Featured Article: Podcast - Apple Weekly Report #135: Apple Lawsuits, Banned iPhone Ad, Green MacBook Ad
MobileMe Lacks SSL E-mail Encryption - Only Half the Story
by , 1:00 PM EDT, August 21st, 2008
Apple's MobileME service lacks Secure Sockets Layer (SSL) encryption for e-mail, and that could allow others to see the data that a MobileMe user sends, according to Computerworld on Wednesday. While true, that's only part of the story, and a calmer, more technical viewpoint has been provided by Tidbits.
Nancy Gohring at Computerworld cited a source at Macrumors who stated that the lack of SSL encryption is a deal breaker. The author went on to site several others who had an opinion about the issue:
"MobileMe is suppose to be Microsoft Exchange for the rest of us. But Microsoft Exchange does things in a secure manner," said another blogger writing under the name of James Katt. "As it is, if you run a business using your Mac, then you cannot use MobileMe because it transmits data insecurely."
Digger deeper into such issues, however, is always a good practice, and Rich Mogull at Tidbits on Wednesday provided deeper background and an enlightening technical perspective.
First, Mr. Mogul addressed the AppleInsider statement that SSL is unnecessary "based upon authenticated handling of JSON data exchanges between the self contained JavaScript client apps and Apple's cloud, rather than the SSL web page encryption used by HTTPS."
Mr. Mogull called that Star Trek technobabble and pointed out that that just means that there is authentication, and the password itself is encrypted.
The Tidbits article also pointed out that most e-mail is sent in the clear anyway, and MobileMe is no different. In addition, the other services are encrypted. [Getting into even deeper detail, the Tidbit's author found that there is a very subtle flaw in Apple's handling of certificates, due a domain name change. However, it would be hard to exploit.]
"When you set up your MobileMe email account, it defaults to a secure connection, and in testing iCal, I found both the push and manual synchronization process appears to use SSL." Mr. Mogull wrote. "Using a sniffer on my own system, I was unable to access the contents of any synchronizing calendar entries or email. iChat authentication is also secure, and MobileMe installs digital certificates to enable secure chats with other iChat users - unlike AOL Instant Messenger ..."
The author did contend that there would, in fact, be very little overhead if Apple were to more broadly utilize SSL, and he would prefer that, especially since users pay US$99/yr for the service. In the meantime, those who want to learn more about their MobileMe operations will find the Tidbits article much deeper and more informative than the less technical approach at other sites.
Observer Comments
Recent Headlines - Updated Saturday, November 29th, 2008
- Sat., 9:00 PM
- Podcast - Apple Weekly Report #135: Apple Lawsuits, Banned iPhone Ad, Green MacBook Ad
- Fri., 12:45 PM
- Podcast - Mac Geek Gab #178: Batch Permission Changes, Encrypting Follow-up, Re-Enabling AirPort, and GigE speeds
- Thu., 1:30 PM
- iPO Review - Scosche kickBACK iPhone case
- 7:00 AM
- Happy Thanksgiving from TMO!
- Wed., 6:00 PM
- TMO Appearances - Nancy Gravley Joins MacJury Gift Guide
- 5:15 PM
- TMO Visits The Bay, a Premium Apple Reseller in New Zealand
- 3:25 PM
- iPO Oh the Games You'll Play - iPhone: The Wii of Handheld Gaming Devices?
- 2:15 PM
- Sonnet Releases Simply Fast FireWire 800 to 400 Adapter
- 1:10 PM
- Mac Gaming News - Disney Plans 1st Annual PotC Online Thanksgiving Event
- 12:05 PM
- iPodObserver - UK Shuts Down iPhone 3G Ad
- 11:15 AM
- TMO Appearances - Jeff Gamet on MacJury Gift Guide
- 10:30 AM
- TMO Contest - TMO Announces Macworld Expo Pass Winners
- 9:50 AM
- PhotoCopy 1.1 Adds iPhoto Event Support
- 9:15 AM
- Acclivity Buys MYOB US
- 8:30 AM
- Review - Bento 2 Holiday Pack
- 7:50 AM
- Microsoft Offers Black Friday Office Discount
- 7:30 AM
- iPO Quick Tip - iPhone: Google Street View
The Mac Observer Reader Specials
- Download Typestyler, still the Ultimate Styling Tool for Internet, Print and Video Graphics. Works great in Classic with a Native OS X Version on the way. Free Tryout: www.typestyler.com
Seagate 1TB 7200.11 7200RPM/32MB Cache SATA Drive $112 Hitachi 320GB 7200RPM/16MB Cache 2.5" SATA Drive $96. Samsung 500GB 5400RPM/8MB Cache 2.5" SATA Drive $138. ATA-SATA Internal External Firewire Drives & More. Click to Maximize your Macs...
Mac observers can now play Party Poker for Mac as well as Mac casino games by going to MacPokerOnline.com.
RamJet Memory: Mac Pro FB-DIMMs: 2Gig kit $95, 4Gig Kit $179, 8Gig Kit $355! MacBook 2Gig Kit $78, 4Gig Kit $149! Click hereFor the latest Apple products use Ciao a comparison website to find laptops like MacBook Air. Then find the best prices on MP3 players and use our comparison tool to evaluate cell phones.
Laptop Hardware Provided by TechRestore - Overnight Mac & iPod Repairs.

