Assured: The Isode Blog

Tricast Mail

We've blogged before about how important it is that mobile device manufacturers take seriously the user interface of the email clients that they ship with their phones (as Apple have done) and how their failure to do this so far has helped make retrieving and sending email on a phone an unattractive proposition.

We came across the Tricast Mail email client recently and this blog post (and the video of the interface half-way down) makes the v2 version of the client look rather special. Can't wait to try it out.

Smartphone manufacturers neglect email at their peril

The Web Worker Daily blog reports on a survey from webcredible that suggests that 33% of mobile phone users feel that email is still the most needed mobile utility. The blog post goes on to suggest that this is one of the reasons that (in the US at least) the iPhone quickly attained the status of second best selling 'smartphone', after the BlackBerry.

Both RIM and Apple have, in their different ways, taken email seriously as an application. They have both done their best to provide for the user an email interface that works well on these small form factor devices and have reaped the rewards, something that many other manufacturers seem to have neglected to do.

But there's more to a good user experience than a nice interface. Ensuring that the appropriate standards are used would be another step in the right direction, so that the user does not suffer from the poor performance one would get implementing protocols designed for desktop operation on devices that have limited storage and relatively low bandwidth.

Smartphone device manufacturers who decide to combine a decent user interface with the appropriate open standards for handling and delivering email (such as the LEMONADE profile that we've talked about previously) still have a chance to stake out a commanding market position.

iPhone: significant security vulnerability

Along with many others, we speculated that the iPhone would support push email by use of IMAP IDLE (see the Isode white paper "IMAP IDLE: The best approach for 'push' email" for more details).

We've been tracing an iPhone, and it turns out that this is not the case. With IMAP servers other than Yahoo!, the iPhone works by polling (at user configured interval) and so you need to wait to see new messages. Use of IMAP (Internet Mail Access Protocol) by iPhone is very good approach, and we hope that Apple will add IMAP IDLE support in an iPhone software update.

With Yahoo!, the iPhone authenticates using a private protocol called XYMPKI, used in conjunction with IMAP.  Yahoo! do not provide a general IMAP service - they use IMAP only for iPhone access and although the iPhone supports TLS (Transport Layer Security), Yahoo! IMAP does not, which leads to a replay attack.

Anyone able to eavesdrop on the authentication exchange, such as when using any open (public or private) wi-fi service, can easily gain full access to the user's email account until the user changes their password. We would advise against using the Yahoo! service with an iPhone, because of this security risk.

XYMPKI provides Yahoo! IMAP with information on the phone, that enables an alert about new email to be sent by an out of band alert mechanism (which we speculate is SMS).

One of Isode's engineers, Dave Cridland, has posted a more detailed explanation of the vulnerability (which we have, of course, reported to Apple, Yahoo! and CERT) on his personal blog here and here.

This proprietary approach with a significant security vulnerability is bad.

Apple and Yahoo! should know better.

   Slashdot It!

Lemonade email client development

Whilst a great many email clients for small devices and mobile phones support IMAP-IDLE (a key part of the LEMONADE profile which enables a 'push email' experience) hard news about development of client packages which support other LEMONADE features are hard to come by, although rumours are numerous. This is understandable given the commercial pressures that developers are under.

One package in development that we do know includes LEMONADE support beyond IMAP-IDLE is the open source 'Modest' package.

Modest, "a small e-mail program specifically targeting modest hardware, such as low-end PCs and internet tablets like the Nokia 770 and N800 internet tablets", is based on the Tinymail library, developed by Philip van Hoof.

What's notable about Modest is the interest and support it appears to be getting from Nokia. The email client on the N770 internet tablet (and the N800 successor device) has long been acknowledged as one of the device's weakest points, something that will come as no surprise to those who have long bemoaned the quality of email clients shipped by manufacturers of mobile devices.

Modest's main developer is a Nokia employee, Dirk-Jan Binnema, and the two co-developers Florian Boor and Nils Faerber  both work for KernelConcepts, a company who's work for the 770 Nokia has previously sponsored. There are rumours that Modest will become the default email client shipped with the 800, an acknowledgement perhaps that whilst third party software is great in demonstrating an active community, its no substitute in the mass market for strong software from the device manufacturer.

