2

In regards to the default Mail app on iOS 8, setup with various mail accounts gmail, outlook etc.

Are emails sent/received to/from the phone securely, if so, how?

Can someone who is snooping on the phones data traffic see any email data?

Thanks for any input.

5
  • Are you talking about WiFi connected or via Mobile Data?
    – AlexH
    Jan 12, 2015 at 11:23
  • Wifi connected predominantly, but also interested in Mobile Data if there is a difference
    – hjumpzfry
    Jan 12, 2015 at 11:26
  • Difficult to find sources, but this suggests iOS Mail is certainly not secure (from Jan'14) forums.macrumors.com/showthread.php?t=1700829 EDIT: Nevermind, the OP in that thread accepted a dud certificate. Oops!
    – AlexH
    Jan 12, 2015 at 11:31
  • As there doesn't seem to be much literature on this, the best way to find out would be to try it yourself on your home network. If your PC is Windows you can use Cain&Abel to ARP poison your iPhone, then send some emails around and see what turns up in the Sniffer of C&A.
    – AlexH
    Jan 12, 2015 at 11:34
  • Thanks for your help, I will try and use the sniffer and see what I can find
    – hjumpzfry
    Jan 12, 2015 at 11:38

3 Answers 3

3

Well, it depends. (Which is the usual answer to this sort of question!)

By default, Internet email is not at all secure; the underlying protocols like SMTP and IMAP are plain text and have no security.

However, sensible email providers will use an additional protocol, TLS, to encrypt the connection between your phone and their servers. Modern versions of Exchange use TLS by default; so does Gmail.

This secures the communications between you and the mail server. (There are some situations in which a bad guy can break TLS if they can intercept your network traffic and persuade you to accept a fake certificate. They're not common but a real threat and in particular your phone company can often do this fairly easily.)

More importantly, there is an aspect of email security that is usually forgotten; you can secure the sending part as much as you like, but you can't do anything about the receiving side. The person you are sending the mails to might not be using TLS; they might be very insecure.

In practical terms: email is secure enough for "regular use" if you have a reasonable email provider and are careful about not accepting bad certificates and avoiding dubious WiFi. However, if you have anything very sensitive to send, you should try and encrypt it separately before sending. (Which might be tricky on an IOS device.)

In a comment you ask if it makes any difference which client you use where you have an option, Apple Mail? Gmail or OWA apps? Web mail in the browser? These all use more or less the same methods to protect your mail from snoopers, so all are roughly equivelant in security from that perspective.

Google would say that using their Gmail app or the browser are slightly more secure, because only they support 2-factor, which is true. We always like 2-factor here - iF you don't have it enabled, go do it now!

However, because the second factor for gmail is "having your phone with you" it doesn't help much with the security when you are reading your mail on the same phone.

1
  • So is receiving my gmail mail on my iPhone via the Mail app less secure than mail.google.com in the mobile browser?
    – hjumpzfry
    Jan 13, 2015 at 4:23
2

You do not control the SMTP servers between you and your recipient, so you don't know if your emails are transmitted in the clear or with encryption. You should assume your emails can be read.

Edit: This is true even if Mail transmits your message securely to your mail server. Mail is often relayed through multiple SMTP servers.

Two solutions are to encrypt your email with S/MIME or encrypt your attachment with some third party app before attaching it to your email.

And even then, there is no guarantee that your recipient will protect the data properly.

1

Adding to Graham's dead-on post, keep in mind that most implementations of TLS/SSL over SMTP are configured to be used in an opportunistic manner. That is, they are not forced and are only used if both sides are configured to use them and agree on an acceptable cipher (and the sys admins have not been lazy and let their certs expire, and so on).

So relying on the fact that 'mail server xyz uses TLS so my email will be secure' leaves a less than warm fuzzy feeling as there are many factors that could affect that being true.

TLS/SSL provide a secure socket to transmit data. So the pipe that the data goes through is secure when used. This is not the same thing as the data being encrypted (S/Mime, etc.) at the sending end, and decrypted on the receiving end.

Best of both worlds, send encrypted data over a secure pipe :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .