Even if you're doing some kind of public-key cryptography, you're still going to have to store the private key at some location on the device, to decrypt the password for IMAP/SMTP/whatever authentication.
Is there some foolproof way to do this that I'm not aware of? How are you supposed to store a password for future retrieval, not in plain text or basically plain text (encrypted but with the key on the device)?
Also, hi from downstairs!
2) If you get physical access to the device, you can pull the DB and whatever IDs are involved. Without encryption, this is game over instantly; with encryption, your goal is to delay it as long as humanly possible.
key = hash(hardware serial number, user password)
And then store the key only in memory every time the user unlocks the phone and wipe it from memory when they lock their phone?
note that the key is only there in my post because its way easier to revoke and regen than to memorize a new complex password every time.
ideally the phone should also be encrypted with a non trivial key (not your PIN)