It'll be interesting to see which of these features also find their way into Evolution, the default e-mail client for the GNOME Desktop as both Tinymail and Evolution utilise the Camel e-mail protocol library.

This item has been cross-posted to the Lemonade for Mobiles blog.

Network Computing Reviews the LEMONADE Mobile Email Standard

Network Computing Magazine's 'Tech Tracker' has published a review of the Lemonade Profile Email Standard that Isode has been active in promoting.

Lemonade Mobile Email Profile: A Sweet Standard

It's a fair review of the current state of play, although of course we would have preferred more mentions of Isode as we were after all the first company onto the market with servers that comply with the standard.

Where the review does fall down a little is in its  assessment of the state of the client market. Whilst the author correctly points out that the range of clients able to take advantage of the full Lemonade standard is currently limited, the article doesn't perhaps make it clear that any existing IMAP client will function quite happily with Lemonade compliant email servers. Lemonade is, after all, an extension to the IMAP standard, not a replacement for it.

ISPs and Organisations looking into IMAP server replacements, or looking to offer an IMAP service for the first time would therefore do well to future-proof their systems by investing in IMAP servers such as Isode's M-Box. There are already plenty of clients that support some elements of the Lemonade profile (like IMAP-IDLE, the open standards approach to replicating the push-email experience) and there is no downside to preparing for the appearance of new clients supporting other Lemonade initiatives.

A LEMONADE 'first' for Isode

We've been talking about the new LEMONADE standard for mobile messaging for some time and how we have plans to incorporate it into our IMAP/POP server (M-Box) and our SMTP Server (M-Switch).

As of yesterday LEMONADE moved out of the 'intend to do' category and moved into the 'have done' category when Isode sent the first message, outside of a test environment, that demonstrated a key LEMONADE function, the ability to forward a message to another recipient without first downloading it - a key capability for mobile devices like PDAs and Mobile Phones with limited storage and bandwidth.

We forwarded without downloading, over a GPRS link, two messages to Josh Maher and David Ferris of Ferris Research in preparation for a webinar that we're participating in this evening (more details and signup link).

The first contained PowerPoint presentations and PDF documents from a Ferris webinar that took place a month or so ago. The forwarded message was 55Mbytes in size but using forward without download only 2.2 kBytes of data were sent and 1.53 kBytes of data received by the client during the operation.

That's 15,099 times more efficient than forward with download.

The whole process took 26.3 seconds compared with the four hours plus it would have taken had you been insane enough to try this using normal forward with download over a GPRS link.

Because one of the recipients uses a Gmail address (with a 20Mbyte message size limit) we then sent a second message with a single attachment, one of the group of attachments forwarded in the first message. This demonstrated the LEMONADE capability to access parts of messages that have not been downloaded.

Forwarding that message without downloading was 'only' 1739 times more efficient than forward with download and took 7 seconds.

We believe that this is an important step  - bringing LEMONADE out of the lab and into the real world.

Free Ferris Research Webinar: Key Standards for Mobile Messaging.

On October 4th Isode will be co-sponsoring and participating in a free Ferris Research webinar:

"LEMONADE and SyncML: Key Standards for Mobile Messaging"

Isode CEO, Steve Kille, will be joined by speakers from Sun, Funambol and Synchronica to discuss the two key Open Standards that are challenging the proprietary solutions for mobile messaging and personal information management.

You can read more about the webinar (starting at 8:30am Pacific, 11:30am Eastern, 4:30pm UK, 5:30pm CET and lasting for one hour) at the Isode website here.

Click this link to register for the webinar. There is no charge to attend.

IMAP and 'push' email

We've blogged about the LEMONADE Profile for mobile messaging on a number of occasions and we've committed to incorporating LEMONADE into our products with Release 12 of our software, now only a few weeks away.

Supporting LEMONADE requires changes to both our POP/IMAP server (M-Box) and our SMTP Server (M-Switch) and will enable users of these products to offer an effective, efficient mobile email service.

Whilst the profile contains many elements (and you can read more about them in a whitepaper here), there are three specific benefits that attract the most attention:

1. Push email
2. Forward without download
3. Efficient re-connection and re-synchronisation

Push email is a term that is often miss-interpreted. The actual user requirement can be summed up by the phrase "Whenever a new message is delivered to my mailbox, I want to be notified 'immediately' that the message has arrived."

