 days, but now that looks unlikely. The timing of today’s announcement tells me that Apple doesn’t want to be seen to be playing catch-up at WWDC.
Catch-up is, nevertheless, what Apple has to play now. It’s significantly behind in features (mobile-Wifi-hotspot, voice recognition, and Flash support are the big ones) and behind in new-unit sales. It’s fast alienating app developers with onerous restrictions on development tools and an app-approval policy that looks increasingly murky and arbitrary. All of which makes me think Steve Jobs’s cunning has deserted him, that he’s either losing his grip or overtightening it.
It will be interesting to see how aggressive the Android-using carriers get about kicking Apple when it’s down. Sprint, in particular, has a golden opportunity two days from now at the EVO 4G launch. It’s already announced that the mobile-WiFi -hotspot feature is on; if Sprint decides to exploit its 4G buildout by making that feature uncapped, Apple will get well and truly hammered among the elite, opinion-molding users it most covets.
This also illustrates the point that Apple’s bind isn’t entirely due to Android. The fact that iPhone has a U.S. exclusive with a badly underprovisioned carrier is seriously limiting Steve Jobs’s ability to respond. One wonders what he will do about that, or can do.
sorry, a non-informed question from Europe: why doesn’t Jobs unlock the IPhone? is it technically impossible?
and indeed:
Since launching the iPhone three years ago, Apple has faced complaints in the U.S. because of quality issues with partner AT&T. Mr. Jobs said he expects the operator’s networks get a lot better, certainly by the end of the summer. However, he also acknowledged there “might be an advantage” in having more than one wireless carrier in the U.S. in a possible hint of a future partnership with other carriers.
http://online.wsj.com/article/SB10001424052748703961204575281401946573926.html
Unlock as in “let it be used with any carrier”? Because Apple has an agreement with AT&T that, in return for Apple locking the iPhone to AT&T in the US, has AT&T paying Apple large sums of money.
Of course it’s technically possible, but then Apple would be giving up kickbacks from AT&T and have to raise the price of iPhones. Sadly American consumers have collectively decided that we don’t want to pay for phones up front, instead preferring to get ripped off via high monthly charges and contract lockin and usage restrictions.
Oh Eric, the only RDF I’m seeing here is your own, the one in which Apple made some sort of announcement today. Would you care to point us to that announcement that Apple made? Oh, and it does indeed come with mobile wi-fi hotspot coverage, it’s just not clear if there are caps on what you get (I presume there are).
Of course, Apple made no such announcement. AT&T did, and I highly doubt it was under duress from Apple like you suggest.
The clue as to why lies in the fact that AT&T raised their termination fee to a whopping $325 just a few weeks ago. The only reason to do that is because they had reason to expect some sort of mass defection from their network. I wonder what might cause such a defection?
That same thing that AT&T is anticipating explains today’s enabling of tethering as well. Of course, they could enable tethering on 3G phones as it already has that capability, but that would spoil the RDF that it’s Apple who prevented consumers for tethering for the last 2 years.
I strongly suspect that Sprint, if not Verizon, will be announced as a new iPhone carrier at WWDC on Monday. I could be wrong, maybe it played out the way you describe above, but that doesn’t explain the termination fee hike.
And frankly, this is all just Kremlinology until the new Apple phone is released.
Correct. In essence, what we’re doing is financing the cost of the phone over the term of the contract. You can get the much beloved European deal here; for example, MetroPCS is a small carrier that operates out of a few cities that doesn’t sell phones tied to 2-year agreements. They have one price $40 all-you-can-eat, but you have to buy your phone; they don’t have free phones. OTOH, the phones they do sell are pretty cheap. On the gripping hand, they don’t offer any smartphones except the Blackberry Curve at $350 and a few cheap Windows Mobile devices.
(I personally use Sprint/Nextel as I have for nearly 15 years)
Eric,
In the interest of fairness, while the new 4G EVO will ship on Friday with wireless tethering, there is a “special” data plan for the 4G phone, which I suspect is really just a Clear subscription in disguise.
Still, it’s unlimited so you could make up the difference by dropping your DSL or Cable (or wireless) home service and it would be all good.
According to the (some what thick) lady at Sprint, the additional charge is $10, so so still a pretty good deal, especially if you can drop you DSL or Cable Modem service in favor of this solution (which at least for single folks is a real possibility).
Another question for a European:
Re MetroPCS: So they only sell a few cheap phones, but what keeps you from getting exactly the phone you want, with the features you want, and then just getting a SIM from MetroPCS and pop it in? Or is the US phone market still miles away from commoditization?
(BTW, the iPhone has had tethering for ages over here in Switzerland…)
>I wonder what might cause such a defection?
I don’t. I think AT&T knows full well that the EVO 4G and other Android 2.2 devices are going to cause serious churn, and is circling the wagons in advance of the Sprint announcement.
And it makes no difference to the logic of the situation whether Apple or AT&T announced the limited tethering; it still leaves the iPhone 4G with no hotspot feature and eating the dust of Android 2.2 with respect to at least two other major features as well.
>Or is the US phone market still miles away from commoditization?
Still miles away. But at least now that development is no longer out of sight over the horizon, as evidenced by my painless switchover from the G-1 to Nexus One.
>I strongly suspect that Sprint, if not Verizon, will be announced as a new iPhone carrier at WWDC on Monday.
How much do you want to bet on that, son? I could use some easy money, and I have no inhibitions against taking it from the self-deluded.
I’ll take some of that action. Too much would have to change, including the building of a second hardware platform – and if that was in the pipeline, we’d have heard about it by now.
If the situation continues to deteriorate, we may see Apple go to a strategy that had been speculated about prior to the AT&T deal: becoming a wireless carrier themselves. For that matter, MetroPCS has a market cap of $3B, and Sprint only $15B – Apple could pay cash for either.
That would depend on being able to break the AT&T contract and forgo that revenue, obviously…
Apple’s not going to do a CDMA iPhone, period. If Sprint was GSM, they might consider it – but there’s a powerful advantage to only having to build one iPhone platform that they’re not going to just throw away.
>That would depend on being able to break the AT&T contract and forgo that revenue, obviously…
It’s worse than that. AT&T is making money from the exclusive, and I don’t see any reason for them to let Apple go – I mean, it’s not like AT&T can’t already sell Android phones. If Steve Jobs wants out before the 2012 expiration, he’s going to have to pay cash on the barrelhead to AT&T to compensate them for the lost kickbacks.
Except for the unlimited plan, the new plans are dramatically cheaper than the old plans when you go past 2GB, so some middle ground has been found here.
What annoys me is that the same deal is not available to laptop owners who want WWAN.
AT&T’s announcement also seriously whacks the pee-pee of the 3G iPad, which will no longer have its much-touted unlimited no-contract data plan as a selling point. Apple has suspended sales of the 3G iPads through its Web site as a result.
True, the iPad is inherently carrier-unlocked, but where else could US iPad users go? There’s T-Mobile and…that’s pretty much it, really,
Something tells me this is AT&T’s attempt to re-establish who wears the pants in this relationship.
>Something tells me this is AT&T’s attempt to re-establish who wears the pants in this relationship.
There’s something to that, I think.
A comparison to the shitcanning of the Nexus One on Verizon is instructive. It was Google who walked away from that deal; so Google has shown it’s got the whip hand over the carriers, while Apple is having data-plan terms dictated to it by its carrier.
The ubiquity game beats the control game. Every time. I’m amazed that there are still people who don’t get this.
>For that matter, MetroPCS has a market cap of $3B, and Sprint only $15B – Apple could pay cash for either.
But they’re both CDMA. So it ain’t gonna happen; probably not ever, and certainly not any time soon. As Jay Maynard correctly observed, we’d hear rumors of a CDMA iPhone well before that kind of deal got off the ground.
Actually, Sprint/Nextel’s 3G network is EVDO and their 4G network is WiMax. The Sprint EVO, which is due out this week, I think, is an Android 2.1 phone that can do simultaneous talk and data by doing talk on CDMA and data on EVDO or WiMax (3G/4G).
Well, there are rumors. Hard to tell if they’re anything beyond wishful thinking, though; it’s entirely possible there isn’t much to it.
Verizon itself have also lean towards a tier plan in the future. In the meantime, I did a 4 day business trip in Las Vegas using my Droid and PDaNet tethering program. Actually works better than my hotel wirelsss (paid for the first night).
Doesn’t the iPhone have a software radio? If that’s the case, then wouldn’t it be a SMOP to change it to EV-DO or WiMax?
