Glitch In OS X Search Can Expose Private Details of Apple Mail Users 49
itwbennett (1594911) writes "The potential privacy risk in Apple's OS X Yosemite, first reported by German tech news site Heise and confirmed by IDG News Service, appears when people use the Spotlight Search feature, which also indexes emails received with the Apple Mail email client. Performing a Spotlight search opens email previews that load external images, including tracking pixels that are used to gather data, even when the Mail client is asked not to do this." From the article: A preview of the unopened emails was shown by Spotlight, which revealed to the operator of the server hosting the pixels the receiver’s IP address, current OS version and some details about the browser used as well as the version of Quick Look, a program that let’s users preview a document.
Re: (Score:1)
I am really confused what the 'Settings.app->Mail, Contacts, Calendars -> Load Remote Images' setting does then.
Mine is set to off, and I do not see any remote images. Since an Anonymous Coward on Slashdot says it does not have that option, it must be true.
Re: (Score:1)
Or even that it does not default to blocking (like Outlook) and allow unblock...
Re: (Score:2)
Re: (Score:2)
Because I'm inclined to be conspiratorial, I am somewhat suspicious that iOS Mail and Safari are written with advertiser-friendliness in mind which leads to them loading mail images automatically and the lack of an adblocking feature (or add-in capability) to Safari.
Yes, you can install a third-party browser like Mercury which can do adblocking but there's no way to change the default browser, which leads to Safari getting used (it doesn't help that Mercury's "Open in Mercury" bookmarklet is broken, the URL
Re: (Score:1)
No, that's Linux.
Re: (Score:1)
Re: (Score:2, Funny)
It's only impervious to criticism.
Re: (Score:2)
AND BEYOND!
Re: (Score:1)
How is this a virus?
Re: (Score:2)
I got mine from the store that sells dehydrated water and air guitar strings.
A job for Little Snitch (Score:3)
Re:A job for Little Snitch (Score:5, Insightful)
I'm not particularly happy with all of Spotlight's newly introduced web search components, either -- I wonder if there's a way to turn that off.
Apple says [apple.com]
If you do not want your Spotlight search queries and Spotlight Suggestions usage data sent to Apple, you can turn off Spotlight Suggestions. Simply deselect the checkboxes for both Spotlight Suggestions and Bing Web Searches in the Search Results pane of Spotlight preferences in System Preferences on your Mac. If you turn off Spotlight Suggestions and Bing Web Searches, Spotlight will search the contents of only your Mac.
Re: (Score:1)
following apples suggestion for limiting spotlight intrusiveness does not stop spotlight attempting to connect to a large range IPs.
Re: (Score:1)
but if you turn off spotlight, it will only search your mac, not the interwebz, so no info will be sent anywhere. note this addresses the GP's specific question at the end of his post, but does not address the submitter's question of how to avoid the tracking pixels.
Re: (Score:2)
I noticed this with Little Snitch, which I recently installed on my laptop. It allowed me to prevent the queries, for which I was quite grateful. I'm not particularly happy with all of Spotlight's newly introduced web search components, either -- I wonder if there's a way to turn that off.
I was also shocked, because the new "features" have caused me to stop using Spotlight
not really a bug just a behavior (Score:5, Informative)
any browser, especially ones that do pre-fetching, reveal the same details. pre-fetching can send your OS and browser details, even cookies, to sites you never visit. This isn't seen as a disaster and those are not deep secrets. Mail is doing this one step deeper by automatically pre-fetching all your e-mails. But seriously, most people delete there e-mails by clicking on the e-mail and hitting the trashcan. so that fetch happens. only some folks will devise strategies to actually not look at an e-maiul before deleting it. and for them , they can exclude e-mail from previe and spotlight.
I already remove e-mail from spotlight just because I don't want e-mails poping up in my searches under an employees name. that could get embarassing if the employee is there while I'm searching for some document we created together.
Re: (Score:2)
not really a bug just a behavior
OK, if it's working as designed, then let's call it a design bug instead of a coding bug.
Re:not really a bug just a behavior (Score:5, Informative)
Browsers do not reveal the same details. The links in an email (if followed) prove that the email address is valid, something your browser can not do. Email clients (good ones anyway) do not automatically follow the links, either in preview or even if you open the mail, unless you ask them to. This is a bug.
Re: (Score:1)
conversely your mail.app won't necessarily have your tracking cookies. each leaks some privacy. they are just different not worse or better.
Re:not really a bug just a behavior (Score:5, Interesting)
It IS worse. Whether or not to accept tracking cookies is up to me. Whether or not my email address gets confirmed as being active and in use is not up to me, because this search program is doing it.
Furthermore, since the search program is following these links it obviously must be interpretting the returned data somehow. Is that interpreter known to be perfect, or is it possible someone could create some malicious content that could cause the interpreter to do something bad? Then, all they have to do is send you an email with a link to the content and the search will happily do whatever the malware wants.
We constantly see comments on here about how stupid people are because they are tricked into following links to sites with malicious content. Here, we have a program doing that exact thing, without user control, and that behavior is being excused. Why?
Re: (Score:1)
It IS worse. Whether or not to accept tracking cookies is up to me. Whether or not my email address gets confirmed as being active and in use is not up to me, because this search program is doing it.
yes it is up to you. You can turn off spotlight in mail. Nothing breaks.
Re: (Score:1)
This has nothing to do with following links. What happens is that the spam shows an image. You can set up the mail client to not load images in junk messages so the spammers won't receive a request for the image which will have your IP address, browser info (the email client in this case), OS, and a bunch of other information. But in the spotlight search results it loads the image even for junk messages so the spammer will get that information. If the spammer is even a bit clever instead of just having
Re: (Score:2)
It shows images by following links.
Other mail agent (Score:3)
That's why I use claws-mail
Segregate mail like the good ol' days (Score:2)
I personally don't understand the need to have system-wide access to email in a moment's notice. Is email not obscenely pervasive enough already?
I disable it from my spotlight preferences as a matter of course.
For that matter, I don't even use the default Mail app that comes with OSX cause it has a couple odd behaviours that tend to drive me nuts, so I'm using PostBox instead. Good ol' fashioned indexing and searching, as god intended.
This is serious for users (Score:2)
Re: (Score:2, Informative)
This isn't a vulnerability, and to disable it all you have to do is uncheck "Mail & Messages" in the Spotlight preference pane in System Preferences.
Re: (Score:2)
It's also only a problem if you're using Mail.app... I'm sure many people are like me and just use GMail, etc. directly through the web interfaces.
Personally, Google Inbox is _way_ beyond Mail.app...
Outlook (Score:4, Informative)
I'm pretty sure MS caught hell for this about a decade ago when their preview pane would preload the entire contents of an email, including VBS scripts and links... It's not like it's the first time it happened, but it looks pretty bad for Apple having made the same mistake twice.
Re: (Score:2)
Funny story, back when I was contract testing at MS, I bugged that as potential privacy issue in Outlook Express before it was released but the triage team didn't think it was important enough to change.
Umm (Score:1)
I'm sure they'll both get over it.