31–40 of 60 posts
If you lose your phone is already game over. Here's a idea...if you have important data that you want to be secure.....DON"T KEEP IT ON YOUR PHONE. How about that, huh ?
This is like telling someone you can access his ~/Documents/ and read the content of files within when he leaves his laptop unattended and logged in.
There is a secure store solution available from a company located in germany. They call it "Secure Incremental Store" - an enhancement for Core Data.
If you lose your phone is already game over. Here's a idea...if you have important data that you want to be secure.....DON"T KEEP IT ON YOUR PHONE. How about that, huh ?
How about making it more secure! Won't it solve the problem? It's just not about Mailbox app it's about all the apps that should protect user's data. Should they care about their user's data or leave it up to the device to protect it?
In other words, this is the expected behaviour when your phone is unlocked.
See: https://developer.apple.com/library/ios/documentation/Cocoa/...
“if anyone else can get hold of your phone, he can access to files of those apps where data is not protected.” As always, if someone has physical access and unlimited time, no device or computer is safe. Also, Mailbox.app only supports GMail. Security minded people are obviously not the target market.
If you get physical access you can also read all the mails in Apple's Mail.app, or any other app on the device. Maybe not using a tool, but you can easily read them in the app, forward them, and send fake e-mails using the account of the user. (edited to make my point more clear :)
This is like telling someone you can access his ~/Documents/ and read the content of files within when he leaves his laptop unattended and logged in.
One need to handle security differently for mobile devices and for laptops. When it comes to the example I gave above in one case a person can read the contents of the files, in another case the same person can copy your entire content. Now if that's not something to worry about, what is!
The argument that 'once you've lost the phone you've lost the data anyway' isn't really fair. If a passcode is being used, data marked as being a security concern is protected with the passcode. A 4 digit code is trivial to brute force, yes, but the point is that it should be done anyway.
Using iExplorer to find files is a lot easier than loading a custom bootloader on to the phone, booting custom firmware, brute forcing the passcode and decrypting the files. If anything, the extra time will raise the chance that you can get to a computer and initiate a remote-wipe.
An important fact is wrong: You actually need to unlock the device to access the data unless the iPhone and the computer were paired before.
If you jailbreak the phone you can access all non protected data.
iOS Mail app uses DAPI correctly. For push mail when the phone is locked it will use a public key to encrypt the data.
I am unsure if even the Gmail app uses it correctly, I only tested the stock mail app.
If you have the an escrow key pair (ie. synced to iTunes) your are screwed. If should do a DFU mode restore to wipe the keybag completely.
“if anyone else can get hold of your phone, he can access to files of those apps where data is not protected.” As always, if someone has physical access and unlimited time, no device or computer is safe. Also, Mailbox.app only supports GMail. Security minded people are obviously not the target market.
If you get physical access you can also read all the mails in Apple's Mail.app, or any other app on the device. Maybe not using a tool, but you can easily read them in the app, forward them, and send fake e-mails using the account of the user. (edited to make my point more clear :)