“Using the Spotlight search feature in OS X Yosemite can leak IP addresses and private details to spammers and other e-mail-based scammers, according to tests independently performed by two news outlets,” Dan Goodin reports for Ars Technica.
“The potential privacy glitch affects people who have configured the Mac Mail App to turn off the “load remote content in messages” setting, as security experts have long advised,” Goodin reports. “But even when remote image viewing is disabled in Yosemite-based Mail app settings, the images will be opened by Spotlight, according to two recent media reports. ”
Goodin reports, “When spotlight returns a preview of e-mails containing the term, it loads the images, overriding the option. Images are loaded even when the previewed message has landed in a users’ junk mail folder.”
Read more in the full article here.
MacDailyNews Take: Yeesh. There’s one to fix, Apple.
When is Apple going to spend as much time auditing OS X and iOS for security as they do flattening the UI and embedding Facebook?
Priorities
I agree. An update that goes all balls-out to make a rock solid bug-free OS would be more appreciated than more features most don’t use. Allocate and prioritize your resources Apple!
Impenetrable security in and of itself is becoming a prized feature, especially now.
“Snow Yosemite,” anyone?
Troll.
You like insecure software that you think looks good?
That is what you are defending.
Yosemite spotlight also seems to hit previously visited sites, but those sub-processes hang and can eat up huge amounts of RAM (2 GB of virtual memory). After disabling that Spotlight option on my 10GB RAM system it’s running a lot faster.
The next version of OS X should be Snow Covered Yosemite. Don’t add any new features, just make everything work better, or faster, or how it was in Snow Leopard.
Strongly agree with the MDN Take on this one – this kind of thing has GOT to be fixed!
Don’t even get me started on the Thunderstrike bootkit. Yikes.
If I’m understanding this correctly, Spotlight will incorrectly load the emails as a Preview IF the email matches your search criteria, and IF you hover over the email long enough for it to hunk you wanted to Preview it.
Oh, and the email has to have linked content that’s can actually compromise/infect your system.
While I agree it needs to be fixed, and fairly soon, I’d hardly call this a huge security risk….too many things have to go a certain way for it to happen.
This isn’t about infection, it’s about confirming to spammers that their email was received and viewed, i.e. a valid email address to send more spam.
Spotlight is yet another example of Microsoft-like suckitude that has been sneaking into Apple’s OS X. It was way better in Snow Leopard. In Snow Leopard, switching between searching for a file name or searching for words within a file was so much more intuitive.
These changes aren’t bugs. They are the result of misguided decision-making at Apple. Apple thinks they are cleaning up the interface by removing visible options but, instead, are rendering it less intuitive and more difficult to use. Apple keeps pushing features on us that we don’t like or want.
Spot on!
Apple’s software leadership is faltering badly. To the OBJECTIVE reviewer, all other things being equal, Mavericks and Yosemite have declined to be no more intuitive and no more stable than Windows 7. Sorry, but pro-Mac bias on this site does not change this fact. It seems to me that Apple leadership felt they had to respond to Windows 8 with a “flat-look” GUI, and they completely forgot about the critical need to make solid software under the hood.
I’ve hardly ever used Mail because it’s too slow. Thunderbird runs rings around it, and I can enlarge Thunderbird’s mailbox-list type size and icons beyond the pitiful extent OS X allows for Mail.
And Spotlight sucks, so it doesn’t appear in the menu bar and I’ve made the entire machine off-limits to it because the stuff it can’t find when turned on would fill boxcars anyway. I haven’t used it in years — since EasyFind came on the scene.
Both apps and the trouble they endlessly cause are only two examples of Apple’s descent into mediocrity then decreptitude, for the barbarians breached the gates with Yozemyte — which I also ignore.
As an immediate fix, I recommend disabling Mail searching in Spotlight.
1. Click (top left of screen)
2. Click System Preferences…
3. Click 🔍 Spotlight (top right of window)
4. Uncheck Mail & Messages.
Just to be clear, this is not a “fix”. This is disabling functionality that Apple didn’t get right.
If I was to buy a new Mac tomorrow, the first thing I would do is uninstall Yosemite and install Snow Leopard. The result would be a faster, more stable, more intuitive, more attractive machine that worked as advertised. We can only hope that the OS X team is divorced from the iOS team before quality on the Mac is driven down any further.