Republic Wireless

[Lemur]

[Y]ou don't actually own the infrastructure you rely on and therefore you are rather dependent on the prevailing attitude among those who do.

Sorta true but sorta not-true; I don't "own" every element of my wireless connection at home, but I do control it. Likewise, the IT department at work is not "owned" by me, but I can negotiate with them.

I don't know that ownership is the right word; let's try "access."

[Tellos Athenaios]

Sorta true but sorta not-true; I don't "own" every element of my wireless connection at home, but I do control it. Likewise, the IT department at work is not "owned" by me, but I can negotiate with them.

I don't know that ownership is the right word; let's try "access."

No, I'm talking about the company. AT & T, Verizon, Sprint, T-Mobile et al own a chunk of infrastructure and have roaming agreements with others. So they know their costs and have contracts to cover the rest. So they have some form of long term security.

RW relies/abuses the goodwill of people running Wifi hotspots to keep its costs down (cost of Wifi is a lot less than the cost of buying capacity from telco). So if a lot/too many of Wifi hotspot owners/operators no longer fancy being RW's provider of cheap bandwidth and decide that either they want some of the pie or that RW isn't welcome on their networks... RW is up a creek without a paddle. Their plan only works if they can offload enough stuff on Wifi to cut costs and recover losses made on stuff delivered over traditional telco networks.

[Xiahou]

Also, aren't there some inherit security concerns with your phone latching onto any available open wifi network for making calls / transactions?

But I agree that their business model seems to depend on being able to leech other people's bandwidth. That doesn't sound like something I'd want to hitch my wagon to. I like the price and lack of contracts though.

[Tellos Athenaios]

Also, aren't there some inherit security concerns with your phone latching onto any available open wifi network for making calls / transactions?

If they don't encrypt the data, there would be. But this is a well understood technical issue and easily mitigated by running a VPN tunnel. It would be rather shocking if RW were so incompetent to not know that.

[Xiahou]

If they don't encrypt the data, there would be. But this is a well understood technical issue and easily mitigated by running a VPN tunnel. It would be rather shocking if RW were so incompetent to not know that.

It goes without saying that they'd encrypt their traffic somehow, but it still seems that connecting to any random AP leaves the door open to trouble more than being connected to a network of known cell towers. If the phone doesn't care how it connects to the network, I'd have to think it'd be more susceptible to spoofing or man in the middle type attacks. Additionally I'd think that (deliberately?) misconfigured APs could also cause trouble.

I can't claim to be a security expert, but depending on free/open wifi networks just doesn't sound like a practical (or wise) business model.

[Tellos Athenaios]

It goes without saying that they'd encrypt their traffic somehow, but it still seems that connecting to any random AP leaves the door open to trouble more than being connected to a network of known cell towers. If the phone doesn't care how it connects to the network, I'd have to think it'd be more susceptible to spoofing or man in the middle type attacks. Additionally I'd think that (deliberately?) misconfigured APs could also cause trouble.

That's not how GSM and derivative connections work, though. The hardware has to scan for available towers -- and latch on to a network. The security provided by GSM is actually optional (phones might warn about this), and even then the A5 algorithm cannot be considered secure against a determined adversary: http://en.wikipedia.org/wiki/A5/1

[Xiahou]

That's not how GSM and derivative connections work, though. The hardware has to scan for available towers -- and latch on to a network. The security provided by GSM is actually optional (phones might warn about this), and even then the A5 algorithm cannot be considered secure against a determined adversary: http://en.wikipedia.org/wiki/A5/1

I was thinking of CDMA with its PRLs. I forget that much of Europe is still using such backwards technology.
Indeed, GSM towers have already been spoofed. Comparing Republic to GSM users, I guess it's hard to get too worried on the security front. But you still have the whole notion of being dependent on wifi freeloading for the venture to be a success.