{"id":81112,"date":"2018-07-20T13:40:07","date_gmt":"2018-07-20T20:40:07","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=81112"},"modified":"2019-06-15T02:45:02","modified_gmt":"2019-06-15T09:45:02","slug":"apples-quick-look-reveals-your-darkest-secrets","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/apples-quick-look-reveals-your-darkest-secrets\/","title":{"rendered":"Apple’s Quick Look reveals your darkest secrets"},"content":{"rendered":"

Quick Look in the macOS Finder. Image: Apple<\/a><\/p><\/div>\n

For more than a decade, macOS has included a feature called Quick Look<\/strong> that makes it easy to preview files right within the Finder, without\u00a0having to launch an\u00a0app.<\/p>\n

While Quick Look\u00a0can certainly\u00a0be a useful feature, its implementation in macOS\u00a0has some\u00a0surprising and potentially disturbing privacy implications.<\/p>\n

Let’s take a look at why the feature\u00a0may be problematic and what you can do to safeguard your private data.<\/p>\n

What Exactly Is Quick Look?<\/h3>\n

Introduced in Mac OS X 10.5 Leopard<\/a>, Quick Look\u00a0displays file previews right within the Finder<\/a> for a variety of common file types, including but not limited to photographs and other images, plain text and rich text files,\u00a0PDFs, Microsoft Office documents, Web pages, and documents in Apple’s Pages, Keynote, and Numbers formats.<\/p>\n

\"\"

Clicking on a file in the Finder and pressing space bar invokes Quick Look. Image: Pixabay<\/a><\/p><\/div>\n

When a user clicks on a file and presses the space bar on the keyboard,\u00a0a preview image is generated and displayed in the Finder. To avoid having to generate the same preview again every time Quick Look is invoked for that file, macOS caches the preview image to the Mac’s internal hard drive.<\/p>\n

Even without<\/em> manually invoking\u00a0the feature via the space bar,\u00a0Quick Look\u00a0may nevertheless generate and cache small previews automatically. Simply\u00a0opening\u00a0a folder in the Finder will generate previews\u00a0of sufficient quality as\u00a0to reveal the files’ contents.<\/p>\n

\"\"<\/a>

Viewing a folder can generate preview images clear enough to\u00a0reveal\u00a0file contents. Image: Wardle<\/a><\/p><\/div>\n

What’s the Privacy Concern?<\/h3>\n

\"\"While the Quick Look feature is very\u00a0convenient and not necessarily a concern for most Mac users, highly privacy conscious users may be dismayed to learn that\u00a0Quick Look doesn’t\u00a0properly respect users’ implicit desires for privacy, as detailed in a technical article<\/a> by Wojciech Regu\u0142a and Patrick Wardle.<\/p>\n

The main issue is that external drives and drives that are no longer mounted\u2014including fully encrypted disks<\/em>\u2014are cached to the Mac’s internal hard drive.<\/p>\n

If you’ve taken the time to\u00a0fully encrypt an external hard drive<\/a>, or if you’ve gone to the trouble of creating an encrypted disk image<\/a> to keep sensitive files private, you’ve made a clear and unmistakable choice to\u00a0safeguard the files contained within that volume and keep them away from prying eyes.<\/p>\n

Unfortunately, so far Apple has not chosen to respect\u00a0your implicit desire for privacy\u00a0when it comes to Quick Look caching.<\/p>\n

Whenever\u00a0you have\u00a0a drive or disk image mounted on your Mac, even if that disk is encrypted or password-protected, macOS will treat it like any other disk and may cache Quick Look\u00a0previews of your sensitive files.<\/p>\n

\"\"<\/a>

Even password-protected disks’ files may be cached by Quick Look. Image: USC<\/a><\/p><\/div>\n

This means that anyone who later gains access to the contents of your\u00a0Mac’s internal drive\u2014even\u00a0when that external drive is no longer connected<\/em>\u2014may be able to see previews of all your private files.<\/p>\n

So What?\u00a0Doesn’t\u00a0FileVault\u00a0Protect Me?<\/h3>\n

\"\"You may wonder why this matters given that every version of macOS since Yosemite has offered to encrypt the Mac’s internal hard drive<\/a>\u00a0by default\u00a0when you do a clean install. Shouldn’t that mean that\u00a0Quick Look previews should be secure?<\/p>\n

It’s important to be aware that your internal hard drive\u00a0may not necessarily be encrypted; there are a number of scenarios in which your Mac’s drive might never have had whole-disk encryption enabled.<\/p>\n

The\u00a0easiest way to tell if your Mac’s internal drive is encrypted is to open Disk Utility (you can find it by looking\u00a0in the Utilities folder inside the Applications folder, or by doing a Spotlight<\/a> search for it by name). When you open Disk Utility, your Mac’s internal\u00a0boot volume will already be selected. If the\u00a0disk is encrypted, you’ll see either “APFS (Encrypted)” or “Mac OS Extended (Journaled, Encrypted)” displayed beneath your drive’s name.<\/p>\n

\"\"<\/p>\n

But\u00a0even if\u00a0your\u00a0internal drive\u00a0is\u00a0encrypted<\/em>, you shouldn’t assume that your Quick Look cache or any other files will always remain private.<\/p>\n

If you ever leave your Mac unlocked and\u00a0unattended for a while, someone could walk up to your computer and get full access to your documents.<\/p>\n

\"\"Or if your Mac becomes infected with a RAT<\/a>, an attacker may be able to access your files remotely, regardless of\u00a0whether your drive is encrypted.<\/p>\n

Full-disk encryption\u00a0only prevents access to a drive’s contents when it\u00a0isn’t mounted.\u00a0When the drive is mounted, it’s just as accessible to spies as an unencrypted drive.<\/p>\n

How To\u00a0Disable Quick Look Caching<\/h3>\n

If you’re wondering\u00a0whether there’s a way to prevent Quick Look from caching previews of all your files, the answer is yes\u2014you’re in luck!<\/p>\n

You can\u00a0copy and paste the following commands into the Terminal app (which you can find in the Utilities folder or via Spotlight) to disable Quick Look caching and delete the database:<\/p>\n

qlmanage -r disablecache\r\nqlmanage -r cache\r\nrm -rf $TMPDIR\/..\/C\/com.apple.QuickLook.thumbnailcache<\/span><\/pre>\n
You may wish to restart your\u00a0Mac after running these commands.<\/p>\n
Where Can I Learn More?<\/h3>\n
For more technical details about Quick Look’s caching issue,\u00a0you can check out\u00a0Regu\u0142a and Wardle’s article<\/a>.<\/p>\n
We also discussed the Quick Look problem on episode 40<\/a> of the Intego Mac Podcast<\/strong>. Be sure to subscribe to\u00a0the\u00a0Intego Mac Podcast<\/strong><\/a>, the\u00a0Intego YouTube channel<\/strong><\/a>, and\u00a0The Mac Security Blog<\/strong>\u00a0to stay\u00a0informed about\u00a0the latest Apple security news.<\/p>\n","protected":false},"excerpt":{"rendered":"
For more than a decade, macOS has included a feature called Quick Look that makes it easy to preview files right within the Finder, without\u00a0having to launch an\u00a0app. While Quick Look\u00a0can certainly\u00a0be a useful feature, its implementation in macOS\u00a0has some\u00a0surprising and potentially disturbing privacy implications. Let’s take a look at why the feature\u00a0may be problematic […]<\/p>\n","protected":false},"author":14,"featured_media":81253,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[10,5],"tags":[273,573,333,106,3772],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\n\t\n\t\n\t\n