And considering how close LTE and WiMax are, that’s almost a non-issue once 4G coverage becomes the default.
brian> Doesn’t the iPhone have a software radio? If that’s the case, then wouldn’t it be a SMOP to change it to EV-DO or WiMax?
Depends on the frequencies. Even if the radio can handle it, that doesn’t mean the antenna is designed well for the specific frequencies. I seem to recall licensed WiMAX was in the 2.9Ghz range, don’t know about EVDO. If your antenna is not designed for the frequency range you trying to use, your range goes to crap and you get tons of retransmits and network drops. Frequency response, even on the crappy little antennae they put in most cell phones, has a pretty sharp drop-off outside the designed frequency range to reduce the amount of noise that must be sorted through to get a clear signal (and reduce the harmonics when transmitting).
I mostly agree with this post. A couple comments.
First, I think the ‘unlimited’ vs. ‘2 gb’ cap is mostly meaningless for the iPhone. I suspect the number of people who go over 2gb is vanishingly small. I use my iPhone fairly actively on 3G (and wifi) and hit about 300MB of 3G per month. So all else equal, I’d guess that most users will save money with this plan. And generally I’m a fan of tiered pricing, so long as the pricing is straightforward.
Second, though, one of the *huge* appeals of the iPhone originally was the simplicity of the plan (and the phone). You didn’t have to guess how much data you thought you might use. The new plan isn’t yet horrible, but it’s approaching it. Cost for 200MB is $15, unless you are using an iPad in which case $15 gets you 250MB. For $25 you get 2GB, unless you want tethering in which case it’s going to cost you $20 more. And you can only have tethering if you have the $25 package, not if you have the $15 package. If you go over your 250MB on the $15 package, you can either upgrade to the 2GB package or pay an extra $15 for 200MB more.
I’d like to see plans like:
Basic: $5 per 100MB
Pro: $20 per 1GB
Tethering: Free.
Simpler for users and I suspect this simplicity would translate into more money for AT&T. Confuse your users and they’ll look for simpler plans elsewhere. Case in point: I had almost written off the Evo 4G because Sprint chose to complicate its data plans, by adding a $10 surcharge, an extra fee for wifi hotspot, etc.. Now that AT&T has gone the same way, the Evo is back on.
I don’t agree that all the carriers will go to tier pricing. As ESR said a few days ago, people don’t like to be nickeled and dimed. At least one will still have an unlimited option, and I bet it would be Verizon — Since they’re so heavily thrown in with Android, I think it would be smart for them always to offer unlimited to differentiate themselves from AT&T on both superiority of service (no headaches or stressing out over counting beans and minutes) AND platform (relatively open Android vs Pottersville/Walled Garden iCabal).
Erbo writes:
> “Apple has suspended sales of the 3G iPads through its Web site as a result.”
Source? You can put a 3G iPad in your shopping cart right now online, with an expected 7-10 days to ship.
You might be confusing it with the 3G iPhone. Apple now only sells the 3GS; they’ve sold off all their inventory of the prior model (the 8GB 3G) to clear the shelves for whatever New Hotness is to be announced next week.
Eric, maybe I’m a little confused, but: given that the iPhone already does tethering in many countries around the world and will do tethering in the US next week, how does the fact that Nokia “has already announced” they will have this feature in their soon-but-not-yet-shipping products mean Apple is “significantly behind” on that feature and “has to play catch up”?
ESR says: The feature I said they’re behind on is the mobile WiFi hotspot, not quite the same as tethering.
@Glen
I suspect that ESR is referring to the wifi hotspot which is available on vanilla Android 2.2 (though will likely be disabled by many carriers on their versions), as well as on the HTC Evo 4G (which I suppose isn’t technically available yet, but will be in a couple days). Tethering on the iPhone is via a cable, and services a single computer. Competitors can create a general wifi hotspot that services several computers.
ESR says: Yes, also the hotspot feature won’t require special software or configuration on the phone end. I think this matters.
> Yes, also the hotspot feature won’t require special software or configuration on the phone end. I think this matters.
Ironically, that sort of ease-of-use feature is just the sort of thing Apple likes to pride themselves on. Must sting …
I suspect that Apple could have implemented something similar, at least on the 3GS — but why bother, when AT&T won’t even let their customers enable the basic tethering feature? Regardless, whether or not Apple could have, they didn’t, and whoever they choose to blame for that, the problem is still ultimately theirs. For all the criticism AT&T gets (and largely deserves), I don’t recall them holding a gun to Steve Jobs’ head and forcing him to sign an exclusivity deal.
