{"id":10452,"date":"2015-01-12T17:04:56","date_gmt":"2015-01-12T22:04:56","guid":{"rendered":"http:\/\/mjtsai.com\/blog\/?p=10452"},"modified":"2015-01-12T17:04:56","modified_gmt":"2015-01-12T22:04:56","slug":"spotlight-suggestions-and-web-bugs","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2015\/01\/12\/spotlight-suggestions-and-web-bugs\/","title":{"rendered":"Spotlight Suggestions and Web Bugs"},"content":{"rendered":"<p><a href=\"http:\/\/arstechnica.com\/security\/2015\/01\/spotlight-search-in-yosemite-exposes-private-user-details-to-spammers\/\">Dan Goodin<\/a>:<\/p>\n<blockquote cite=\"http:\/\/arstechnica.com\/security\/2015\/01\/spotlight-search-in-yosemite-exposes-private-user-details-to-spammers\/\">\n<p>Using the Spotlight search feature in OS X Yosemite can leak IP addresses and private details to spammers and other e-mail-based scammers, according to tests independently performed by two news outlets.<\/p>\n<p>[&#8230;]<\/p>\n<p>Mail allows users to block remote images for precisely this reason. But even when remote image viewing is disabled in Yosemite-based Mail app settings, the images will be opened by Spotlight, according to two recent media reports. The feature is used to search a Mac for files or e-mail containing a specified search term. When spotlight returns a preview of e-mails containing the term, it loads the images, overriding the option. Images are loaded even when the previewed message has landed in a users&rsquo; junk mail folder.<\/p>\n<\/blockquote>\n<p><a href=\"http:\/\/www.imore.com\/spotlight-spam-email-and-what-you-need-know\">Rene Ritchie<\/a>:<\/p>\n<blockquote cite=\"http:\/\/www.imore.com\/spotlight-spam-email-and-what-you-need-know\">\n<p>As described above, email can be turned into a pseudo webpage by requesting server-side images &mdash; including tracking pixels &mdash; be loaded into them. Instead of attaching an image, which embeds the image in the email, they pull it from a website: http:\/\/example.com\/image.gif. If &ldquo;load remote content&rdquo; is enabled, that image will be pulled as soon as you open the email, and the website will get your IP address and other information just as if you visited the site directly.\n<\/p>\n<\/blockquote>\n<p>As I recall, the same bug has always been present in Quick Look. Quick Look thumbnails seemingly try to load the images but are thwarted by the sandbox. Quick Look previews load the images regardless of the setting in Mail.<\/p>\n<p>See also: <a href=\"http:\/\/mjtsai.com\/blog\/2014\/10\/19\/spotlight-suggestions-and-privacy\/\">Spotlight Suggestions and Privacy<\/a> and <a href=\"http:\/\/c-command.com\/spamsieve\/help\/does-spamsieve-stop-web\">SpamSieve&rsquo;s documentation on Web bugs<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"<p>Dan Goodin: Using the Spotlight search feature in OS X Yosemite can leak IP addresses and private details to spammers and other e-mail-based scammers, according to tests independently performed by two news outlets. [&#8230;] Mail allows users to block remote images for precisely this reason. But even when remote image viewing is disabled in Yosemite-based [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"","apple_news_api_id":"","apple_news_api_modified_at":"","apple_news_api_revision":"","apple_news_api_share_url":"","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[131,150,30,903,355,1103,1042,1102],"class_list":["post-10452","post","type-post","status-publish","format-standard","hentry","category-technology","tag-bug","tag-email","tag-mac","tag-mac-os-x-10-10-yosemite","tag-privacy","tag-quick-look","tag-spotlight","tag-web-bugs"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/10452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=10452"}],"version-history":[{"count":1,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/10452\/revisions"}],"predecessor-version":[{"id":10453,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/10452\/revisions\/10453"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=10452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=10452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=10452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}