Page 2 of 2 FirstFirst 12
Results 21 to 29 of 29
  1. #21  
    Quote Originally Posted by Minsc View Post
    Blocking ports is great, but has nothing to do with encrypting the data stream which is what SSL gives you. While I guess it's nice that Palm is "fixing" this to allow non-SSL setups, I too don't understand why you would run Exchange without having SSL enabled. I mean, maybe if it's your own personal Exchange sever and you don't give a crap, then fine. But for a company..? eeeks.

    I know way too many people who use laptops and smartphones on public WiFi hotspots (unencrypted). Without SSL enabled, all their email traffic is wide open and readable.
    This isn't about anyone's security policies, it's about Palm supporting a protocol that's supposed to be supported. Plenty of folks access their other email accounts via non-SSL POP3, and Palm provided support for that. Why no lectures about how stupid it is to access your personal email without SSL?

    The fact is that Palm promised EAS support, and at no time did they specify that they would limit said support to those organizations following best security practices. And of course, they didn't specify that because it would have been stupid to do so. It's really not Palm's business to enforce security, and lectures about what's right and wrong in this context aren't terribly helpful. I mean, seriously, does anyone here REALLY need to be told that it's better to run with encryption than without it?

    I'm fully confident that Palm will resolve the SSL and non-SSL EAS issues, and I'm guessing they'll do so well within 30 days. And so, I'm not one of the folks yelling and screaming about the issue and threatening to return their Pre. But at the same time, I'm also not naive enough to think that my IT department is going to reconfigure our currently broken Exchange server to support me and my lone Pre, when the iPhones, BB's, and other devices connect just fine.
    Treo 600 > Treo 650 > HTC Mogul (*****!) > HTC Touch Pro (***** squared!) > PRE! > Epic
  2. #22  
    BTW, you can buy root certs from RapidSSL or PostiveSSL at namecheap.com for $9.95/yr. There really is no reason to not have a valid SSL cert loaded on your server, unless you are using dyndns or something to do the name translation. But even then there are workarounds.

    I just wish Palm would fix the core functionality so it works with all configs of exchange.
  3. #23  
    Quote Originally Posted by hparsons View Post
    You asked, so I'll answer. I won't go as far as to say "incompentent", but you are STILL running a risk. Over 80% of IT security breaches come from inside the company, not outside. If you are using EAS inside your firewall without using SSL, you are allowing anyone who has the knowledge to look at packets on your local network, and find login information.

    Exchange data that runs over the wire, any wire, should be encrypted.
    On the intranet I do run SSL, externally we block 443 and use OWA only. That is where my Pre picks up on the problem. RPC is disabled as well. Security risk? I think not.
    Palm History: Palm III>IIIc>CLIÉ NR70v>CLIÉ TG50>Tungsten C>Treo 650>Treo 700p>Centro>Pre!! 6/5/09
    Phone History: Way too long

    Sorry Timmy, SERO does not work with the Pre.
    If you have an iTouch click me.
  4. #24  
    I think the bigger issue is how the hell could they release this thing without this functionality? Oh, and how the heck did they MISS it during QA testing?
  5. hokap's Avatar
    Posts
    16 Posts
    Global Posts
    38 Global Posts
    #25  
    Quote Originally Posted by mikesm View Post
    60 days is unacceptable. It needs to be fixed by the end of the month or it's going back. I'll give it another try after it lands on AT&T.
    You guys are unbelievable! It took Apple/iphone almost a YEAR to get EAS right! You're going to **** and moan over 60 days (that will probably be sooner).

    Other than EAS I have almost no complaints about this AWESOME device. I would prefer the battery last a bit longer but I understand that's being worked on as well.

