Truly unlimited mobile for $19: How can it be true?

Terminatyion fee explained

If you are an O2 customer, and you call someone on a Vodafone line, O2 has to pay Vodafone some money to connect the call. This payment is called a termination fee.

I generally find my battery goes down faster when the wifi isn't left on all the time, just because 3g is so battery-hungry when it's transferring data, so the more of it gets dumped onto any wifi that I'm near the better

Presumably the phones won't try to connect to WiFi unless WiFi is detected, which can be done in a very low-power manner (think of those keychain WiFi detectors).

Owner not liable?

In this case the owner can probably get away with it and it would instead by the handset manufacturer who would be liable. They are selling this as totally seamless with no owner knowledge or control of the interaction - unlike wifi squatting where it is user initiated/controllable.

The manufacturer on the other hand are controlling the interaction with their DNS hack and so would be the ones attempting to circumvent access restrictions.

Of course this all depends on the quality of the lawyers doing the arguing.

@JeffyPooh

Read the article again.

Not disputing

While it may very well be true that US operators hold Americans for idiots, conditions (geographical and economical) may also account for some of the differences between European and US costs. European cities are more compact and so require fewer cells. European cities are less geographically dispersed, requiring less long-distance equipment.

All guess work, of course. What are the business cost differences between Europe and the USA?

DNS Based VPN?

Only if the outbound DNS request can be made to ANY server. If the DNS servers are tied down to the ISP servers that are used by the hotspot, this goes out of the Window.

IP over DNS

It's been done; do a search for NSTX, for example. There's an old HOWTO document that explains specifically how it can be used when the WiFi connection only lets you make DNS requests to a single server; the restricted connection does not have to let you make DNS queries to arbitrary servers, as long as you control the DNS for a domain.

If the restricted connection lets you send arbitrary UDP packets to port 53 (DNS) at any address - ie they don't force you to use their DNS server - then setting up a tunnel is pretty trivial, of course, using CIPE or something similar. If you don't need full IP, you could do this at the application level - just write a couple of proxies that tunnel TCP traffic through UDP. You could probably even do it with a pipeline of netcat processes.