A while ago, I'd tested this by sending myself an email with a file attached, then opening it in a web-based client. What I saw was a blank message with a single
smime.p7m attachment. I assumed this must contain the body of the message and the attachment, both encrypted.
Recently, though, I got a nasty surprise from iMessage—it apparently doesn't encrypt files you send. This lead me to be suspicious about pretty much everything that transfers files and claims to be secure.
Are attachments sent using Mail really encrypted with the body of the message, or are they just sent insecurely alongside it?