I was one of those people who never intended to purchase an iPhone before Apple released its putative second version. Yet, I somehow found myself sitting on an airplane home from San Francisco with a new iPhone in my pocket. It may have been the last day of Macworld Expo; to be honest, things are a little fuzzy. The iPhone has quickly become both an indispensable tool and my favorite toy. And like any security geek, I've spent a fair bit of time digging through all the options and making sure the iPhone is as safe as it is a pleasure to use. We don't spend a lot of time thinking about the security of the phones in our pockets, mostly because the odds of losing or breaking it are far higher than someone hacking it. One thing I realized quickly when using my iPhone is that I need to think of it more as a cross between a computer and a phone. We iPhone users check email and browse the Web on our iPhones as much as on our Macs, but there's one key difference: the iPhone is always in a pocket and always on the network. While there isn't a lot you need to do from a security standpoint, I do have a few recommendations that stem from how we use iPhones differently than other devices. Set a Passcode -- The first thing that I recommend you do is set an access passcode in case you lose your phone. Your iPhone becomes inaccessible when it's locked down (at an interval you set) until you enter the passcode. Corporations often require passcode protection for smartphones that they require employees to carry, but it's not something we think about for our consumer phones. Since the iPhone contains all your email accounts, all your contacts, and possibly access to private Web sites that control access via cookies, you have more to lose than with a standard phone. If you find that entering the passcode over and over again is too much trouble, think carefully about the data that you've stored on your iPhone, so you can minimize damage in the event that your iPhone is lost or stolen. For example, be prepared to immediately change all your passwords for email accounts you read on the iPhone. You can set the passcode from Settings > General > Passcode Lock. Don't forget the code you set, or you'll have to reset your phone in iTunes to regain access. I keep my iPhone set to lock itself automatically every 15 minutes since I'm paranoid (as a security writer, I'm a bit more of a target than most people), but most people will be fine with a 1-hour lock. Don't Remember Open, Unencrypted Wi-Fi Networks -- One nice feature of the iPhone is that it can remember the settings for every Wi-Fi network you connect to, and automatically reconnect to these networks in the future. Have it memorize your home and office network names (the SSIDs) and passwords, and you're automatically connected when you move between home and work, using AT&Ts (slow) EDGE network when you're out and about. The problem is that a lot of networks use the same network name, like "linksys" (for Linksys wireless access points), "tsunami" (for Cisco), or "default". Your phone can't tell the difference between different open, unencrypted networks that use the same name, even though Wi-Fi access points also broadcast a unique embedded number. All a bad guy has to do is set up an open access point with a common name and start collecting the network traffic of anyone passing by. If you live in a rural or suburban area, this probably isn't much of a concern, but if you spend time in urban areas, airports, or conference centers it's a small, but real, risk. If any of that traffic is unencrypted and sensitive, say an email password, the bad guy (or, more likely, curious teenager) can capture it. I wrote more about these risks on my blog, and the solution is simple. On your iPhone, go into Settings > Wi-Fi and set the slider for "Ask to Join Networks" on. For those times you need to connect on an open network, just make sure you "forget" it from the iPhone interface (again, in Settings > Wi-Fi) when you're done. For networks that you control, like your home network, just make sure to at least enable wireless encryption (preferably WPA). A unique name is also a good idea: with WPA and WPA2, the network name is used as part of the encryption process, and changing the name from its default setting improves your security there, too. (Apple names its base stations with part of the unique network address by default, like "AirPort Network 00b33f", you'll likely want to change that anyway!) Your phone won't connect to a network with the same name (should you run across one) unless both the network ID and password match. And if you use Apple's AirPort base stations (Extreme or Express), AirPort Utility makes every effort to keep you from setting up an unencrypted network, and even marks an open network as a configuration error. Use a VPN -- With an ever-increasing number of hotspots offering free Wi-Fi, such as at all Starbucks stores as AT&T takes over their hotspot network, it's likely that we iPhone owners will find ourselves connecting to more open Wi-Fi networks in the future to take advantage of free, high speed bandwidth. Any open Wi-Fi network is a risk, free or not, but I for one have always been turned off by overpriced wireless and use free options much more frequently. As we expand out use of free networks, it's also more likely we'll eventually wander into an open network with a name we've remembered, probably near a college, where someone decides to sniff the traffic. The good news, yet again, is that Apple includes a virtual private network (VPN) client on the iPhone. Virtual private networks are encrypted tunnels between you and a gateway, but by default, they only encrypt traffic destined for that network. If you connect to a VPN to check your email, only that email traffic is encrypted unless you tell your iPhone to "Send all traffic" to the remote network. This is also, conveniently, an option in the VPN settings on your iPhone. Setting up a VPN is beyond the scope of this article (see Glenn Fleishman's "Secure Your iPhone Connections at Macworld Expo - and Beyond," 2008-01-09, for more details), but if you use the PPTP option, be sure you set the encryption level to "Maximum" to prevent bad guys from sniffing your VPN password. The biggest problem with the iPhone's VPN is that it doesn't engage automatically. If you wander in and out of a Wi-Fi network's coverage, and the iPhone switches to EDGE and back, you'll lose your Internet connection (if the VPN connection tries to remain active) or your VPN protection (if it does not). Here's hoping Apple fixes that in the iPhone 2.0 software. Relax and Enjoy -- That's about all you need to do to secure your iPhone, and as I said, keeping an iPhone safe is more about not leaving it in a cab or knocking it onto a hard floor than encrypting every bit of data in and out. Most of you will never have to worry about network sniffing or advanced attacks, but a few extra, simple precautions never hurt. Especially those of you wandering around college campuses or technology conferences.  Copyright © 2008 Rich Mogull. TidBITS is copyright © 2008 TidBITS Publishing Inc. If you're reading this article on a Web site other than TidBITS.com, please let us know, because if it was republished without attribution, by a commercial site, or in modified form, it violates our Creative Commons License. VMware Fusion. The most seamless way to run Windows on your Mac. Backed by nearly a decade of proven virtualization technology. Try VMware Fusion today for free, or order online for only $79. Visit:  

	Read more at TidBITS
	db.tidbits.com/article/9614?rss