The Lemonade working group started from the supposition that IMAP and SMTP are already a good combination for the provision of mobile email, when there is ongoing activity between the client and the server IMAP will automatically inform the client of the presence of new messages.

The IMAP IDLE command, which is a widely implemented standard extension to the core IMAP protocol and contained within the LEMONADE Profile, ensures that the server will inform the client of new messages even when there is no other activity taking place between client and server.

IDLE maintains the connection by issuing a 'NOOP' command, usually every 15 minutes, to ensure that the connection isn't disrupted by a timeout (such as an IMAP server timeout, TCP connection timeout or NAT gateway timeout).

IMAP -IDLE is a very efficient way of offering all the benefits of push email with substantial implementation, deployment and performance advantages over alternative approaches to solving the user requirement outlined above. You can read more about IMAP-IDLE in a whitepaper on the Isode website: "IMAP IDLE: The best approach for 'push' email."

We'll blog more about our LEMONADE-related changes to M-Box and M-Switch as the release date for r12 approaches.

New Whitepaper: IMAP IDLE - The best approach for 'push' email

The concept of "push email" has been widely marketed as a desirable feature of mobile email services, to enable users to get immediate notification of and access to new messages.

A new whitepaper on the Isode website looks at various approaches to meeting user requirements, and concludes that the Internet Standard IMAP (Internet Message Access Protocol) IDLE command is the best way to achieve this service.

You can here the whitepaper in fiull here.

New whitepaper from Isode: LEMONADE Profile - The key standard for mobile messaging

LEMONADE is the Internet Engineering Task Force (IETF) technology being standardized for support of Mobile Email. Isode has been an active participant in the LEMONADE working group and we'll be incorporating the Profile in to the next major release of our messaging servers (R12).

The LEMONADE Profile is approved, and it is anticipated that it will be published shortly as an Internet Standard. A new whitepaper on our website, "LEMONADE Profile: The Key Standard for Mobile Messaging", explains what the LEMONADE Profile is about and why it will be the central specification for Open Standards mobile messaging.

You can find the whitepaper at: http://www.isode.com/whitepapers/lemonade-profile.html

M-Box POP/IMAP Gateway changes.

In our recent R11.4 release we made an important change to the M-Box POP/IMAP Gateway product which we launched in December of last year.

 

This product now operates in 'synchronization mode', which manages its relationship with the backend POP server to which it connects. Prior to R11.4 when the gateway connected to the POP server to download messages, those messages were deleted on the POP server.

 

Now messages are deleted on the POP server only if the client deletes the message on the M-Box POP/IMAP gateway. Both servers remain in sync.

 

M-Box can easily be deployed in POP/IMAP Gateway configuration by placing it in Gateway mode using the Internet Messaging Administrator also released with R11.4. You can evaluate M-Box by clicking here.

Isode's M-Box and LEMONADE

It's nice to see that the new Open Standard for mobile messaging, LEMONADE, which Isode has committed to supporting, is now getting some attention in the press. Two articles published last week (links below) correctly identify the importance of Open Standards in challenging the proprietary systems currently making the running in the fast expanding market for mobile email.

We intend to incorporate the Profile 1 LEMONADE extensions into M-Box in the next major release (R12) of the Isode product set.

But even without these new features, M-Box as it stands today is still one of the best performing IMAP servers available, with a robustness and scalability that you'd expect from Isode products. M-Box benchmark results are published here and the product itself, as with all Isode products, is available for evaluation either on its own or as part of our Internet Messaging evaluation suite.

Those LEMONADE articles can be found at:

• Unstrung.com: Mobile Email Standards Bubble Up
• Techworld.com: Open Standard Lemonade to Beat Blackberry

'Prosumer' - new target for mobile email?

The consulting and research company, Informa Telecoms and Media have published a new report on the Mobile Enterprise. In the report they identify the 'Prosumer', an employee who's company pays for a portion of their monthly phone bill and who has been excluded from accessing corporate email wirelessly due to technical barriers including device configuration/capabilities.

