The folks at MusicGremlin have pushed out their portable, Wi-Fi-equipped music player with a big splash: Walt Mossberg may have reviewed it--and found a few rough edges in its network support--but I've opted not to run it through its paces at this point for what I think is an important reason.

The Gremlin MG-1000 is a portable music player that comes pre-equipped with a directory of 2 million songs on its 8 GB hard drive. It can use Wi-Fi or a computer connection to download music, with most songs generally available for purchase (most 99 cents), but all songs available to listen to with a monthly $15 subscription. The $300 device can also exchange downloaded music with other peers who are also subscribers. This means that if you're listening to a song someone else wants and you're nearby, they don't have to pull from the Internet, they can pull from you locally as long as they're already permitted to listen to music.

It's sleek and the people behind MusicGremlin are quite brilliant. I saw a prototype of the device about 2 1/2 years ago, and saw the latest iteration at CES in January. I have two review units in hand, in fact. It's the only piece of hardware I've used that has the potential to supplant some of the iPod's cachet and market. I've said since I first saw the prototype that Apple should just up and buy the firm because they need some of the mojo of the Gremlin player to keep the iPod's momentum. But then the iPod just keeps on flying off shelves, so I may not be the best judge of what the consumer entertainment market wants.

But there are two problems for me on the Wi-Fi side: one, a showstopper; the other, just eventually important.

First, the MG-1000 can't connect to a Wi-Fi network using WPA Personal. Because I and all sensible security experts now recommend WPA Personal as a minimum method of securing a home or small-business network, I balk at reviewing a device that requires a security step-down even to test. For home users who leave their networks completely unsecured or use the older WEP thinking it's good enough, well, I worry about you, but this wouldn't be a stumbling block for using MusicGremlin. I castigated Kodak and others for shipping WEP-only devices last year, when even then it seemed rather absurd.

Years after the mandatory requirement of WPA for Wi-Fi certification of adapters and access points, I just can no longer accept a device that can't meet this security bar. The chips and firmware used for embedded devices may lag, but then you have Devicescape giving away their entire security stack for integration on embedded devices running Linux, including not just WPA Personal but WPA Enterprise. There's no good excuse except a lack of development time, and that doesn't justify requiring worse security.

The other issue, which doesn't make the device unusable, is the lack of a partnership with a hotspot aggregator. You can connect to a T-Mobile hotspot if you have a T-Mobile account using a preconfigured setup in the Gremlin player. (There's no special Gremlin rate, either.) But the many, many hotspots that use a gateway page are off limits. This includes the large number of free locations that require use of an account, or a click-through on terms of service. My recent jury duty experience included Wi-Fi that was usable only after clicking a button at the bottom of two pages of legal disclaimers. Only then did ports open up for access.

For a device that's meant to be mobile, I would have thought a hotspot aggregator partnership or an embedded micro-browser with very minimal functionality would be a given. Boingo just open-sourced its hotspot platform and they offer reseller agreements for the hotspots in their network. There are other options, too. Linksys has an upcoming VoIP over Wi-Fi phone that includes a micro-browser and an extensible authentication module for other kinds of log ins.

The second point is not as important as the first, and I hate to criticize a product for what it lacks rather than what it contains. It's a great device, a great service, and I'd like to provide a full review. But I'll wait until the developers catch up the security realities of 2004 and add WPA Personal support.

Read more at: http://wifinetnews.com/archives/006656.html.