I've been trying to think of a safer way to check the email on an Android device. Android devices are generally very insecure, and therefore they should not be trusted for anything serious. Here are some reasons we should all know already:
- The device manufacturer won't provide timely updates, or will soon stop providing updates.
- The apps in the store can be malicious, or be infected via supply-chain attacks. This is not rare, has happened, and keeps happening.
- The device is much more likely to be stolen or lost, since people carry it with them all the time. Remote wiping can't be relied on, since it depends on GPS (which you might not want to have enabled all the time) and connectivity (the attacker can just go to a place where no signal is available).
- The device is often used as a second factor for authentication or as a way to reset passwords, making it a single point of failure if you are using such services on a phone (the phone will allow access to everything).
In order to be able to check the email anyway, somehow, I thought of the following method:
- Create a separate account for the phone, for example
firstname.lastname@example.org. The phone will only connect to this account. It won't connect to your real accounts.
- Your real accounts will forward all the messages to the phone's account, for example:
email@example.com -> firstname.lastname@example.org,
email@example.com -> firstname.lastname@example.org, and so on.
- Now you can read the email from
email@example.com your Android device, and delete the messages soon after. So it's basically a dummy email account connected to your phone, and if it's ever hacked the attacker will only find a mostly empty account (no old or archived emails).
But then I realized that an attacker could just request a password reset from one of your real accounts, and they will be able to receive the reset link/code on the dummy account, because everything is forwarded there. The attacker would have to know the names of the real accounts, but I guess that would be trivial to find out (the real accounts are probably shown as the senders in forwarded emails). It turns out the best thing to have would be some kind of filter, to remove possibly sensitive content from the emails (like numbers, links, etc.) or to send a canned message instead of forwarding it in case some keywords are detected (like "code", "reset", "password", "click", "microsoft", etc.). There's no easy way to do this, and I'm afraid it would require some custom implementation which might introduce other possible weak points. For example, I thought I could forward everything to an account on a server I control, and then run a custom script with
cron regularly, which in turn will send custom (filtered) email notifications to the account connected to my Android device. You can see that the complexity is starting to increase a bit too much, and makes me wonder if it's actually worth it.
- Is all this overkill? Would a solution like the first one I proposed (simple forwards) be enough? I guess opportunistic attackers will probably use malware to gather all the data available on the phone (like username and password of the dummy account on the phone), but maybe won't go as far as to try to mess with other stuff (like trying to reset passwords for accounts that appear to be forwarding the email). But I might be wrong.
- Are there better methods to achieve what I want? Note that I don't need to be able to read all the email all the time. Ideally, I would want to be able to read most of it, but at least I'd need to be notified of new email anyway.
- Am I missing anything else? (Other related threats, gotchas, etc.)