Receive new posts as email.
This site operates as an independent editorial operation. Advertising, sponsorships, and other non-editorial materials represent the opinions and messages of their respective origins, and not of the site operator. Part of the FM Tech advertising network.
Entire site and all contents except otherwise noted © Copyright 2001-2010 by Glenn Fleishman. Some images ©2006 Jupiterimages Corporation. All rights reserved. Please contact us for reprint rights. Linking is, of course, free and encouraged.
It's a big Wi-Fi news day before I head off to Maine til next Thursday; expect more news on my return (but not about Maine).
Software pioneer Dan Bricklan on 802.11b: good to see what an intelligent guy who has been kicking around since developing VisiCalc has to say about the Next Big Thing.
First look at 802.11a: the folks at 802.11 Planet (more on them below) get a first look at the Atheros 802.11a chipset in action. Sounds promising. The short of it: higher bandwidth with better algorithms and many stepdown speeds produce more throughput than 802.11b at similar distances indoors.
Get rugged: integrated 802.11b in a serious laptop meant for being bashed, used outdoors, and otherwise beat up.
Wireless issues abound at Intel Forum: security, compatibility, co-existence
Remember the 802.11 Planet conference in early October!: yours truly will be there serving on one panel and moderating another. The conference looks truly interesting for businesses and ISPs, as well as those journalists and technologists who want to be on top of the latest news.
Apple chooses odd moment to upgrade AirPort cards to 128-bit WEP encryption keys: Apple's AirPort card - a kind of PC Card that fits in a special slot in all shipping Macintoshes - used to support just 40-bit WEP keys. The new version supports 128-bit keys for compatibility, but there is no word, according to the MacCentral article, on whether existing cards can be flash upgraded or whether the Apple AirPort Base Station (access point) will be similarly upgraded. Oddly, the 128-bit key is no more secure now than the 40/56/64-bit key, so the timing is strange.
WayPort buys Laptop Lanes and will add 802.11b to several airports: the first real public salvo in the battle of the airports. Although the reach of for-fee public Wi-Fi networks have been growing over the last year, most notably with MobileStar's expansion to hundreds of Starbucks outlets, airport terminal coverage has been highly restricted, often found behind closed doors in red carpet or executive clubs.
The parent company of Laptop Lanes, SoftNet Systems, bought that firm in 2000 as part of its attempt to expand into a national brand. They also founded AerZone, which was focusing on partnerships with airlines to quickly roll out service in airports. They had signed contracts with United and Delta to equip all of their gates and lounges, and a contract with San Francisco International Airport (SFO) to roll service out there. Laptop Lanes was to be renamed AerZone Business Center, or something similar.
Abruptly, however, AerZone gave up the ghost in mid-December 2000, after under a year of development (with no operations). I had interviewed their CMO on a Thursday; the next Monday, the outside PR firm called to tell me operations had ceased (apparently to the surprise of the CMO). SoftNet had absorbed the reality of the costs of deployment in a tightening economy, and pulled back. It also started advertising for a buyer for Laptop Lanes.
AerZone has proved a cautionary tale for other wireless ISPs, who have only gradually moved into airports. WayPort's acquisition of Laptop Lanes gives them point sources to equip rather than requiring a complete terminal coverage, which the company offers at only a few airports, such as - erratically - at Seattle-Tacoma International Airport (SeaTac).
The lessons learned from AerZone are several. Cost is certainly one, as building complete coverage - which some airports' operators have required - requires both wired and wireless infrastructure. One provider (now pulling out of the public market itself) said that it could cost $2 million to equip an average metropolitan airport.
Word also circulates among the companies and individuals I speak to regularly that some airports are demanding large fees simply for entry, plus significant portions of the proceeds. (MobileStar charges an extra $1 per 24-hour-period in an airport even when using its unlimited minutes service.)
Another factor is competition: some airports are still bidding offers, and others have limited deployment until they can decide on policies for overlap. The ownership of the airwaves in airports is not exactly up for debate, but there are multiple stakeholders confusing issues further: can an airline offer "private" Wi-Fi in its red carpet club and at its gates, while the airport authorizes other services for the entire airport?
