As it turns out, Apple’s image security is based only on the date the photo was taken – if a photo was taken prior to the date shown on the iPhone, it will not be visible. But setting the time back on the device will cause any photo taken from that date onward to be visible, even if your phone is locked.
While interesting, the bug really isn’t that big of a deal – if you keep your iPhone locked, nobody will be able to get in and change the system time. And if someone did directly access your iPhone, you’ve got bigger things to worry about than photos.
Despite this being a minor bug, the take-home message is that relying only on a timestamp is a pretty poor way to handle image security…