Comments on: GDS & Medical Information

By: Brendon J. Wilson

Brendon J. Wilson — Wed, 30 Nov -0001 00:00:00 +0000

Of course, this kind of vulnerability applies equally to any of the other desktop search tools. One has to wonder: will the Spotlight feature in Tiger (the next version of the Mac OS X) similarly risk exposing user’s sensitive data?

And do users recognize that GDS even poses a risk to data secured by hard disk encryption solutions? After all, as long as the data is accessible at some point (such as when the encrypted volume is mounted by the user), GDS will probably attempt to index it and, in doing so, risk leaking data outside the confines of the encrypted volume.

By: Evan Wise

Evan Wise — Wed, 30 Nov -0001 00:00:00 +0000

One more thing to note about the Spotlight Store: There is one content index and one meta-data store per file system. This keeps the content indexes and meta-data stores with the files they belong to—crucial when using external FireWire drives that travel from Mac to Mac.

from: http://developer.apple.com/macosx/tiger/spotlight.html

So it would appear that the GDS bug may hit again…

By: Brendon J. Wilson

Brendon J. Wilson — Wed, 30 Nov -0001 00:00:00 +0000

Well, actually, it would appear that the Spotlight design team was smart enough to avoid the problem entirely. Storing the index with the volume to which it relates guards against sensitive data residing on an encrypted volume from being exposed when the volume is not mounted.

However, I’m unclear on whether or not GDS has made the same design choice. Would require additional research.