There's definitely a technology issue, too: if you aim for complete coverage with competition, you have a limited number of potential overlapping channels to avoid reducing bandwidth for everyone. (Wi-Fi has 11 available channels in the U.S., but they overlap. You can operate three access points on three distinct, nonoverlapping channels, but if you have two services trying to overlap coverage - you get the point. You run out of channels, and you require complete coordination between competitors.)
Although at first blush, it seems a no-brainer to do the airports first and let cities follow, wireless ISPs seem doomed to follow in Metricom's halting footsteps. The airports need to be fully available and reliable at any reasonable price; hook the customer there, and they take the service home with them, and demand it there.
[Current publicly known coverage: Seattle's SeaTac, Dallas/Ft. Worth, Austin, and San Jose have more or less complete coverage, with MobileStar in American Airlines lounges in all major cities, and Global Digital Media (still?) hitting Boston and Philadelphia.]
Forbes discusses a Sony Bluetooth-enabled digital camcorder: but my question is, why would Sony put Bluetooth in a digital camcorder to send short video clips when Bluetooth is limited to 1 Mbps? The device is called the Network Handycam IP, which is even funnier, given that Bluetooth is an ad hoc protocol, not a true networking system, and doesn't actually support IP (Internet Protocol) networking.
Palm backs Bluetooth, but is it the right plan?: Palm is betting on the wrong horse when it comes to exchanging data, as a combination of speed and flexibility needed to turn the Palm into a real computing device aren't available under Bluetooth. When I tested the Xircom wireless adapter for Handspring, I was stunned at how the Handspring changed instantly from useful PDA into a window on the Internet. [link, as is often the case, via Tomalak's Realm]
Slashdot weighs in on the "parasitic grid": here's a good firestorm, if I've ever seen one, about Ephraim Schwartz's article in InfoWorld in which he employs the term "parasitic grid" to refer to free wireless networks. There are plusses and minuses to the term, as I discussed yesterday. Opportunitistic networking would be more accurate.
Two sensible articles predicting reasonable futures: one, from eWeek, on 802.11a's increasing traction; the other, from Internet Week, on the reasoned reaction to WEP's weakness. The former article also mentions an increasing availability of 802.11b-based phones.
Bridging wired networks with two Linksys WAP11s for under $400: my piece for O'Reilly Networks's Wireless DevCenter on the nitty-gritty of using the bridging software that come with these sub-$200 devices to link wired Ethernets.
Parasitic grid or free wireless networking?: the author of this piece pushes a term for free wireless networking I haven't heard from anyone ever: parasitic grid. Read responses of the folks on the Bay Area Wireless User Group's (BAWUG) mailing list to this term: , , and .
The term parasitic grid or parasitic network appears to originate from a single British Telecomm (BT) researcher named Peter Cochrane. He wrote two interesting papers with great foresight: one from 1999 on the general idea, and another with more contemporary references in 2000.
The notion of parasite here is really more of opportunism: rather than have to configure devices, we simply walk around and they plug in wherever and whenever they can. This is kind of the idea behind 3G cellular, in which ubiquitous relatively decent bandwidth is available whether travelling in a car at 65 mph, walking down a street, or in an office.
As I've commented in this space before, however, most of the time, people are in dense areas that can easily be served by current and soon-to-be-released flavors of 802.11.
My initial take was that the author of the InfoWorld piece linked above was trying to coin a phrase through introduction. After some email back and forth with him, I'm more convinced he doesn't view the phrase as a negative. I had seen it originally as pejorative term. (One of Schwartz's source emailed me to say that Schwartz had tried the phrase out on him, but he didn't agree with it as a good description of free wireless networking.)
But if you look at it as a purely technical description, parasitic's not half wrong. I'd definitely push opportunistic or vernacular networks instead, which eliminate most or all of the negative valence, while still painting the picture. The idea of walking around with devices that connect whenever and wherever they can is a powerful one, even more powerful than ubiquitous computing, which requires even more commercial infrastructure.
Thanks to Lawrence Lee (of Tomalak's Realm) for the original story link and the links to the BT researcher.
802.11a won't suffer from shorter distances, has plenty of advantages: keep in mind this article was written by a company making 802.11a equipment. In indoor environments, the author claims that there's little difference in range.
802.11a chipsets to ship in a few weeks and cost just $35 in quantity: if you need 100,000 or more, this is competitive with 802.11b.
