macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives (bleepingcomputer.com)

Apple's macOS surreptitiously creates and caches thumbnails for images and other file types stored on password-protected / encrypted containers (hard drives, partitions), according to macOS security experts Wojciech Regula and Patrick Wardle. From a report: The problem is that these cached thumbnails are stored on non-encrypted hard drives, in a known location and can be easily retrieved by malware or forensics tools, revealing some of the content stored on encrypted containers. On macOS, these thumbnails are created by Finder and QuickLook. Finder is the default macOS file explorer app, similar to Windows Explorer. Whenever a user navigates to a new folder, Finder automatically loads icons for the files located in those folders. For images, these icons are gradually replaced by thumbnails that show a preview of the image at a small scale.

Comments

Can't search mail if you have spotlight disabled

[Anonymous Coward]

These slimebags are just like google, facebook and the rest of the traitors. You can't even search your fucking mail if you don't let them dig around in your filesystem. They do this bullshit under the facade of being helpful. It's really just asshole design.