macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives (bleepingcomputer.com)

Apple's macOS surreptitiously creates and caches thumbnails for images and other file types stored on password-protected / encrypted containers (hard drives, partitions), according to macOS security experts Wojciech Regula and Patrick Wardle. From a report: The problem is that these cached thumbnails are stored on non-encrypted hard drives, in a known location and can be easily retrieved by malware or forensics tools, revealing some of the content stored on encrypted containers. On macOS, these thumbnails are created by Finder and QuickLook. Finder is the default macOS file explorer app, similar to Windows Explorer. Whenever a user navigates to a new folder, Finder automatically loads icons for the files located in those folders. For images, these icons are gradually replaced by thumbnails that show a preview of the image at a small scale.

Comments

Re:Duh!

[fluffernutter]

That's an awfully obscure point to know for an OS that is supposed to both be secure and 'just work'. Put those two together, and security should just work, not require you to understand this distinction. Your comment amounts to, "you're encrypting it wrong".

Re:Duh!

[fluffernutter]

Doesn't matter, it shouldn't be on option to be left open. It might be ok if it explained that "Apple reserves the right to copy any data from another device to your system drive so do not assume all data is encrypted unless your system drive is encrypted". But I doubt it says that, because that alone would be confusing to people, so they should just not automatically copy data off an encrypted drive, period.

Re:Duh!

[I'm New Around Here]

and then when it crashes and you can't slave it into another system to get data from it, you're hosed.