>I don’t recall them holding a gun to Steve Jobs’ head and forcing him to sign an exclusivity deal.
I suspect that was AT&T’s price for letting him sell handsets that would talk to their network. Back then, nobody (except maybe Jobs himself) knew that a smartphone OS could be such a customer lure that carriers would (in effect) pay to get one.
I believe it was widely reported at the time that *only* AT&T was willing to take what Apple gave them and sell it without seeing it much in advance.
For all the griping about Apple, Apple was *the* company that broke the carriers’ lock on the OS. So yes, it is almost certain that the price AT&T demanded for ceding control of the OS was exclusivity. I remember hearing at the time that it was a 5-year exclusive, though that has presumably been renegotiated since t hen.
i seem to remember that AT&T was also said to be the only carrier that would allow apple to rewrite its entire voicemail system to be compatible with the “visual voicemail” feature, which was one of the well-touted aspects of the first-generation iphones.
> Tethering on the iPhone is via a cable”
No, you can also do it via bluetooth as well. You might well *want* to use a cable if you have one handy, so the phone stays charged. But it’s not required. See here:
http://www.apple.com/iphone/iphone-3gs/tethering.html
> and services a single computer.
That…is probably true but I’m not sure I see the benefit. Assume you have, say, an iPhone and a MacBook Pro and you use a USB cable to give your MacBook internet access while your iPhone is charging. Couldn’t you then just configure the *MacBook* as a general wifi hotspot that services other computers? Given that all macs have wifi and a “Create Network…” option right there in the Airport menu, what’s the benefit to *not* doing it that way? I guess if you’re someplace that doesn’t already have free wifi *and* you have multiple devices you need to use simultaneously *and* all these devices have wifi *but* none of these devices are themselves able to serve as a wifi hotspot (meaning they’re not modern mac or pc laptops). Um…no, I’m not really seeing it. What’s your use case for this feature?
> also the hotspot feature won’t require special software
Nor does the iPhone tethering feature. According to the link, the steps to tether are:
1. In Settings, choose General > Network > Internet Tethering.
2. Slide the Internet Tethering switch to On.
3. Connect iPhone to your computer:
To connect, either (a) plug in the phone using the USB charger cable, or (b) turn on bluetooth and “pair” the phone with your laptop.
esr Says:
—
It’s worse than that. AT&T is making money from the exclusive, and I don’t see any reason for them to let Apple go – I mean, it’s not like AT&T can’t already sell Android phones. If Steve Jobs wants out before the 2012 expiration, he’s going to have to pay cash on the barrelhead to AT&T to compensate them for the lost kickbacks.
—
From June 2008:
—
In the near term, AT&T anticipates that the new agreement will likely result in some pressure on margins and earnings, reflecting the costs of subsidized device pricing, which, in turn, is expected to drive increased subscriber volumes. The company anticipates potential dilution to earnings per share (EPS) from this initiative in the $0.10 to $0.12 range this year and next, with a 2008 adjusted consolidated operating income margin of approximately 24 percent and a full-year 2008 wireless OIBDA margin in the 39-40 percent range. As recurring revenue streams build without any further revenue sharing required, AT&T expects the initiative to turn accretive in 2010.
—
http://www.att.com/gen/press-room?pid=4800&cdvn=news&newsarticleid=25791
So, by the looks of things, the contract with Apple expired, and AT&T changed the unlimited plan to tiered pricing.
There is no evidence for Apple giving kickbacks to AT&T. On the contrary, in the original 2007 contract, AT&T was sharing service revenue with Apple. The contract was amended in 2008, such that AT&T could discount the phone, and the revenue split stopped. It’s also likely that the contract was shortened from 5 years (2012) to 3 (2010).
For example, in July of 2008 we had the very same USA Today reporting that, “Under the original iPhone contract, Apple had the right to offer the device to other carriers beginning in 2009.â€
But instead, in 2008 Apple and AT&T apparently agreed to an extension — into 2010, USA Today reported citing “people familiar with the matter†who asked “to not be named because the terms are confidential.†The reason for the extension? The huge payout AT&T was giving Apple for each iPhone sold, apparently.
And then, in April 2009, The Wall Street Journal reported that AT&T’s exclusive agreement “expires next year,†citing sources familiar with the matter (that’s inline with the latter USA Today report). They go on to note that, “Mr. Stephenson is now in discussions with Apple Inc. to get an extension until 2011.â€
So if the initial contract had AT&T getting the iPhone exclusively through 2012, why would WSJ and USA Today report that it expired first in 2009, then in 2010? Well, either their sources were flat-out wrong, or (and I think more likely), the contract has changed over time.
Actually, this move by AT&T just prior to WWDC points to something huge in the works from Apple. If it’s a Verizon phone, Android will be challenged to keep up it’s growth.
Apparently, existing iPhone users can keep their $30/month unlimited plans, but they won’t be able to use the new iPhone’s tethering capability. So the move by AT&T is clearly in response to the new tethering functionality: AT&T doesn’t want to be reduced to being simply a bit-pusher. If other wireless providers don’t follow AT&T’s lead with Android’s Wifi hotspot feature, then I think this might even start a revolt amongst (non-fanboy) iPhone users, with many opting for Android and unlimited data.
That’s the big question, Morgan. Will they, or will they gleefully say “nobody else is offering unlimited data, why should we?”
I’d love to have tethering, but I’m not going to give up unlimited data to get it. Unlimited data has been a major selling point for both the iPhone and iPad, and AT&T did Apple no favors at all by doing away with it.
>That’s the big question, Morgan. Will they, or will they gleefully say “nobody else is offering unlimited data, why should we?â€
From the point of view of the other carriers, Sprint are the rotten bastards most likely to defect from this particular implicit cartel. That’s the way they’re pointing, anyway. And it will only take one.
tethering on android available on most phones ….all you need to do is root your phone and install the Cyanogen Mod
Morgan Freewolf said: If other wireless providers don’t follow AT&T’s lead with Android’s Wifi hotspot feature, then I think this might even start a revolt amongst (non-fanboy) iPhone users, with many opting for Android and unlimited data.
I hate to tell you this, Morgan, but it sure seems like most people don’t actually give a shit about that.
A goodly number of the iPhone users I know don’t even own a laptop, let alone want to tether one to their phone. (Hell, the Droid owners I know never use tethering!)
Given that, by all accounts, the vast majority of users never exceed the 2 gigs of the new, cheaper AT+T plan, where’s the “revolt” coming from?
The tiny market of super-geeks* that care about notionally-unlimited-though-we-really-mean-5-gigs data plans and tethering already aren’t using iPhones, are they?
(And to harp on what Jay Maynard replied with… nobody gives you unlimited data now. They all call it that, but it’s really a soft limit of 5 gigs in every example I’m aware of, including the old iPhone plan, and if you’re lucky or nice, they won’t charge you for the occasional overage. For instance, every Verizon plan is 5 gigs, not unlimited.)
(*I say “super-geeks” because that’s beyond normal tech geekery. I’d rather have a superior user experience than give it up for features I don’t actually give a fig for, and a nice un-fragmented platform. Or at least relatively un-fragmented, since I suppose the iPad counts as a fragmentation, what with the different screen size.)
Actually, Sprint already offers all-you-can-eat data on 4G for $60 a month on top of your regular wireless plan (3G still has a 5GB monthly cap).
Who’s going to have a “superior user experience”? An iPhone user on AT&T’s crappy network with spotty 3G coverage or an HTC EVO (running Android 2.1) user on Sprint’s 4G, pulling down bits at 9.11 Mbps?
A couple of things –
1) There’s no way in hell Apple was behind this announcement. The last time Apple let some other company screw with their PR was… I think, never. And definitely not AT&T. If I had to guess, I would say that this announcement is AT&T’s way of giving Apple the finger prior to Apple announcing a iPhone on a competing carrier Monday. It’s also a last-ditch effort to avoid becoming a flat-rate bit-pusher, which I think will fail in the long run.
2) The CDMA iPhone isn’t as far outside of the realm of possibility as ESR is suggesting. I don’t know for sure one way or the other, but I’m privy to some inside info (why I’m posting anonymously) that suggests that Apple at least took a very serious look at it. If Apple’s not ready for cellular polyamory, they at least did some serious flirting, exchanged some dirty text messages, and went of a few dates. Unless ESR has a better mole than me (certainly possible), I wouldn’t write it off so quickly.
