Apple explains iPhone OS 3.1 Exchange changes
iPhone and iPhone 3G users hit a roadblock last week trying to login to Exchange 2007 servers after upgrading to iPhone OS 3.1.
(Credit:
Apple)
Because the problems began with the latest update, it may seem reasonable to assume that the update is to blame, but it's not. In fact, everything is working exactly how it's supposed to be, according to Apple.
"iPhone OS 3.1 is working properly with Exchange Server 2007," Apple representative Natalie Harrison told CNET News. "We added device encryption information to the data that can be managed by IT administrators using Exchange Server 2007. The policy of whether to support iPhone 3G, in addition to iPhone 3GS, which always has on-device encryption, on Exchange Server 2007 is set by the administrator and can be changed at any time."
What this means is that iPhone OS 3.1 now properly identifies itself to Exchange 2007 as having hardware encryption, and that's what is causing the problems for iPhone and iPhone 3G users.
iPhone OS 3.0 did not identify itself properly to Exchange 2007 on any iPhone. This means that if you had a 3G and Exchange 2007 was configured to require hardware encryption, you could still login, even though the device does not have hardware encryption.
With iPhone OS 3.1, all iPhones identify themselves properly to the server, essentially fixing a glitch in the previous operating system. However, now iPhone and iPhone 3G users that upgraded to iPhone OS 3.1 cannot login to Exchange 2007 servers that require hardware encryption.
If you use the new iPhone 3GS, you won't notice any change. Apple's newest phone is equipped with hardware encryption, so it will meet the requirements of the Exchange server when identifying itself.
If you already upgraded to iPhone OS 3.1 on an iPhone or iPhone 3G and connect to an Exchange 2007 server, you can ask that the IT admin turn off the hardware encryption requirement for those devices.
Company IT administrators who require hardware encryption to access Exchange 2007 will need to decide whether they want older iPhones to access their servers. If so, they will need to configure Exchange to not require encryption from the iPhone and iPhone 3G.
Of course, if you haven't upgraded your iPhone, it will continue to access Exchange 2007 as it always did.
Jim Dalrymple has followed Apple and the Mac industry for the last 15 years, first as part of MacCentral and then in various positions at Macworld. Jim also writes about the professional audio market, examining the best ways to record music using a Macintosh. He is a member of the CNET Blog Network and is not an employee of CNET. He currently runs The Loop. You can follow him on Twitter @jdalrymple. 
But again, easy to deal with on the back end.
I had to do it to my 3GS because a phone call cam in during a sync. Somehow, this screwed the pooch wit the file system.
I lost all my bookmarks, all my application settings, everything. I had to rearrange over a hundred icons using the lousy iPhone user interface.
iTunes 9.0 has a means to rearrange the icons using your computer. But in order to do so, you first have to let iTunes move (and misplace) ALL of your icons to one of Apple's 3 pre-set arrangements. No thanks.
Worst of all, unless you allow iTunes to rearrange all of your icons, you can never again use iTunes to sync apps from your computer to your phone.
So far, I've found the iTunes/iPhone software to be horrible. How did Apple get a reputation for making good software? Is it just the pretty animations, hypnotizing amateur computer users
"How did Apple get a reputation for making good software?"
They have a good reputation for making a good OS. The software including QuickTime and iTunes, is widely ridiculted and despised across the industry.
"Worst of all, unless you allow iTunes to rearrange all of your icons, you can never again use iTunes to sync apps from your computer to your phone."
I know a psychologist I can refer you to.
Getting IT admins to configure exchange to turn off encryption for these devices.. I am laughing my *ss off... Its the same kind of attitude that has got apple such a bad repute with most enterprises.
Keep it up apple..you are doing what you do best ... i.e stink
Make no mistake, this isn't a ploy to encourage another round of device upgrades. Apple looks bad to both the users that can't access exchange and also the business who they are suggesting should lower the bar on their security.
Not sure why you need to be such a fanboy about it though, you already had an insightful enough comment.
3.1 fixed it by turning if off, or stating correctly that it is not using encryption, so now if you are requiring that on your Exchange server then it wont work with an iPhone.
Exchange 2007 encryption is hardly ever used so this is basically a non issue for most. The SSL tunnel is still there, encrypting the connection and the dat will pass through that tunnel. What this option does is encrypt the data inside the already encrypted tunnel. Double encryption. This was added by MS in 2007 to compete with RIM, as RIM has always done this on the Black Berry and that is why the government uses Black Berry.
Signed,
-The IT guy who has to troubleshoot all the email glitches.
All phones before WinMo 6 have the same security issue and even the Pre can't handle this feature. It's really not as big a deal as all the hype would have you believe. Apple really hasn't touted full exchange support till OS 3.0.
This response from Apple is just disengenous. They should have been forcoming with users and apologized. The better solution would have been to offer software based device encryption. Leave it to the user to decide if any slowdown on the device is worth it in order to be able to sync with Exchange 2007.
Bad Apple. Bad.
If its not iphone's problem then surely its exchange's problem...... ho wait may its again AT&T's fault..
Iphone was advertised and sold as compatible with Exchange then how and with this update its no more so. All those people who bought with piece of junk were totally ripped of. And the only solution that apple has that IT admins should turn off device encryption for the device.. Is this even realistic !!!!!
The iPhones which were sold as being compatible with Exchange (the 3Gs) aren't having problems. Earlier models did receive a free upgrade of the OS which included this capability, but that didn't automatically give those older models built in hardware encryption like the 3Gs model has. Further, technically, being compatible with Exchange and supporting device encryption are two different things.
