Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
In regards to the default Mail app on iOS 8, setup with various mail accounts gmail, outlook etc.
Are emails sent/received to/from the phone securely, if so, how?
Can someone who is snooping on the phones data traffic see any email data?
Thanks for any input.
Well, it depends. (Which is the usual answer to this sort of question!)
By default, Internet email is not at all secure; the underlying protocols like SMTP and IMAP are plain text and have no security.
However, sensible email providers will use an additional protocol, TLS, to encrypt the connection between your phone and their servers. Modern versions of Exchange use TLS by default; so does Gmail.
This secures the communications between you and the mail server. (There are some situations in which a bad guy can break TLS if they can intercept your network traffic and persuade you to accept a fake certificate. They're not common but a real threat and in particular your phone company can often do this fairly easily.)
More importantly, there is an aspect of email security that is usually forgotten; you can secure the sending part as much as you like, but you can't do anything about the receiving side. The person you are sending the mails to might not be using TLS; they might be very insecure.
In practical terms: email is secure enough for "regular use" if you have a reasonable email provider and are careful about not accepting bad certificates and avoiding dubious WiFi. However, if you have anything very sensitive to send, you should try and encrypt it separately before sending. (Which might be tricky on an IOS device.)
In a comment you ask if it makes any difference which client you use where you have an option, Apple Mail? Gmail or OWA apps? Web mail in the browser? These all use more or less the same methods to protect your mail from snoopers, so all are roughly equivelant in security from that perspective.
Google would say that using their Gmail app or the browser are slightly more secure, because only they support 2-factor, which is true. We always like 2-factor here - iF you don't have it enabled, go do it now!
However, because the second factor for gmail is "having your phone with you" it doesn't help much with the security when you are reading your mail on the same phone.
You do not control the SMTP servers between you and your recipient, so you don't know if your emails are transmitted in the clear or with encryption. You should assume your emails can be read.
Edit: This is true even if Mail transmits your message securely to your mail server. Mail is often relayed through multiple SMTP servers.
Two solutions are to encrypt your email with S/MIME or encrypt your attachment with some third party app before attaching it to your email.
And even then, there is no guarantee that your recipient will protect the data properly.
Adding to Graham's dead-on post, keep in mind that most implementations of TLS/SSL over SMTP are configured to be used in an opportunistic manner. That is, they are not forced and are only used if both sides are configured to use them and agree on an acceptable cipher (and the sys admins have not been lazy and let their certs expire, and so on).
So relying on the fact that 'mail server xyz uses TLS so my email will be secure' leaves a less than warm fuzzy feeling as there are many factors that could affect that being true.
TLS/SSL provide a secure socket to transmit data. So the pipe that the data goes through is secure when used. This is not the same thing as the data being encrypted (S/Mime, etc.) at the sending end, and decrypted on the receiving end.
Best of both worlds, send encrypted data over a secure pipe :)
