A follow up to my 7,5 years old question. Back 10-15 years ago, when I wanted to send an executable file over Gmail from my PC, all I had to do was to change file's extension to some meaningless one or compress that file with a password.
The mentioned question (and all answer to it) proven that contents of ZIP file can be browsed (or even changed) without knowing the password used to build up such ZIP archive. But I still had some (stupid?) faith in 7zip.
Today it turned out that mobile Gmail for Android "knows" that I am trying to send executable
.apk file (or prevents me from doing so for any other reason) even when I am:
sending as plain file (obviously),
.dator some other,
compressing with ZIP with no password,
compressing with ZIP (ultra compression) and encrypting archive with a password,
compressing with 7ZIP (ultra compression) and encrypting archive with a password,
using an 7 years old idea of double compression:
.zipfile without password,
- compress resulting
.zipfile again into another
.zipfile with password / encryption.
The last one actually "killed me". If Gmail "knows" what type of file am I sending, even if I treat that file with a double compression, adding a password-based encryption on top of it, then how can I treat files sent over Internet (even encrypted ones) as secure or even safe?
I am by no mean an expert. This question may sound like a naive one. But, still... I wonder, why should I encrypt files at all, if a simple mail client is able to "break through" password-protected file and tell itself, what type of file is contained there?