"All those people who bought with piece of junk were totally ripped of."
No, there weren't ripped off as this was not an advertised feature when the older devices were sold. Further, the iPhone is hardly a piece of junk.
"And the only solution that apple has that IT admins should turn off device encryption for the device.. Is this even realistic !!!!!"
No, it's likely not very realistic. Then again, companies aren't going out to purchase old phones to use with their Exchange servers. Apple clearly spells all of this out in their Enterprise deployment guidelines. Nobody bought an iPhone under false pretenses. There is no good solution for the older iPhones as they don't have built in hardware encryption. Older models didn't have remote wipe either. Only the 3Gs model is billed as enterprise ready and rightfully so.
This feature, that is hardly ever used on Exchange 2007 and not even supported on previous versions of Exchange, was clearly stated as not doable on the iPhone. In FACT only Windows mobile 6.1 can support it, so 5.0 and 6.0 cant use it either. Its NOT turned on by default on Exchange 2007 when its installed. They standard SSL requirements are still in place, encrypting the tunnel.
"This feature, that is hardly ever used on Exchange 2007 " ... ***
Did you know that HIPAA mandates encryption of all emails (including transmission/cached). So all those executives/employees at insurance companies using this damn phone were just putting their org's compliance at risk. I am sure you will feel great when an iphone containing all your health records is lost/stolen and hackers can simply get all that info by simply jailbreaking the phone.
This issue is a perfect example of customer deception. Iphone 3g was sold as an exchange compatible device and this update simply proves that apple was lying for all this time. PERIOD.
"iPhone OS 3.1 is working properly with Exchange Server 2007," Apple representative Natalie Harrison told CNET News. "We added device encryption information to the data that can be managed by IT administrators using Exchange Server 2007. The policy of whether to support iPhone 3G, in addition to iPhone 3GS, which always has on-device encryption, on Exchange Server 2007 is set by the administrator and can be changed at any time."
The sales and market share tell the true pic. Apple is a child's toy. Spend 1200.00 on a notebook that is 4 years behind the latest PC and it lasts approx. 3 years. JUNK. [CNET editors' note: Personal attack deleted.]
Cry me a river, Apple implemented a security fix on the iPhone. Time to bash!
Where do you want to go today? Down, down, down.
Where they belong.
Good to see you trolling here. Well until they ban you anyway.
This is a lot of FUD from the Softie fanboys, as usual. The more Apple grows, the more FUD we see. I think it's quite entertaining.
Do you realize that iphone caches your mail bodies so that you can view frequently views mails without any latency. So even though the mail might be safely encrypted on the server end it can be still accessible to any eavesdropper who happens to have physical access to your phone.
For the 10 Failed Attempts Data Wipe BS... is it a default settings for the phone.. the answer is NO... Also even though you have configured your phone for this, it will be still possible for hacker to jail broke you phone to access all the data residing on it.
Dream on fan boy.. dream on
iPhone 3.1 breaks some iPhones' snycing because it was NOT suppose to work in the first place.
This kind of behavior will only hurt Apple.
I'm an Apple supporter, you are missing my point.
1) iPhones 3G (and ealier?) said they had hardware encryption but didn't.
2) Exchange 2007 (and later?) accepted the statement blindly but did not in fact encrypt anything.
Note the email traffic is still encrypted by the SSL tunnel so the h/w encryption we are discussing is in addition to the transport encryption so I don't think HIPPA regulations and the like are compromised.
Seems there are two bugs here. If the phone says I do h/w encryption then Exchange sends encrypted messages the phone should not work. It must be the case that the phone says 'I can encrypt' and Exchange says 'Ok but I won't bother' If the phone worked before it should work now. It is a totally bizarre scenario that the moment Exchange is told the phone can't do h/w encryption it starts to encrypt.
I think we need more information.
In the past iphone was lying to the server that it was encrypting even though it wasn't really doing that. So all that data was laying on the phone in clear text waiting to be compromised. This update stops iphone from lying to the exchange server hence the issue.
And regarding HIPPA please dont talk through ars From the HIPPA security doc "Require that all portable or remote devices that store EPHI employ encryption technologies of the appropriate strength;" more at http://www.cms.hhs.gov/SecurityStandard/Downloads/SecurityGuidanceforRemoteUseFinal122806rev.pdf
This means that i can sue my health cover provider who happens to use iphone < 3GS in their networks.
We are talking about MS Exchange.
That's Microsoft.
How could it possibly be Apple's fault?
Please stop. Steve Jobs returning to announce ringtones is the most amazing remarkable really good thing ever.
But I think it is more than that. The second way to connect is simply to setup an account on the iPhone to use your OWA server, works fine and sync perfectly, yes encrypted via SSL.
But the real deal is this you dont need the extra $15 a month for enterprise services from AT&T to use OWA, but you do if it is a direct connect or push from Exchange.
This is not a security bug, the channel has been encrypted all along.
So is this really an issue or a play to get more revenue?
By the way 50% of the MAC's we purchased last year are having major failures, hardware failures, over 50% ...yeh that great, dont expect to get any help from Apple, we have been trying for 6 months on some of these issues.
1Gremlin
- by jcoliton1 September 21, 2009 9:46 AM PDT
- So - my server guys say that I have to go BACK to 3.0 OS - anybody know how to install an old version of the OS? (That will teach me to try and stay current!)
- Like this Reply to this comment
-
(47 Comments)