It was recently discovered that the Apple Mail app (available in the macOS stores) leaves a portion of emails users' encrypted in plain text . The discovery and disclosure was made by Apple expert Bob Gendler.
The expert noticed that a portion of the emails are left in plain text in a database, called snippets.db. The security affects all versions of macOS.
The company has been informed of the problem (after it was discovered by an employee), but a patch to fix it has not yet been released.
“If you send encrypted emails from the Apple Mail app, there’s a way for some parts of those emails to be read as if they weren’t encrypted — and it seems Apple has been aware of this security issue for months but hasn’t offered a fix,” The Verge reported.
The company told The Verge that it plans to fix the issue with a future update software. It also noted that only a small portion of emails are displayed in plain text. However, that doesn’t excuse the fact that Apple has known about the issue for a long time and hasn’t done anything to fix it.
The expert discovered the security issue while investigating how the virtual assistant Siri.
Siri gets various information from many applicationsin order to be able to give better answers to users.
According to Gendler, Siri uses a process called “suggestd”that allows it to collect information from various apps. The information it collects is stored in the snippets.db file.
Siri also gets information from the Apple Mail app. Users use it to send and receive encrypted emails. However, there is this security issue that leaves some of the content in plain text, and Siri, through the “suggestd” process, collects this information and stores it in plain text in the database .
“Let me say that again… The snippets.db database stores emails from Apple Mail … UNENCRYPTED— they can be read even with Siri disabled, without requiring a private key. Most would assume that disabling Siri would stop the information collection. This is a big deal. It’s a big deal for governments, companies , and ordinary users who use encrypted emails and expect the content to be protected,” says The Verge.
According to the expert, disabling Siri will not stop the process of collecting content from encrypted emails.
There are three ways to stop Apple Mail from collecting messages:
- Go to settings, go to System Preferences → Siri → Siri Suggestions & Privacy → “Uncheck” the boxes for Apple Mail.
- Run the following command in Terminal to prevent Siri from receiving information from Apple Mail: defaults write com.apple.suggestions SiriCanLearnFromAppBlacklist -array com.apple.mail
- Deploy a configuration profile (for all users) to prevent Siri from receiving information from Apple Mail.
The third solution is permanent. It will disable the ability to collect information from Apple Mail. Additionally, future operating system updates will not re-enable the collection process.
Gendler also suggests removing the snippets.db file, located in “/Users/(username)/Library/Suggestions/”.