Cell telcos look to 802.11b: feeling the hot breath down their necks?
Red Herring pooh-poohs free wireless, sees 3G convergence: this piece is off base, dismissing coordinated efforts of volunteers as pointless. We'll see; it's how a lot of things on the Internet work, and it's applicable to real infrastructure, too.
AirSnort's impact: AirSnort is a simple program that extracts WEP encryption keys using the weaknesses in the algorithm discussed recently.
New York Times shrugs: I sent a list of corrections about today's Bluetooth article (free reg. required) which I noted in yesterday's blog. The response from some editors there was that WECA told the NY Times reporter that 802.11b ad hoc networking isn't used much, and that WECA doesn't certify. Because the reporter didn't speak to IEEE, an important aspect of the story was lost.
In fact, 802.11b ad hoc networking - networking between computers that doesn't require an access point in hardware or software to relay traffic - is a powerful agent towards supplanting Bluetooth functions. Many compact devices that will run 802.11b might need to employ its ad hoc mode to avoid infrastructure demands. This is the raison d'etre of Bluetooth itself.
My other notes about accuracy of description were brushed off as well.
The New York Times on 802.11b security issues (free registration required): an excellent and clear summary with good anecdotes about the state of corporate understanding of wireless network security
The New York Times on Bluetooth's prospects (free registration required): not good, but Bluetooth may still survive. The article makes good sense of the finances, support, and business climate, but features some howlers and odd phrasings.
Consider this odd statement: "...radio waves can travel through walls and in many directions at once, up to about 30 feet." Specifically, at the power limits and with antennas in Bluetooth's minimum specifications. More accurately, it would read, "Bluetooth's radio signal spreads in all directions from each device's built-in antenna, reaching a specification-mandated minimum of 30 feet indoors through walls and other obstructions."
Another error in the piece misstakenly underrates Wi-Fi: "instead of linking devices through an ad hoc connection of radio waves like Bluetooth, Wi-Fi connects devices directly to an established Internet network." The writer (or more likely, editor and copy editor) seem to impute a magic meaning to radio waves. Wi-Fi can, obviously, connect ad hoc networks (such as one being built for Burning Man) both in the formal sense of the word - there's part of the 802.11b spec applying to a technically ad hoc network - as well as the looser sense of a bunch of devices. Wi-Fi doesn't have to be connected to the Internet; it doesn't even have to run TCP/IP. Wi-Fi is Ethernet, wirelessly.
Yet another odd locution: "Users of the unlicensed spectrum do not have to pay telecommunications carriers for air time..." That's not quite right. I realize this is trying to cast unlicensed spectrum in terms of licensed chunks, but it implies that telecomm companies somehow own the airwaves.
This program breaks the WEP encryption and delivers the key: I have mixed feelings about posting a link to this software, but it's necessary because it's widely available. Running this software against anyone's network except your own (or one that you have authorized, written permission to crack) could constitute illegal cracking in many jurisdictions worldwide. Simple ownership of this program might also be illegal in some countries.
Note that cracking WEP encryption is not covered by the DCMA, which has resulted in charges against people cracking Adobe eBook and Hollywood DVD encryption. Those schemes are copyright-protection methodologies that include encryption; WEP is a general-purpose encryption system which is not design specifically to protect copyrighted materials.
If your system admin doesn't believe that WEP is full of Swiss cheese, forward them the link and make sure they run the program.
None of the above constitutes legal advice; I am not a lawyer. Consult an attorney or barrister in your local venue before taking any action you're concerned about.
It takes over 300K to see a list of MobileStar locations: did they not understand at MobileStar that customers who want to view a list of locations are probably on dial-up? What's with putting their over-designed 226K Shockwave file on this, of all pages? What led them to a design team that chose this for a useful Web site? Too many sites, especially in this realm, are choosing message over meaning. Get it to us fast, simple, no frills. Do your marketing to people who have time for it. If I'm viewing a list of locations, I'm already about to be a customer.
NYCWireless, a free network, gets some Village Voice ink: oddly, I wrote about this for Village Voice's Seattle publication, the Seattle Weekly, from the standpoint of Seattle Wireless, our local free networking advocacy group.
