Must iPhone mail be encrypted through SSL?

Mike Chapple, CISSP, IT security expert from the University of Notre Dame. He worked as an information security researcher at the National Security Agency and the U.S. Air Force. Mike often writes for SearchSecurity.com and is the technical editor of Information Security magazine.

Q: I just bought an iPhone and I am setting up an email account. After setting the account, I received a message saying that SSL is not activated. What are the security risks of using such account settings? In addition, how can I choose?

A: When TCP/IP clients and servers communicate over the Internet and the network, SSLSecure Sockets Layer provides encryption services for TCP/IP connections. For iPhone mail, SSL encrypts all the communication between your phone and the email server.

Why is it so important? There are two important reasons. First, the SSL check email is not applicable, meaning that anyone with the same network device can snoop your communication content. They can use common tools, such as Wireshark, to read your emails over the Internet.

If you do not care about the confidentiality of the email, there is another important reason for encrypting the email connection: protecting the security of your account. If you do not encrypt the email server connection, your user name and password will pass through the network in plain text. Eavesdroppers can log on to your email account and use your identity to send/receive emails.

For these reasons, I strongly recommend that you activate SSL connections when sending and receiving emails, not on the iPhone, but on all devices.