iOS 7 doesn't encrypt email attachments
Summary: A researcher has reported to Apple that email attachments stored on an iOS device are not encrypted at rest, contrary to Apple's claims. — In explaining the considerable measures Apple put in iOS to protect data, one claim the company makes …
Context & Ripple Effects
Researcher Andreas Kurtz reported to Apple that email attachments saved on iOS devices are stored unencrypted at rest — directly contradicting the data-protection guarantees Apple advertises for iOS 7. The finding spread fast: 9to5Mac, MacRumors, AppleInsider, Business Insider, TUAW and others all picked it up the same day, and Apple has acknowledged the bug and confirmed it is working on a fix.
The episode lands awkwardly for a company that markets device encryption as a headline feature, and it comes from an outside researcher verifying Apple's claims rather than from Apple's own disclosure — a pattern enterprise buyers of iPhones will notice.
First-order effects
- Organizations relying on iOS data protection for compliance-sensitive email now have attachments readable from device storage without the passcode, until Apple ships its fix.
- Apple's privacy messaging takes a credibility hit precisely because the gap was demonstrated independently rather than disclosed by the company.
Second-order effects
- Rivals running Android or Windows Phone can counter Apple's security-led pitch in enterprise deals by citing a documented gap in iOS attachment encryption.
- Mobile-device-management vendors and IT auditors face pressure to verify at-rest encryption themselves instead of trusting platform-level claims, raising evaluation costs across every mobile deployment.
Third-order effects
- Independent researcher verification of vendor encryption claims is hardening into a de facto audit layer for mobile platforms, meaning any future 'encrypted by default' marketing from Apple, Google or Microsoft will be tested against real device behavior before customers accept it.
The trend: As encryption becomes a consumer- and enterprise-facing selling point, mobile platforms are shifting from self-reported security claims toward claims validated by outside researchers.