What Mac owners need to know about WEP (in)security): my article in today's TidBITS on the issues of WEP encryption, and how Mac owners can manage to cope with it.
Bill Gurley dances on Bluetooth's grave, chortling: Gurley is a long-time analyst of Internet companies and technologies, and has always had a very straightforward, non-hype view of the future. This column addresses why Bluetooth is too far behind 802.11x to catch up, and why cable replacement technology is already outdated. (Last year, I had a number of manufacturers insist that Bluetooth would persist because 802.11b chipset costs would remain too high. Doesn't seem like that's a problem any more.)
MobileStar not keen on intra-U.S. roaming: MobileStar is seeking out wired ISPs as partners in the U.S., and wireless outside national boundaries, but is not keen on forging relationships that would extend beyond its Starbucks and related partnerships and hotspots.
Life after AirPort: a sophisticated network user upgrades to an SMC gateway: this brief but excellent account runs through many of the concerns and configuration issues of getting what you need out of an inexpensive access point. The writer also notes quite clearly that he uses SSH and SSL for all his network traffic, avoiding pitfalls with WEP.
After the recent revelations that makes WEP security paperthin, coupled with my own increased use of Wi-Fi in public spaces without any encryption, I determined to see how difficult it would be to enable SSL support in my mail server.
SSL would encrypt all communication between the mail client and mail server, rendering it impervious to cracking - or at least much much much more impervious than sending your mail password in clear text (which is what happens in an open wireless network or open Internet network).
I'm not really a Unix system administrator; I learned how to run a Unix box (originally SunOS 4.1.3 back in 1994) by default to start a Web company. Nonetheless, even though I cannot write C programming code, I can compile software and configure Linux boxes with relative ease. What follows isn't for the faint of heart, but hand it to your system admin, if it's too far beyond your interest.
I knew that both Eudora and Outlook had enabled client-side SSL support in recent versions. I knew that Exchange (which I don't use) and sendmail (which I do) had the server-side components.
SSL uses a relatively clever system to encrypt messages without huge cryptographic overhead. Using a third-party certificate authority to keep both parties in a transaction honest, the two parties in SSL first exchange a key encrypted using public-key encryption. The key they exchange is then used for subsequent data interchanges. This allows a strong encryption system to be initiated through a secure key transfer.
I had the latest version of sendmail, 8.11.5, and I found a wonderful and straightforward page on how to compile and configure sendmail with SSL support. This page told me which files I needed, how to install and configure them, and how to create my own mini-certificate authority (CA). This last step allows an installation to not have to buy a certificate from VeriSign, which is perfectly fine when you're working with your own customers, employees, or colleagues, so no trust issue is at stake that a third party needs to be involved with.
It turns out that the steps involved in getting sendmail configured are trivial. I then proceded to the mail retrieval side: qpopper from Qualcomm, a free and highly configurable POP server. Again, it turns out that this is a breeze, but not as well documented.
You compile qpopper (if you've followed all the recommendations of the sendmail compilation) like this:
This points to the OpenSSL libraries and binaries. Now do the make and make install. Make sure that your inetd.conf or xinetd configuration files point to this new /usr/local/sbin/qpopper file, or that you put qpopper in the expected place.
Now you need to change the invocation of qpopper in inetd.conf or xinetd configuration:
qpopper -s -f /etc/pop.options
Make a new file called pop.options in etc, and put these lines in it:
set tls-private-key-file='/etc/mail/certs/key.pem' set tls-server-cert-file='/etc/mail/certs/cert.pem' set tls-support=stls
Reload inetd or xinetd, depending on Unix/Linux version. You should now be all set.
Remarkably, it does work - but only for POP. An obvious difference of opinion between the major client developers (Outlook and Eudora) and the sendmail team have led to an incompatibility in current versions of all interacting products. Notes for the next sendmail release, 8.12, indicate that the software will offer a configuration switch to fix this problem (which requires the client to send certain kinds of certificate information which Eudora and Outlook don't).
To set up Eudora with POP - which is the more important of the two, given that POP would allow your passwords to be sniffed - I went into Eudora 5.1 for Macintosh, selected SSL from Settings, and changed SSL for POP to Required. I tried to connect, and my Mac wisely warned me that the certificate authority for my mailserver was unknown; I accepted this, saved it, make another request - and now I'm secured for retrieval.