Informa believe that this large segment of users do have a need to access corporate email through their mobile device and that manufacturers like Blackberry will move increasingly towards back-end server solutions, and away from their current focus on the mobile device.

We think that this is right, blackberry type solutions are great at what they do but the requirement for a new handset excludes a very large number of companies who would like to roll out mobile access but cannot justify an investment in new handsets for employees who have traditionally used their subsidised personal mobile phones for company use.

This rise in demand for efficient corporate email access via already existing devices (perhaps with new email clients) coincides nicely with the work that Isode and other companies have been doing to implement the IETF's LEMONADE standards. These new Open Standards bring efficient mobile email access to existing handsets though a combination of LEMONADE Compatible clients on phones and LEMONADE compatible IMAP mail servers such as Isode's M-Box (or even IMAP access to POP only accounts via a product like Isode's M-Box POP/IMAP gateway).

Access, Replication and Synchronization for Mobile Email Devices

We've added a new whitepaper to the Isode site, "Access, Replication and Synchronization for Mobile Email Devices"

Mobile devices are increasingly tasked with handling email and associated data, such as address books and calendar information. The paper examines the many approaches to getting data onto to and off of the mobile device, looks at synchronization issues between the mobile device, desktop and server, outlines the Open Standards protocols designed to address these issues and recommends a model for mobile and desktop access to email, address book and calendars.

Particular attention is paid to the two main evolving standards designed to address these issues, The Internet Engineering Task Force's proposed LEMONADE standard and SyncML. The OMA (Open Mobile Alliance) is evaluating both these options for supporting mobile email devices. The paper suggests that these two options are complementary, not competitive with SyncML used for synchronizing personal calendars and address books, as it is ideal for these functions and LEMONADE (based on IMAP/SMTP) used for email as SyncML does not have adequate functionality to support the same wide range of usage scenarios.

You can read more here.

Open Standards for Mobile Messaging - an important milestone.

In an important step in defining open standards for mobile messaging, the IESG (Internet Engineering Steering Group) has approved the 'Lemonade Profile' as a Proposed Standard. 

This is the final technical approval for the LEMONADE work. We've blogged about lemonade and its importance a number of times already.

The LEMONADE profile is a a set of required extensions, restrictions and usage modes of the IMAP and mail submission protocols. The profile allows clients (especially those that are constrained in memory, bandwidth, processing power, or other areas) to efficiently use IMAP and Submission to access and submit mail.

Included in the profile is the ability to forward received mail without needing to download and upload the mail, optimization of mail submission and efficient resynchronization in the event of loss of connectivity with the server.

This profile does not define technology, but references other specifications to define a coherent set of protocol specifications to meet a specific objective. This is not a typical Internet specification, as most Internet standards are used on a "mix and match" basis. The profile has been driven by requirements from the telecoms world (and in particular the Open Mobile Alliance) to have a coherent set of standards that can be specified for a service deployment.

This definition is key to those seeking to build an open standards based deployment of mobile messaging.

Email for Mobile Phones: Variety of Solutions will Cause Confusion

There are all sorts of solutions to mobile phone email appearing.  These include:

• The proprietary approaches from RIM and Microsoft
• Similar solutions from smaller vendors
• Offerings from Yahoo and Google/gmail
• Open standards based solutions

We saw an interesting recent review of three more offerings of a different class on the Mobilecrunch blog.

The essence of all of these is to provide a very simple interface on the phone (supported on a wide range of phones), using a backend server that connects to a variety of email systems.   One of them converts all emails to SMS (fragmenting if needed).  The other two interact with the phone using a proprietary protocol to the client that essentially downloads all waiting email. If you only get small messages, and want to read most of them, this type of solution could be useful. Users with more complex requirements will want a solution that interacts directly with their mail server.

The number of solutions appearing make clear that this is an area where things are happening fast.  This will make it very hard for users to understand and to distinguish between different approaches/products.

Microsoft - worst mobile OS for push email?

In this interesting article from Silicon.com, Jørgen Behrens, VP of product management and strategy at Symbian, says:

"Out of all the push email solutions on a mobile OS, Microsoft is the worst of any. The only thing Microsoft have got going for them is the familiarity and the Microsoft look and feel."