3) The iPhone vs. Android discussion isn’t going to change any minds in this group :-)
4) Apparently an Android rootkit is being shown off ( http://www.networkworld.com/news/2010/060210-android-rootkit-is-just-a.html ). Pretty much the only advantage of Apple’s insanely locked-down platform is that it will most likely be less susceptible to malware. We’ll see how well that prediction works in the long run, but giving the average user the ability to install *anything* on an almost always-on, almost always-connected device may very well be a recipe for disaster.
>Pretty much the only advantage of Apple’s insanely locked-down platform is that it will most likely be less susceptible to malware.
Huh? Experience suggests the reverse, actually.
That is, “insanely locked-down” platforms tend to rely on security by obscurity that is quite brittle against any even moderately competent attack. And to have lots of undiagnosed bugs leading to security holes.
Well, I’ll have a superior user experience on AT&T over Sprint – since Sprint doesn’t cover my home, period.
Verizon has already stated as they role out their next gen network that they want to go to a pay-go pricing model for data. Sorry I don’t have a link handy, I heard it on the radio. It’s worth noting that a lot of the carriers have been reworking their data plans recently. I wish though that instead of going back to the dark ages of mobile data (as AT&T seems intent on doing) they would handle their “traffic problems” the way T-Mobile is, 5GB data, and then after that they cap your speeds, but you can keep going and no extra charges.
Well, esr, while what you say has no doubt been true in the past, isn’t it true that the walled garden of the App Store has been malware free? If there was a case, I missed it. I understand and have some sympathy with your philosophical objections to the App Store approach, but with all due respect I don’t think it’s fair to say that “experience” shows it more likely to have malware, when the incident count (so far) seems to be zero.
>I don’t think it’s fair to say that “experience†shows it more likely to have malware, when the incident count (so far) seems to be zero.
Give it time. I’m extrapolating from experience with previous “insanely locked down” systems.
> Give it time. I’m extrapolating from experience with previous “insanely locked down†systems
Let’s not forget that the iPhone runs (essentially) freebsd jails over a Mach kernel.
It’s locked down in more ways than you might want to admit.
[citation needed] FreeBSD jails don’t exist on OS X.
Also, security through obscurity is already a known problem on the iPhone 3GS.
30 seconds of google says no.
For those who think that security through obscurity is a plan for success, you can find a real life example of what ESR would expect to see by looking around for information about a smartphone “sms vulnerability”. Originally demonstrated on an IPhone at a black hat conference end of july last year, similar vulnerabilities were found on both Android and Windows Mobile.
The vulnerability on Iphone took about 6 weeks after (alleged) notification to get patched(i’ve also seen quoted figures of 12 days, “about 6 weeks” and “since end of june” hence the alleged). The comparable vulnerability on Android got patched “A day or two” after disclosure.
ESR says: …and anyone who is the least bit surprised by these facts has been asleep for the last decade.
Yeah, but it might take “A year or two” for the patch to reach the HTC Hero, and then you have to back up all your stuff with a payware program because the update comes as a PROM-clobbering Windows executable, not an over-the-air band-aid.
JonB: Of course the App Store could have malware. The point is: does it? Your link seems to be about an app that was never in the store, so it doesn’t disprove my point. In contrast, malware has been distributed through the Android Market.
An additional 30 seconds of Googling ‘Nicolas Seriot’ shows that not only could the app store have malware, but it has had malware:
Is that Steve Jobs Reality Distortion Field you’ve got over there really that good?
Here’s another one: http://mtc.sri.com/iPhone/
In early November 2009, Dutch users of jailbroken iPhones in
T-Mobile’s 3G IP range began experiencing extortion popup windows
(Figure 1). The popup window notifies the victim that the phone has
been hacked, and then sends that victim to a website where a $5
ransom payment is demanded to remove the malware infection [1,2].
The teenage hacker who authored the malicious software (malware) had
discovered that many jailbroken iPhones have been configured with a
secure shell (SSH) network service with a known default root password
of ‘alpine’. By simply scanning T-Mobile’s Dutch IP range from the
Internet for vulnerable SSH-enabled iPhones, the misguided teenage
hacker was able to upload a very simple ransomware application to a
number of unsuspecting iPhone users before being caught and forced to
pay back his victims.
This one only effected jailbroken iPhones and relied on a default password, so you could argue that it’s not a “real” security hole. But think about it. Any good security scheme needs to be able to gracefully handle transitions between permissions levels, and this incident demonstrates that the iPhone was not designed for this at all. I’m sure there are plenty of other problems as well, all originating from the same careless design attitude which led to this one. Do you really trust a team of programmers who shipped an OS with a default root password, which was difficult to change without any know-how, just because they thought they could get away with it? I bet there are other oversights as well.
