Glitch In OS X Search Can Expose Private Details of Apple Mail Users

itwbennett (1594911) writes "The potential privacy risk in Apple's OS X Yosemite, first reported by German tech news site Heise and confirmed by IDG News Service, appears when people use the Spotlight Search feature, which also indexes emails received with the Apple Mail email client. Performing a Spotlight search opens email previews that load external images, including tracking pixels that are used to gather data, even when the Mail client is asked not to do this." From the article: A preview of the unopened emails was shown by Spotlight, which revealed to the operator of the server hosting the pixels the receiver’s IP address, current OS version and some details about the browser used as well as the version of Quick Look, a program that let’s users preview a document.

Comments

A job for Little Snitch

[GlobalEcho]

I noticed this with Little Snitch, which I recently installed on my laptop. It allowed me to prevent the queries, for which I was quite grateful. I'm not particularly happy with all of Spotlight's newly introduced web search components, either -- I wonder if there's a way to turn that off.

Re:A job for Little Snitch

[Noah Haders]

I'm not particularly happy with all of Spotlight's newly introduced web search components, either -- I wonder if there's a way to turn that off.

Apple says

If you do not want your Spotlight search queries and Spotlight Suggestions usage data sent to Apple, you can turn off Spotlight Suggestions. Simply deselect the checkboxes for both Spotlight Suggestions and Bing Web Searches in the Search Results pane of Spotlight preferences in System Preferences on your Mac. If you turn off Spotlight Suggestions and Bing Web Searches, Spotlight will search the contents of only your Mac.

not really a bug just a behavior

[goombah99]

any browser, especially ones that do pre-fetching, reveal the same details. pre-fetching can send your OS and browser details, even cookies, to sites you never visit. This isn't seen as a disaster and those are not deep secrets. Mail is doing this one step deeper by automatically pre-fetching all your e-mails. But seriously, most people delete there e-mails by clicking on the e-mail and hitting the trashcan. so that fetch happens. only some folks will devise strategies to actually not look at an e-maiul before deleting it. and for them , they can exclude e-mail from previe and spotlight.

I already remove e-mail from spotlight just because I don't want e-mails poping up in my searches under an employees name. that could get embarassing if the employee is there while I'm searching for some document we created together.

Re:not really a bug just a behavior

[bws111]

Browsers do not reveal the same details. The links in an email (if followed) prove that the email address is valid, something your browser can not do. Email clients (good ones anyway) do not automatically follow the links, either in preview or even if you open the mail, unless you ask them to. This is a bug.

Re:not really a bug just a behavior

[bws111]

It IS worse. Whether or not to accept tracking cookies is up to me. Whether or not my email address gets confirmed as being active and in use is not up to me, because this search program is doing it.

Furthermore, since the search program is following these links it obviously must be interpretting the returned data somehow. Is that interpreter known to be perfect, or is it possible someone could create some malicious content that could cause the interpreter to do something bad? Then, all they have to do is send you an email with a link to the content and the search will happily do whatever the malware wants.

We constantly see comments on here about how stupid people are because they are tricked into following links to sites with malicious content. Here, we have a program doing that exact thing, without user control, and that behavior is being excused. Why?

Other mail agent

[chthon]

That's why I use claws-mail

Re:WHAT?!?!?!?

[Anonymous Coward]

It's only impervious to criticism.

Outlook

[steveo777]

I'm pretty sure MS caught hell for this about a decade ago when their preview pane would preload the entire contents of an email, including VBS scripts and links... It's not like it's the first time it happened, but it looks pretty bad for Apple having made the same mistake twice.