{"id":27225,"date":"2019-11-06T16:59:03","date_gmt":"2019-11-06T21:59:03","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=27225"},"modified":"2020-02-06T14:59:49","modified_gmt":"2020-02-06T19:59:49","slug":"siri-stores-encrypted-e-mails-in-plain-text","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2019\/11\/06\/siri-stores-encrypted-e-mails-in-plain-text\/","title":{"rendered":"Siri Stores Encrypted E-mails in Plain Text"},"content":{"rendered":"

Bob Gendler<\/a>:<\/p>\n

The snippets.db<\/em> database is storing encrypted Apple Mail messages…completely, totally, fully — UNENCRYPTED — <\/strong>readable, even with Siri disabled, without requiring the private key. Most would assume that disabling Siri would stop macOS from collecting information on the user. This is a big deal. This is a big deal for governments, corporations and regular people who use encrypted email and expect the contents to be protected. Secret or top-secret information, which was sent encrypted, would be exposed via this process and database, as would trade secrets and proprietary data.<\/p>

[…]<\/p>

Another database, entities.db<\/em>, stores records of people’s names, email, and phone numbers you’ve corresponded with. Although the phone number may not be in your contact list, data from emails such as signature blocks and forward information are stored. It’s like an address book built for you. This could be touchy, as it may allow quick and easy access to some potentially sensitive information.<\/p>\n

[…]<\/p>\n

For a company that prides itself on security and privacy, the lack of attention to detail on an issue like this completely and totally surprises me. […] I also have to wonder why it took 99 days for someone to know the answer on how to prevent this. All parties at Apple were alerted multiple times before writing this blog and giving an ample amount of time before I published this.<\/p><\/blockquote>\n

You can prevent it by going into the Siri settings and unchecking Mail. This does not remove e-mails that have already been stored in the database.<\/p>\n

The Suggestions<\/tt> folder is protected from apps that haven’t been given permission, but the data is unencrypted on disk if you aren’t using FileVault.<\/p>\n\n

Previously:<\/p>\n