Comments on: FileVault and QuickLook leak some information from encrypted volumes

By: kevin

kevin — Wed, 16 Feb 2011 04:58:46 +0000

Missing the point with this conversation, which is why so shady a method? These thumbnails , or “pictures” it is taking, what is wrong with storing in ~/Library/Caches?

By: Quicklook puede comprometer la seguridad que ofrece Filevault

Quicklook puede comprometer la seguridad que ofrece Filevault — Thu, 03 Feb 2011 09:09:13 +0000

[...] | OSXDaily En Applesfera | Filevault, ¿qué es y cómo funciona? 3 me [...]

By: J

Wed, 26 Jan 2011 08:13:41 +0000

Not if that VM is just memory mapped to a file on disk (which is the case).

By: Geoff Strickler

Geoff Strickler — Wed, 26 Jan 2011 07:34:53 +0000

Actually, it does have a real impact. Virtual memory must be allocated and swapped to disk. The reason I started looking into QL is because of the memory and CPU it was using at login. To quote Robert A. Heinlein, TANSTAAFL (there ain’t no such thing as a free lunch). Virtual memory does have an impact, even if it’s only temporary/transient.

The bottom line is that it uses resources on my system, and I never use it. So far, I’ve found no way to disable it and recover the resources it uses.

By: J

Wed, 26 Jan 2011 04:55:21 +0000

Quick Look does not really “allocate” 500MB of memory. It’s purely virtual and generally accounts for a very small amount of real wired memory. This has no real impact on the global system performances.

By: Geoff Strickler

Geoff Strickler — Wed, 26 Jan 2011 00:13:24 +0000

There is definitely an issue with Quick Look. I don’t know about FileVault, but it creates and caches previews for files in TrueCrypt encrypted volumes.

It’s certainly missing a level of transparency and manageability showing what it’s doing, what’s stored where, etc.

There is also the fact it for those of us who don’t use QL, not being able to disable it makes it a complete waste of resources. On my machine, It allocates over 500MB of VM, for a feature that I never use.

How do I tell QL to ignore some/all volumes?

By: J

Tue, 27 Jul 2010 07:30:02 +0000

As I mentioned in my previous comment, Quick Look does not store anything in its cache that comes from encrypted volumes.

If you really want to reset the cache, use “qlmanage -r cache” in a Terminal.

By: mdoorkeeper

mdoorkeeper — Tue, 27 Jul 2010 05:32:16 +0000

Found it in cd ‘/private/var/folders/M4/M4C9EH+OHfCUCPjIRmQAUU+++TI-Caches-/com.Apple.QuickLook.thumbnailcache/’ What would be the consequence of simply deleting the whole com.Apple.QuickLook.thumbnailcache folder?
…and what application can open the files therein so I can read them?

By: DistortedLoop

DistortedLoop — Mon, 26 Jul 2010 12:46:21 +0000

If J is correct, not a big deal, but if the stuff is actually cached, why not just add a script to your machine that periodically deletes the cache file during the day? At least it would lessen the damage on a breach.

By: J

Sun, 25 Jul 2010 19:35:23 +0000

Thumbnail cache is disabled for encrypted volumes, including file vault users. You should be able to confirm with following terminal command:

qlmanage -m disks

If this is not the case, there is definitely a bug in Quick Look.

By: B

Sun, 25 Jul 2010 17:29:56 +0000

Good question, you can kill the daemon from running by using

killall -9 quicklookd

but that is not a permanent solution.

it might be best to just not use quicklook thus not allowing the thumbnails to be generated. I have yet to find a way to disable Quick Look completely.

By: Steve

Steve — Sun, 25 Jul 2010 15:43:05 +0000

So how do you disable QuickLook?