    It's unrealistic to expect Palm to have EVERY possible Exchange setup in mind on release. That said I'm very frustrated as well...but, I'll be patient and until then keep using my OWA login through the web browser. Not the exact setup I was hoping for, but effective.
  6. Minsc's Avatar
    Posts
    967 Posts
    Global Posts
    974 Global Posts
    #26  
    Quote Originally Posted by wynand32 View Post
    This isn't about anyone's security policies, it's about Palm supporting a protocol that's supposed to be supported. Plenty of folks access their other email accounts via non-SSL POP3, and Palm provided support for that. Why no lectures about how stupid it is to access your personal email without SSL?
    I'm not defending Palm's implementation of EAS so much as I'm questioning why any company would run their messaging service unencrypted. (especially externally, outside the firewall) Accessing your personal POP email unencrypted also isn't wise but that's just your personal email. We're talking about enterprise communication here, and most companies (and their customers, vendors, and stakeholders) probably wouldn't be thrilled to know that their corporate communication is traipsing around in clear text.

    I mean, seriously, does anyone here REALLY need to be told that it's better to run with encryption than without it?
    Well, given the number of people here who are apparently running without it then I'd say.... yes!

    If the only hangup you have with the Pre's EAS is the SSL thing, then my feeling is you should maybe consider turning on SSL and be done with it, rather than complain and wait for Palm to release a fix. I know, I know, that's crazy talk right?
    Last edited by Minsc; 06/11/2009 at 08:58 PM.
  7. sjjones's Avatar
    Posts
    757 Posts
    Global Posts
    789 Global Posts
    #27  
    Quote Originally Posted by lostshootingstar View Post
    This is somewhat of an ignorant post. You cleary don't understand the issue at hand here.

    The problem is that WebOS does not support any exchange server that requires a PIN and/or remote wipe. I don't think corporations are going to be handing out pres as a fleet device anytime soon either, but that doesn't mean I don't want to connect to MY exchange account.

    especially since the pre was advertised as EAS compatible, not "EAS compatible....as long as you have SSL, and no advanced security policies in place"

    The bottom line is that Palm really screwed the pooch here. They do not support the super low end EAS users (e.g., non SSL), nor do they support the higher end EAS users (PIN, remote wipe). If you're not in the middle, you're screwed.
    My co. requires this and mine works great but i dont have to enter any PIN anymore?

    Actually my favourite thing about the PRE, used to have to enter a pin constantly while using my Treo pro
  8. hokap's Avatar
    Posts
    16 Posts
    Global Posts
    38 Global Posts
    #28  
    Quote Originally Posted by joehp1 View Post
    Face it - the Pre was not ready to be released. It seems it is up to the good people on this forum to trouble shoot it for Palm.

    I am also getting tired of all the folks on here that will support Palm no matter what. You beat on those on the forum that do not like the Pre because they are having issues and are returning it. People use these phones for business and if they don't work, NO BUSINESS!

    I have been one of the strongest supporters of Palm - going back to the early days. Why can't you just admit that it was not ready!
    I've been WinMo as well as Blackberry for the last few years. I bailed on Palm after the 600 series Treos. That said, I completely disagree. I think the device is actually quite ready. I think it was a bad choice for Palm not to release it with the password/remote wipe options in place. There are MANY that have been able to access their EAS with no problems.

    I'm annoyed as well since my company requires the password and remote wipe. However, this device is way too good to return. I'll wait for the update. If it takes 60 days, so be it. I'm hoping it's out a bit sooner than that. The real point is that this phone does 90% of everything else fantastic!

    Be realistic people, it's been less than a week!
  9. #29  
    I work for a large firm and have basically made myself the guinea pig for the Pre. The telcomm guy that helped get me hooked up with the Pre hasn't even received his demo version from Sprint yet.

    I'm not sure how the whole thing works, but my World Edition BB (which I still haven't sent back yet) and every other BB in the firm is set up with autolock and remote wiping, but my Pre is hooked up to the server without any of that. The guy didn't even ask me about any of that when he sent me the settings to get hooked up to the Exchange server.

    I've set it up to autolock with a PIN on my own, but is this just a choice being made in IT, or is it actually not possible to connect to some of these servers based on their configuration?

    The local IT guys are constantly telling me about stuff they CAN'T do when the reality is they don't want to.
Page 2 of 2 FirstFirst 12

Posting Permissions