Interesting comment and, if viewed from a proprietary implementation perspective, possibly true. But isn't he missing the point? Push email is a function of the standards used by the mail server and the client's ability to mesh with those standards.

Mr. Behrens seems to be thinking of a world where enterprise system administrators roll out mobile phones to the workforce, dictating phone model and contract. A vast majority of companies of course do nothing of the sort. Everybody already has a mobile phone and it makes much more sense, if the phone supports the functions the enterprise is trying to enable, to take advantage of existing hardware and connections.

In this real world the only thing the system administrator worries about is the ability of the phone client to support the standard the server is using and the "look and feel", crucial to encouraging actual use.

As mobile phone operating systems (Symbian and Windows Mobile OS included) impose no restrictions on the user's (or enterprise system administrator's) ability to load compatible third-party software onto the phone or on their ability to fetch email from diverse mailservers, the operating system the phone is using is a factor only insofar as it dictates the range of email clients available.

And in a world where Open Standards always end up dominating (I'm thinking in this case of course of the IETF's emerging LEMONADE standards for efficient mobile email, IMAP extensions) and the authors of third-party clients across all platforms write to those standards, the operating system becomes less and less important. Users don't buy operating systems, they buy phone features and application availability.

There is however still one way, I think, for an operating system to gain a decisive lock on the enterprise mobile email market and that is to ship a decent client with the phone, one that supports the relevant (open) standards and is a pleasure to use. At the moment none of them seem interested in doing that. 

A good IMAP client for mobile devices

In an earlier blog posting Steve noted that IMAP is the ideal standard for mobile messaging and that even as it stands today (without the LEMONADE functionality which we and others are working on) does a good job of delivering a satisfactory mobile messaging experience to the end user.

One of the main stumbling blocks to the widespread adoption of this standard for mass-market mobile email has been the relatively poor quality of the email clients shipped with the mobile devices that people use.

I know  that with my last phone (a Sony Ericsson T610) the shipped email client, whilst theoretically usable, was pretty useless in practice and talking to colleagues at Isode and friends, that seems to be a common judgement on phone email clients.

However, good IMAP clients for phones are available as third-party add-ons, one great example being Profimail which I'm now using on my new Nokia N70 (the standard client shipped with the phone is, again,  pretty terrible).

Profimail (which is available as a demo download from the author's site) does pretty much everything I want from a mobile client and looks good.

If the authors choose to add Lemonade support as the Lemonade features are finalised, Profimail would be a great recommended client for mail service providers to point their users to in order to complete an open standards based mobile messaging offering based on a Lemonade compliant IMAP message store like Isode's own M-Box.

I'm surprised that a mobile phone manufacturer hasn't already either bought the program outright or at least asked them to whitebox the product so they can ship it directly with their phones, it would give them quite an edge over the competition.

Lemonade and IMAP for Mobile Messaging

Open Standards for Mobile Email are a good thing. The IETF Lemonade working group has been working to extend the Internet Standard IMAP (Internet Message Access Protocol) and SMTP (Simple Message Transfer Protocol) to meet advanced mobile requirements. I’ve been arguing until recently that Lemonade is the solution for open standards mobile messaging. This has an unfortunate secondary message: “open standards mobile messaging is not available yet”.

IMAP is a good open standard for Mobile Messaging, and does everything you need pretty well. So my new message is “IMAP is the solution for open standards mobile messaging and Lemonade makes it even better”. We’ve reflected this in updates to the Isode white paper Open Standards: The best approach for Mobile Messaging (that describes detailed benefits and functionality).

This post has been cross-posted from the Ferris Research newsletter.

Mobile Messaging

A little while ago Isode sponsored a joint meeting of the Internet Engineering Task Force's 'LEMONADE' group and the Open Mobile Alliance. Both of these groups are looking at architectures to support mobile email (email on phones, PDA's etc) and are approaching the issue from slightly different angles. After sitting in on the meeting we think that convergence of these two approaches is both desirable and possible and have written a whitepaper outlining our thoughts.

