Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×
Privacy Security Apple

Glitch In OS X Search Can Expose Private Details of Apple Mail Users 49

itwbennett (1594911) writes "The potential privacy risk in Apple's OS X Yosemite, first reported by German tech news site Heise and confirmed by IDG News Service, appears when people use the Spotlight Search feature, which also indexes emails received with the Apple Mail email client. Performing a Spotlight search opens email previews that load external images, including tracking pixels that are used to gather data, even when the Mail client is asked not to do this." From the article: A preview of the unopened emails was shown by Spotlight, which revealed to the operator of the server hosting the pixels the receiver’s IP address, current OS version and some details about the browser used as well as the version of Quick Look, a program that let’s users preview a document.
This discussion has been archived. No new comments can be posted.

Glitch In OS X Search Can Expose Private Details of Apple Mail Users

Comments Filter:
  • by GlobalEcho ( 26240 ) on Friday January 09, 2015 @01:11PM (#48776517)
    I noticed this with Little Snitch, which I recently installed on my laptop. It allowed me to prevent the queries, for which I was quite grateful. I'm not particularly happy with all of Spotlight's newly introduced web search components, either -- I wonder if there's a way to turn that off.
    • by Noah Haders ( 3621429 ) on Friday January 09, 2015 @01:30PM (#48776741)

      I'm not particularly happy with all of Spotlight's newly introduced web search components, either -- I wonder if there's a way to turn that off.

      Apple says [apple.com]

      If you do not want your Spotlight search queries and Spotlight Suggestions usage data sent to Apple, you can turn off Spotlight Suggestions. Simply deselect the checkboxes for both Spotlight Suggestions and Bing Web Searches in the Search Results pane of Spotlight preferences in System Preferences on your Mac. If you turn off Spotlight Suggestions and Bing Web Searches, Spotlight will search the contents of only your Mac.

      • by Sox2 ( 785958 )

        following apples suggestion for limiting spotlight intrusiveness does not stop spotlight attempting to connect to a large range IPs.

        • but if you turn off spotlight, it will only search your mac, not the interwebz, so no info will be sent anywhere. note this addresses the GP's specific question at the end of his post, but does not address the submitter's question of how to avoid the tracking pixels.

    • I noticed this with Little Snitch, which I recently installed on my laptop. It allowed me to prevent the queries, for which I was quite grateful. I'm not particularly happy with all of Spotlight's newly introduced web search components, either -- I wonder if there's a way to turn that off.

      I was also shocked, because the new "features" have caused me to stop using Spotlight

  • by goombah99 ( 560566 ) on Friday January 09, 2015 @01:16PM (#48776569)

    any browser, especially ones that do pre-fetching, reveal the same details. pre-fetching can send your OS and browser details, even cookies, to sites you never visit. This isn't seen as a disaster and those are not deep secrets. Mail is doing this one step deeper by automatically pre-fetching all your e-mails. But seriously, most people delete there e-mails by clicking on the e-mail and hitting the trashcan. so that fetch happens. only some folks will devise strategies to actually not look at an e-maiul before deleting it. and for them , they can exclude e-mail from previe and spotlight.

    I already remove e-mail from spotlight just because I don't want e-mails poping up in my searches under an employees name. that could get embarassing if the employee is there while I'm searching for some document we created together.

    • not really a bug just a behavior

      OK, if it's working as designed, then let's call it a design bug instead of a coding bug.

    • by bws111 ( 1216812 ) on Friday January 09, 2015 @01:32PM (#48776765)

      Browsers do not reveal the same details. The links in an email (if followed) prove that the email address is valid, something your browser can not do. Email clients (good ones anyway) do not automatically follow the links, either in preview or even if you open the mail, unless you ask them to. This is a bug.

      • conversely your mail.app won't necessarily have your tracking cookies. each leaks some privacy. they are just different not worse or better.

        • by bws111 ( 1216812 ) on Friday January 09, 2015 @02:56PM (#48777443)

          It IS worse. Whether or not to accept tracking cookies is up to me. Whether or not my email address gets confirmed as being active and in use is not up to me, because this search program is doing it.

          Furthermore, since the search program is following these links it obviously must be interpretting the returned data somehow. Is that interpreter known to be perfect, or is it possible someone could create some malicious content that could cause the interpreter to do something bad? Then, all they have to do is send you an email with a link to the content and the search will happily do whatever the malware wants.

          We constantly see comments on here about how stupid people are because they are tricked into following links to sites with malicious content. Here, we have a program doing that exact thing, without user control, and that behavior is being excused. Why?

          • It IS worse. Whether or not to accept tracking cookies is up to me. Whether or not my email address gets confirmed as being active and in use is not up to me, because this search program is doing it.

            yes it is up to you. You can turn off spotlight in mail. Nothing breaks.

      • This has nothing to do with following links. What happens is that the spam shows an image. You can set up the mail client to not load images in junk messages so the spammers won't receive a request for the image which will have your IP address, browser info (the email client in this case), OS, and a bunch of other information. But in the spotlight search results it loads the image even for junk messages so the spammer will get that information. If the spammer is even a bit clever instead of just having

  • by chthon ( 580889 ) on Friday January 09, 2015 @01:24PM (#48776663) Homepage Journal

    That's why I use claws-mail

  • I personally don't understand the need to have system-wide access to email in a moment's notice. Is email not obscenely pervasive enough already?

    I disable it from my spotlight preferences as a matter of course.

    For that matter, I don't even use the default Mail app that comes with OSX cause it has a couple odd behaviours that tend to drive me nuts, so I'm using PostBox instead. Good ol' fashioned indexing and searching, as god intended.

  • I've used OS X since it's release, this is the first of the many published vulnerabilities that actually causes me concern. From a security perspective Spotlight is unusable on Yosemite machines until this is fixed. Thank goodness my main machines are still on 10.9.
    • Re: (Score:2, Informative)

      by Rosyna ( 80334 )

      This isn't a vulnerability, and to disable it all you have to do is uncheck "Mail & Messages" in the Spotlight preference pane in System Preferences.

      • It's also only a problem if you're using Mail.app... I'm sure many people are like me and just use GMail, etc. directly through the web interfaces.

        Personally, Google Inbox is _way_ beyond Mail.app...

  • Outlook (Score:4, Informative)

    by steveo777 ( 183629 ) on Friday January 09, 2015 @02:39PM (#48777307) Homepage Journal

    I'm pretty sure MS caught hell for this about a decade ago when their preview pane would preload the entire contents of an email, including VBS scripts and links... It's not like it's the first time it happened, but it looks pretty bad for Apple having made the same mistake twice.

    • by Kaenneth ( 82978 )

      Funny story, back when I was contract testing at MS, I bugged that as potential privacy issue in Outlook Express before it was released but the triage team didn't think it was important enough to change.

  • I'm sure they'll both get over it.

When all else fails, read the instructions.

Working...