I surprisingly noticed today as I “ssh” into the device to find out that all cached sent, received & draft mail is stored as plain text on the device. This includes a summary information file that includes all headers of emails (sender, recipients, subject, etc).

If you check the directory “/home/user/.modest/cache/mail/imap/” you will find all your email accounts subfolders, if you navigate to any of those you will find that all the information is stored in plain text. There are also subfolders within each email account. For example if you go to the INBOX subfolder you will find that emails are stored in plain text.

This is a major security issue if the device is lost or stolen.

Is there an encryption option somewhere that I haven’t noticed or is this simply the lack of encryption within the device?

so what you are saying is that a thief would look for your emails in home/user/.modest/cache/mail/imap/ ?

why couldn't he just use the email app?

... what is the point of encryption if the e-mail app is unprotected. could you please explain. =D

We already went over a similar thing

http://talk.maemo.org/showthread.php?t=41164

Dante, I don't store the email passwords on the device (email setup), so the thief won't be able to log into the account, however emails are being stored as plain text which is a huge security issue.

Yes, thanks I had seen this, but it is talking about usernames/passwords being stored in plain text which is not an issue for me since I never store passwords on the device.

I am concerned that email messages are stored in plain text, which is a big problem.

Encrypt your homedir, search for bug report about this and if there isn't one file a new one. This was also discussed in the Brainstorm forums already, btw.

I am pretty sure we have SOME program available in the repos for mounting/creating encrypted disks/volumes. I would just delete all cached emails if paranoid enough - but I can see why you'd want encryption.

However, I'm pretty sure even if you encrypt the emails using the available tools, the N900's email app would take some hacking to make it capable of opening and saving them in that encrypted volume.

Perhaps turn to one of the community email apps that are being actively developed, and see if you can get them to integrate that with email encryption upport?

because this is not an E-series device?

Want encrypted emails? Get a Blackberry

Thanks for all the replies. I guess the issue is, in this case, is with the actual native mail client on the N900. It does not encrypt stored messages. This is a major security issue since the application does not comply with industry security standards. I was actually very surprised.

So the correct solution is for the native email client to store this info encrypted.

I have done some other research and apparently there are a number of apps both native and/or developed that stores info like usernames, passwords, chat messages, SMS, etc, in plain text.

For the time being does anyone know of a secure email client?

Should we report this as a bug?