So there is an E-mail client. I can encrypt its database with a few clicks in its menu. But it's storing the opened attachments unencrypted in /tmp/foo/bla.xls. The bla.xls has 644 UNIX permission (since user's umask is 0022) and the /tmp/foo/ directory has permission of 750. The owner:group is the user that uses the desktop, the mail client.
My question: Is it normal to store opened attachments in unencrypted format?
At some point the program needs to store the documents somewhere in an unecrypted format if the document is to be shown to the user. If you want to show the document to the user you need to decrypt it, there is no other way. It can either be stored on disk or in memory in its unencrypted form (although the latter can have severe issues once the filesize starts growing). Hence often the unencrypted file is stored temporarily in a folder where only the owner of the file can view it.
If the permissions are indeed 750 on the folder then it means that only the owner and group members will be able to view the file. This is normal practice as long as all files are removed from the tmp folder after viewing.