Internet part of team that implemented Fluhrer, Mantin, and Shamir attack: what an excellent summer excursion, and a way to guarantee one's future tenure - in 8 years when he's got his undergrad and grad degree (via Tomalak's Realm)
New WEP attack implemented successfully: what was a theory just a few days ago is now a reality. The final nails have now been hammered firmly into the coffin of the 802.11b Wireless Equivalent Privacy (WEP) encryption system. Research. The authors of the above paper exploited the weaknesses noted in the Fluhrer, Mantin, and Shamir paper, which is to be presented the middle of this month.
The trick now is to find methods of encapsulating data inside secure encrypted channels that don't require a corporate infrastructure. Although SSH and SSL solutions abound, can the average business user without a company virtual private network (VPN) retrieve mail and conduct other personal or professional work with any degree of protection?
The 802.11b container turns out to be a fishbowl.
Read the paper that puts the kabosh on WEP security (in PDF form only): this is the paper to be presented in mid-August that describes how to quickly break the WEP encryption algorithm due to weaknesses in implementation and other choices.
802.11a to be much cheaper than originally anticipated: I'll have to eat my eat. I was expecting, like many in the industry, that 802.11a equipment would have a premium attached, costing at least double today's 802.11b equipment. Chipset maker Atheros expects OEMs (the actual manufacturers) to ship product by year's end. I had thought the combination of shorter distances (because of the higher frequency) coupled with higher prices would limit utility. However, with a low enough price and a slightly higher power output, we're talking one-to-one substitution. Hopefully this won't cool off 802.11b sales in the meantime. It's also important to recall that 802.11a uses the 5 GHz U-NII band which is essentially empty at the moment - especially compared to the crowded 2.4 GHz band that "b" operates in.
Meanwhile, 802.11b prices themselves plunge at the consumer level: a colleague, wanting to set up a Wi-Fi network at home, reported that Outpost.com and other vendors are listing a variety of Linksys equipment with large price drops and manufacturer's discounts. Amazon.com is running a free shipping special on shipments of $99 or more in electronics, so try these out: their basic PC card (PCMCIA) is under $85 with rebate. The WAP11 home gateway access point, which can be used to bridge wired networks using multiples of itself, is $185 with rebate. Their more full-featured home gateway, the EtherFast, which features a built-in 4-port switched 10/100 Mbps Ethernet hub, is just $205 with rebate.
Compact Flash 802.11b radio ships from D.Link: way ahead of schedule, we have a Compact Flash format 802.11b radio that appears to support the full spec. Equipment needs to be modified to take full advantage of this development. For instance, wouldn't you like a digital camera that could transmit photos (in real time or stored) via 802.11b back to a base station?
Starbucks Chairman Howard Schultz gets it: Schultz understands the combined importance of having wireless access for his customers and a wired national network connecting his outlets for supply-chain management. Whew. Now if he'd just tell his CEO (see yesterday). (Link via Tomalak's Realm.)
Schultz, too, seems afraid to say the name of the partner devoting tens of millions of dollars to building their network, MobileStar of Texas. In this interview above, he says in response to a question about the network, "We have been working on this for quite some time with Microsoft Corp. (www.microsoft.com) and Compaq Computer Corp. (www.compaq.com). The network, which will be based on 802.11b technology, could be very significant for us and for our customers." Is there something in the business relationship with MobileStar that I'm missing?
Wireless : in light of today's news stories (see below), I've added a permanent link to the rundown of security problems with 802.11b that first appeared here in mid-July. It's now updated to reflect the latest announcements, too.
Meanwhile, 802.11b security is dead: the paper will be presented in two weeks, but it's certainly to spell the end of WEP for any kind of reliable security. Now, to avoid overstating the case, most networks aren't going to be busted no matter how simple the cracking techniques are. With hundreds of thousands of networks currently available, and millions ultimately being built (from the size of a home to a college campus), the odds of an individual network being cracked is small. On the other hand, if you're running a law firm - or really any business with customer data - it's time to make sure you have industrial-quality VPN software installed between the access points and your firewall.
And, finally, some concrete evidence that corporate buyers are worried about all this stuff: consumers are pushing the growth of Wi-Fi revenue, but companies are still chary because of the above-mentioned security issues. The simple breaking of WEP that will be revealed will almost certainly cement that trend. But it should speed WEP's replacement. Of course, all existing devices may be out in the cold, unless they have enough space and computational power to support a firmware upgrade that would add a WEP replacement to their existing capabilities. Experience with "56K" modems would argue against that, requiring a vast equipment upgrade for installed operations. (More follow up from SF Gate.)
Dan Gillmor turns off his Wi-Fi: Dan, a well-regarded tech columnist who I find on target all the time, has chosen to stop using 802.11b due to the latest security development. He points out that we all need to consider our networks public from now on. (See my rundown of encryption options for more details.) Dan could keep using his card, but he'd have to opt for virtual private networking or SSH tunneling, which necessitates infrastructure changes - changes which should be made regardless of wireless network security, of course.
Starbucks chief unaware of nature, status, and importance of wireless network: in this financial interview, the CEO of Starbucks states of the MobileStar-partnered wireless network in their stores, "We have 500 equipped, but we haven't turned it on." Buddy, maybe your own partners and employees should tell you that it's on and MobileStar is charging?
MobileStar's own Web page lists 500 active stores - in their own words - and my own experience plus field reports confirms active, charging hot spots. Starbucks hasn't made their side of the announcement yet, which makes this a soft launch. But their partner is speaking out.
Meanwhile, Smith doesn't even mention MobileStar by name in ths interview. He cites partners as Microsoft, Compaq, "and others". That would be like saying that my cell service is provided by Motorola and others.
He also gives insight into his own lack of understanding of the primary purpose of having high-speed wireless Internet access by saying, "this will be a different experience than just Internet access." That's what they all say.
His description of what the service will be useful for suddenly shifts to what sounds like wireless cell phone use, not laptop or handheld: "I don't want to go into a lot of detail, but what will happen when a consumer comes into a store and has a wireless device is: a screen will come up that'll ask them if they want to make an order. They'll be able to order and pay for the drink. It will also provide them with things like: are you interested in a culture event, a sporting event, a movie across the road. So they'll be able to look at the entire entertainment scene, and probably buy their tickets eventually."
Has no one told this guy about Ticketmaster? Why would you order a drink via a computer when you're in the actual Starbucks? Why would you specifically buy tickets in a Starbucks location online rather than anywhere? In other countries, especially Europe as I understand it, the cell phone has become a proxy for a debit card: you can use the device in a variety of ways that simply show up on your bill. I can see ordering in person and hitting a button on the cell phone to pay, avoiding credit cards and cash entirely. (Another option is a infrared cash beam from a Palm OS device, but that's only a prototype.)
Perhaps this focus has to do with the revenue split. I've seen no reports nor gotten a clear indication from any of the players as to whether Starbucks will share revenue from MobileStar. It may be a revenue-neutral proposition for them, as MobileStar is wiring a national data network for Starbucks comprised of T1 lines. That cost, which both parties agree MobileStar is bearing, would easily run into tens of millions. That may leave MobileStar as the sole beneficiary of any revenue on that network.
Still, it's disturbing to see a CEO who cannot clearly articulate the purpose and benefit of the wireless network they're installing. It's at least threefold (and their VP of new technology has articulated this in the past): 1. it makes going to Starbucks for a travelling businessperson a destination, not an option; 2. it provides, finally, a live data network for Starbucks for their own corporate purposes; 3. it allows Starbucks to develop products for payment and interaction that rely on a high-speed network, including wireless device (cell phone) payment and stored-value cards.
Now, why can I say this more clearly than the guy who runs the company?
At 802.11 Planet, an updated and expanded version of my article on Starbucks/Mobilestar's continuing soft launch of their national network: Starbucks continues to keep quiet, but more and more hot spots are lit up providing an increasingly easy-to-find outlet in several major cities. Pricing still seems high, but the market will ultimately settle that.
Microsoft and Intel join WECA board: significant announcement, as Microsoft and Intel were starting to deploy and employ 802.11b without being involved in the industry trade group. Although the IEEE sets the standards, WECA (Wireless Ethernet Compatibility Alliance) runs the certification program and owns the trademark that allows vendors to declare their equipment fully intercompatible.