Isode's interest in mobile email centres around our wish to offer an open standards approach to mobile email that competes effectively with the proprietary solutions currently on offer (most notoriously from RIM with their Blackberry devices). In an Open Standards world services like (and superior to) those offered by these proprietary vendors would be available from service providers feeding messages to a wide range of standard handsets running their own choice of email client.

Whilst we've designed M-Box to take advantage of upcoming LEMONADE features like 'forward without download' we've also been looking at how realistic it is to offer such service now and have been pleasantly surprised by what we have found. IMAP has always been recognised as the correct protocol for mobile email access but the real stumbling block has been the lack of decent clients that the user could load onto their mobile device and which would give them a good user experience, as the client shipped with the device would almost certainly not.

We don't think this is an issue any more, with really good clients available for Symbian and Windows Mobile smart-phones, Windows PDAs, Palm devices and other mobile hardware.

We'll be posting about these separately over the next week.

Will.

R11.2 M-Box

R11.2 will be the second release of our new M-Box product.  As you might expect, a lot of work has gone into hardening the product, and adding desirable functionality that we left out of the first release.   We've also put a lot of work into tuning performance, to get the results shown in the benchmarks we released recently. 

R11.2 adds supports for Quota control, so that disk space usage can be controlled for each user, and the manager can monitor usage.   It also adds TLS (Transport Layer Security) support for IMAP, to add data confidentiality to message retrieval. We've also provided a mechanism to manage SIEVE using the Internet Draft "A Protocol for Remotely Managing Sieve Scripts" (managesieve) Alexey Melnikov of Isode is a co-editor of this specification).   

SIEVE (RFC 3028) is a language that specifies control of mail filtering, to handle things such as vacation notifications, mail forwarding and automatic email filing. These can be controlled based on parameters such as message size, and regular expression matches on email headers (e.g., "Subject:").

Because SIEVE is a language, a server implementing SIEVE needs to decide where to store SIEVE scripts and how to manage them.   M-Box stores them in files on the server. For a future release we plan to store SIEVE scripts in the directory, so they could be managed by a special purpose DUA, or have custom scripts built from information managed in a provisioning system.

Managesieve provides a mechanism to create and update scripts using a simple protocol. This allows for better integration with email clients. Cool IMAP clients such as Mulberry and Polymer support managesieve.   Unfortunately the mainstream clients do not (yet).   

Isode recommends proving Webmail in conjunction with M-Box using the excellent open source IMP that provides a Webmail front end to IMAP.   One of the tools associated with IMP is Ingo, which is a Web interface to manage SIEVE scripts using managesieve.  This has good functionality, is easy to use (particularly for common functions such as vacation notices), and works well with M-Box. Its suitable for use both with IMP and as a Web interface for other users to manage SIEVE scripts.

Mobile Messaging

Our CEO, Steve Kille, has been guest-posting on the Ferris Research Weblog on a subject close to our hearts, Open Standards in mobile messaging.

The main point of the post we've stated publicly before (and here on this blog) but bears repeating as often and as loudly as possible, that proprietary protocols for mobile messaging should be challenged and are being challenged by emerging Open Standards.

Isode propose Open Standards approach to challenges of mobile messaging.

With mobile messaging demand continuing to grow and proprietary solutions making most of the running in supplying that demand, Isode CEO Steve Kille, in a talk to EEMA's Annual Conference in Leuven, Belgium yesterday and in a whitepaper released on the Isode website (Open Standards: The best approach for Mobile Messaging) makes the case for an Open Standards approach to mobile messaging.

Isode believes that solutions based on Open Standards deliver increased flexibility and lower costs compared to their proprietary counterparts and that Open Standards can produce a solution as good as or better than proprietary protocols. A technically robust and commercially viable service can be achieved with Open Standards.

A key step in enabling Open Standards based alternatives to such proprietary protocols/services as Blackberry are the proposals of the IETF's LEMONADE ("License to Enhanced Mobile Oriented And Diverse Endpoints") working group, set up to propose messaging standard extensions in support of smart phones, set-top boxes, other memory/processor limited devices and bandwidth/latency challenged networks.

Isode's soon to be released IMAP server, M-Box, has support for some of the key LEMONADE specifications and Isode will be demonstrating M-Box and expanding on the Open Standards messaging approach at the Inbox/Outbox exhibition being held in London on 22/23 June.