Slashdot Mirror
Glitch In OS X Search Can Expose Private Details of Apple Mail Users
itwbennett (1594911) writes "The potential privacy risk in Apple's OS X Yosemite, first reported by German tech news site Heise and confirmed by IDG News Service, appears when people use the Spotlight Search feature, which also indexes emails received with the Apple Mail email client. Performing a Spotlight search opens email previews that load external images, including tracking pixels that are used to gather data, even when the Mail client is asked not to do this." From the article: A preview of the unopened emails was shown by Spotlight, which revealed to the operator of the server hosting the pixels the receiver’s IP address, current OS version and some details about the browser used as well as the version of Quick Look, a program that let’s users preview a document.
The real problem is that the iOS mail app doesn't have an option to block image loading for non-trusted user. So, if I open any email on my phone, I get the images and tracking.
I'm not particularly happy with all of Spotlight's newly introduced web search components, either -- I wonder if there's a way to turn that off.
Apple says
If you do not want your Spotlight search queries and Spotlight Suggestions usage data sent to Apple, you can turn off Spotlight Suggestions. Simply deselect the checkboxes for both Spotlight Suggestions and Bing Web Searches in the Search Results pane of Spotlight preferences in System Preferences on your Mac. If you turn off Spotlight Suggestions and Bing Web Searches, Spotlight will search the contents of only your Mac.