2

I am trying to determine if there is a benefit to using the GMail app over the built in iOS one when it comes to security. I know that both store data locally on the phone, but the question is whether that data is encrypted? I cannot find a definitive answer for either one as to how the data is stored on the phone itself. And currently S/MIME is not an option, either.

1
  • 2
    I don't really understand the focus of this question. It looks like you only ask about the storage on your device itself, ignoring that a) there is likely full disk encryption for protection on the device already and b) mail is likely stored at the servers from Apple and Google too and c) mail is not end-to-end protected from sender to recipient unless S/MIME or PGP is used - which you explicitly exclude as option. Commented Dec 4, 2023 at 2:40

1 Answer 1

0

I unfortunately haven't looked extensively at either app, so my ability to answer this question is limited, but I can shed some light, at least. I'll try to avoid opinion-based comments, and mark them where I can't, but be aware that there's not a lot of public knowledge here as both apps are closed-source and I'm not aware of any public security reviews of either.

Secret storage

Both apps almost certainly use the Keychain to store secrets (such as tokens and/or credentials for accessing the Gmail servers). It would be astonishing for the iOS mail app not to, and only slightly more plausible for the Gmail app not to. Keychain on iOS is not literally perfect security; I believe the encryption key it uses for data it keeps is stored in hardware, but the authentication code to access that key is probably derived from your unlock code (which could be observed or even brute-forced, though the hardware will resist brute-force attempts) plus some secret stored in the OS (which is unavailable to attacker without root access on the phone). It's merely extremely good security (other platforms have similar features, but Apple's ability to control the hardware gives them an advantage). Furthermore, app access to the Keychain is segregated so that no one app can access any other app's secrets; bypassing this protection would require compromising the OS application sandbox.

Local data security

I don't know whether either app encrypts its data (other than keys/credentials) locally. I expect not, though it would certainly be possible; generate a symmetric encryption key stored in Keychain and use that for all data read or written. The reason I suspect that they don't bother is that there's only two ways an attacker could access that data anyhow: a privileged process that bypasses the sandbox between apps, or offline access to the device storage. The first approach is possible, with root privileges, but those are the same privileges that would be necessary to bypass the per-app isolation on the Keychain, so such encryption with a Keychain-stored key wouldn't add anything anyhow. The second approach is practically speaking a non-starter, because iOS encrypts all files within the device with a system-level device encryption (which is backed up by hardware, and possibly even the encryption/decryption itself is carried out within hardware rather than exposing the key to main memory). Bypassing the device-level encryption requires either rooting a running device (at which point you can read the entire file system, whether or not the decryption key is actually in RAM) or spoofing both Apple's hardware and user authentication process (which famously even the FBI could not do) to get the chip to allow attacker software to decrypt the storage. As such, both are mostly infeasible to attack.

Network security

This is one place where it is plausible - though by no means guaranteed - that the Gmail app is better off. Since Google controls the Gmail app directly, they can more easily implement network security controls such as certificate or public key pinning, restricting cipher suites, and so on (for increased TLS security). By comparison, the general mail app on iOS needs to be compatible with a wide range of email servers, some of which don't support TLS at all, or only support older versions, and most of which won't have known pinnable certificates or public keys. Apple could (and it wouldn't surprise me if they did) special-case Google accounts to have some of the same security features that Google could itself implement, but it's less likely that they did so than that Google did so. (With that said, there's reasons Google might not have locked down its network security too tightly in the app as well, since this would mean that the app wouldn't work in e.g. corporate environments with mandatory TLS interception.)

Furthermore, there's the other end to consider; the iOS mail app is almost certainly interacting with Gmail as at best customized IMAP and SMTP servers, which is the same way that all other third-party email clients (from Outlook to pine) interact with Gmail (and ~all other email services). There's nothing inherently insecure about that (although those protocols predate TLS and it had to be sort of shoehorned in), but wider compatibility generally means being less strict in what messages you accept, and thus there being more ways to attack the service. By comparison, the Gmail app likely uses its own message format (most likely over HTTPS) to communicate with the Gmail servers in much the same way the webapp does. It would shock me if Gmail used STARTTLS - an extension that makes it possible to switch to a secure connection once communication with an SMTP or IMAP server has started - but didn't mandate that clients do so, and similarly the client shouldn't tolerate an unencrypted connection either, so an "SSL stripping" attack shouldn't work - but the Gmail app almost certainly starts with TLS, so there's never any plain-text traffic for a network attacker to attack at all.

Other application security

On this point, there's no clear winner, and it would take a team of skilled security researchers performing a thorough security review of both apps - with either the full source code, a lot of skill at reverse engineering, or a lot of skill at block-box testing - to produce a very clear answer. Both Google and Apple are security-conscious companies well used to operating with many adversaries, and both employ extremely talented developers and security engineers. Nonetheless, both have suffered catastrophic security flaws in their mobile platforms and apps, and are constantly patching zero-day flaws in their software. Between the two, I think I'd give the edge to Google, who have a higher-profile security team and (so far as I can recall) have suffered somewhat fewer catastrophic security flaws (though Apple improved dramatically after some of the earlier ones), but that's not a clear winner. Both apps are likely written in Swift, which is... less memory-safe than some other languages, including ones that Google favors for its own development, but still quite good, and hopefully the developers aren't doing anything stupid with Unsafe types or operations.

However, this is another place where the question of complexity and attack surface arises. The built-in mail app needs to be able to communicate not only with Gmail (which it may have customized code for; Gmail does not operate exactly like the IMAP standard would indicate, so some work is needed if you want the way Google presents labels including archiving to work exactly as expected) but also with arbitrary other email services, many of which might adhere to the standards better but probably all of which have their own kinks. By comparison, the Gmail app likely offers tighter integration with Gmail - potentially adding some attack surface of its own, if for example it natively supports Gmail's "confidential" email feature - but perhaps not bothering to support the myriad of variations in implementations of POP, IMAP, and SMTP that have sprung up over the years and thus perhaps being easier to fully code review and fuzz test.

Conclusion

Specifically for local data security or secret storage, there's probably little if any difference, and it's hard to say which would be better. For general network and application security, the Gmail app may have an advantage, but there's very little evidence (at least, not without an expensive and extended security review) so this is much more a "suspicion" than a "conclusion".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .