3

Let's say I set up a Microsoft account on a Windows phone and use the associated built in email client. If I send an email, would it be send in plaintext. On wifi, if someone is sniffing the traffic, will he be able to see the contents of the mail?

2

This would depend on the e-mail server that you're connecting to as opposed to being a function of the Mobile Phone operating system.

The (old) default was to send outgoing mail over port 25/TCP using the SMTP protocol. Traffic over this port is, by default, unencrypted.

Many modern e-mail services do not make use of this port and instead will use an encrypted version of SMTP over port 465/TCP or 587/TCP (more info. here)

If the encrypted version is used then someone on a wi-fi network would not be able to see your traffic without additional measures to defeat the encryption (which are much more complex than simple traffic sniffing)

  • 465 is deprecated in favor of STARTTLS on 25. – sebix Aug 22 '15 at 15:13
1

Rory's answer is correct. However, there are also two additional ways that you can secure email built into WP8.1 or higher.

  1. Use a VPN. While WP8.1 only supports a limited number of VPN protocols and apps, many corporations and free or commercial VPN providers use these protocols. If you connect to VPN and use it to tunnel all traffic (not just LAN traffic), then a network attacker on your WiFi will not be able to decrypt or interfere with your email (except possibly by killing the connection outright, but there's no defense against that on a network you don't control).
  2. Use S/MIME (Secure Multipart Internet Mail Extensions). This requires that you have a certificate for your email recipient already installed in the phone or findable on the Exchange server that the phone is sending the mail through (assuming you're using ActiveSync). Using S/MIME, the phone will encrypt the email such that nobody except the recipient (who has the private key corresponding to the public key stored in the certificate) can decrypt the message or any attachments, although some message metadata (like who sent the message, who received it, what the subject line was, and so on) will be visible to anybody. S/MIME is reasonably common in corporate environments (because Exchange and Outlook support it) but rare elsewhere.

Another approach that isn't built into WP8.1 but that is available through third-party apps is OpenPGP. This is the standardized email encryption format used by tools such as PGP (Pretty Good Privacy) and its free, open-source clone GPG (GNU Privacy Guard). Similar to S/MIME, you'll need the public key of each recipient, and some way to trust that it came from them. You'll also need an app, such as oPenGP or OpenPGP fur Windows Phone, both of which are available in the store (I'm not associated with either, and frankly they both have bugs but are usable). Use the app to write your email (or copy-paste it into the app) and have the app encrypt it to your recipient(s). You can then send the encrypted message over email without worrying that a network attacker can decrypt it (though there will still be metadata leakage). OpenPGP usage is most common among fans of information security and privacy, and rare in the general populace.

Oh, you could of course also just send the email over cellular data. Even if the connection to the email server isn't encrypted, the connection to the cell tower is. It's not the best encryption in the world, especially if using an older data protocol (I think all 2G protocols are broken by now; less sure about 3G and up) but most people don't even have the technology to intercept cellular data transmissions, much less decrypt them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.