Max E.> …the misguided teenage…
Hmmm. I think “hoodlum” is probably a better term. I hope he did some sort of pennance other than being “forced to pay back his victims.”
@esr:
I’d have said that anyone who honestly advocates security through obscurity has been asleep for the majority of the decade before the most recent one.
@PapayaSF:
Actually thats not the point. The point is “what’s stopping it”.
That article’s point is that if you release a “free to play” game (like all the ones that are on Iphone already) and can hide some routine for attaching phone data along with the updates then you could probably skate indefinately because the infrastructure is fundamentally insecure. He even suggests what kind of infrastructure you’d probably need to improve. It’s kind of like Android’s current infrastructure funnily enough.
Code review by a small group of overworked employees is not security, it’s wishful thinking.
IE has always had code review by a small group of overworked employees. Do you trust it’s code review?
> The last time Apple let some other company screw with their PR was… I think, never.
Does Engadget count? :-)
Max, your argument over the security of a jailbroken iPhone is the equivalent of someone saying that ubuntu is insecure because if you run the live CD and turn on SSH people can break in because it uses a default password. Or that any number of database services are insecure because they also have default passwords. or various switches and routers.
SSH on the iPhone is off by default and can not be turned on without explicit user action that by its very nature alters the security system of the device. There is nothing anyone can do to protect a user from their own stupidity and anytime you turn on a remote access service, it is the responsibility of the user turning it on to understand the security implications.
I get the arguments of the potential of iPhone insecurity, but users voluntarily opening holes in their system do not count.
>I get the arguments of the potential of iPhone insecurity, but users voluntarily opening holes in their system do not count.
I concur.
tmoney: I think this Douglas Adams’ quote is appropriate here:
“A common mistake that people make when trying to design something completely foolproof is to underestimate the ingenuity of complete fools.â€
After having used my mother’s android phone I have to say, it is really horrible. The iphone is far, far, far better in terms of actually doing things. This may explain the difference in data download volumes.
I am still, like you folks, annoyed at apple over some of their decisions, but the difference in the products are fairly huge.
Um, have you actually tried the HTC EVO 4G? Seriously, get in your car, go to a Sprint store, (or a RadioShack, etc.), and try one. The user experience is truly impressive. My wife’s phone will be in on Tuesday — they were sold out Friday.
After having used my best friends iphone I have to say, it is really horrible. Android is far, far, far better in terms of actually doing things in a timely, usable fashion.
Of course thats probably because i’m an android user and have absorbed the android mental model whereas you’re an iphone user and you’ve absorbed the iphone mental model. Personaly I find qualitative usability data to be always suspect, Hell i’ve seen some pretty suspect quantitative usability data but at least that i can have a conversation about that.
Well, those examples seem like fairly weak tea as malware goes, being more privacy violations than something like stealing passwords or dialing foreign telephone services. But I never claimed the App Store was immune, I just questioned the claim that it was (or would be) worse than alternatives.
And, no, I don’t think of myself as a Jobs Kool-Aid drinker. I’ve always been a big fan of Apple, being a liberal arts/publishing guy who got into computers via the Mac, but I don’t agree with everything they do. (E.g.: I wish there was a minitower Mac in between the Mini and Pro, think the App Store is a bit too restrictive, etc.) And while I get where all the F/OSS people are coming from, I think the Apple-bashing misses some crucial points.
Macs have never been about being the cheapest, or the fastest, or having the most features. They’ve been about overall design and having the best user experience for most users. Geeks tend to like cheap/fast/features, and tend to dismiss design as a frill. I think the Mac approach (careful design, tight software/hardware integration, open where appropriate, closed where they think they have to be) has worked well.
I think what Apple does is hard and necessary, even for people who never buy Apple. While there may be F/OSS alternatives to Apple products, how many are as well-designed? (Granted, iTunes largely sucks.) I want a design-driven Apple (even if they are partly proprietary), because I think it’s better for the computer ecosystem as a whole. Let’s face it: Apple has been the driving force for UI design since 1984. Without them we might still be staring at green monospaced fonts on black screens. I think they’re the ones to beat in hardware and OS design, MP3 players, smartphones, and now touchscreen tablets.
I think some of the predictions about Android are wishful thinking. Android will be some sort of success: they are already the minority platform preferred by many geeks, and might become “the Windows of smartphones” (i.e. the biggest market share with a wild and woolly app market), but surpassing Apple in (non-geek) user experience? Seems unlikely to me. Good design (especially hardware + software) is very hard, and usually comes from good company teams and not scattered volunteers. (No offense to F/OSS volunteers! I applaud your efforts and steer clients to Unix hosting for websites!)
Plus, Apple isn’t standing still. I think it’s a lot easier for Apple to add missing features and get more open than it is for Android devices (or most things F/OSS) to gain Apple-level integration and design polish.
I totally agree with JonB when he says it isn’t important whether or not there is malware now; the important thing is that there is a strong potential for malware and the longer iPhone continues to be a pervasive platform, the greater its security will be attacked both quantitatively and qualitatively.
Statements like “overall design” and “best user experience” don’t say anything quantitatively. The reason Apple fans get poo-pooed when they make these statements is that they are palaver. Beauty is in the eye of the beholder.
Even saying things like “tight hardware/software integration” doesn’t say much; if components and peripherals are carefully chosen, a PC desktop running Linux has the same so-called “just works” experience as a Macintosh. On the machine I’m using now and my wife’s machine, I haven’t had to manually install any drivers or perform any hardware-specific configurations whatsoever.
For example, I like to scan old photographs, so I have a scanner — it’s a Canon LiDE 60, which happened to be on sale at my local Office Depot for even less than I could purchase it online. Before I purchased this scanner, I researched its support by SANE, etc., on Linux and found that it’s known to work well. When I got it home, I plugged it into my Ubuntu PC and voila — it “just worked”. I *did* require some manual configuration, since both my wife and I use this device: I had to alter the netmask in saned.conf to allow clients on my internal network to access the device.
Of course, this could have been made more user-friendly by a GUI saned configuration utility, but literally all I had to do was add a line that says ‘192.168.1.0/24’ to the saned.conf file. What’s more is that the alternative on Windows and Mac OS X out-of-the-box is that network sharing of scanners isn’t possible, except, of course, by SANE itself, in which case the configuration is exactly the same. :) (See why hackers go out of their way to make their software network transparent?)
And once I added that line, the scanner also “just worked” on wife’s desktop and laptop and on my laptop as well. The other hardware components and peripherals in each system were chosen in a similar fashion — either stuff that’s going to work well because it’s built around a known standard, has a vendor-supplied Linux driver, or otherwise has good, working open-source drivers available for it.
“Tight hardware/software integration” is similar in Apple land. The only real difference is that Apple is doing that pre-screening of hardware for you — in some cases developing their own drivers and in some cases not — and slapping a bitten apple picture onto it to make you feel better. So you can either take the educated approach and own your system, or you can take the Apple nursemaid approach and have your hand held and your diapers changed for you. It’s your choice.
Maybe, maybe not. By far, Apple wasn’t the only team doing work on GUIs. X, for example, began work at MIT in 1984 as well.
Microsoft already has a “Windows of smartphones” called Windows Mobile. :-P *ducking*
Well, the “nursemaid approach” is a feature of technological advancement: we no longer have to manually set the spark advance or the choke on our cars, for example. “Just adding a line to a saned.conf file” is easy for geeks (and I’m enough of one to do that), but that’s not appropriate for a mass market product. Example: How to take a screenshot. I’d say that’s a quantitative example of “overall design†and “better user experience†and “hardware/software integration.”
Yeah, but, like I said, there’s no equivalent at all in out-of-the-box Windows or OS X.
Your example no longer applies. There is a screenshot app for free in the Android Marketplace and I think the EVO 4G has it pre-installed (not 100% sure on the latter).
Though I’ve only used it a little, Terminal comes with OS X. It’s quite powerful and might well do the equivalent, though I’m not enough of a geek to say for sure.
. It’s significantly behind in features (mobile-Wifi-hotspot, voice recognition, and Flash support are the big ones)
The mobile hotspot thing doesn’t matter to most people, since tethering is all they need. Apple’s voice recognition actually works, which is more than I can say for any android device I’ve tried (it seems like they’re falling down on quality control of their microphones), and Flash is a bug, not a feature.
and behind in new-unit sales.
Only temporarily, due to the anticipation of the next iPhone, which is now breaking Apple’s own previous sales records.