https://bugs.kde.org/show_bug.cgi?id=527962
Bug ID: 527962
Summary: Thumbnails for files in vaults and encrypted
filesystems get saved in ~/.cache/thumbnails,
completely unprotected.
Classification: Frameworks and Libraries
Product: kio-extras
Version First unspecified
Reported In:
Platform: Arch Linux
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: Thumbnails and previews
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Created attachment 197764
--> https://bugs.kde.org/attachment.cgi?id=197764&action=edit
Thumbnail of file in a vault got saved in wide open ~/.cache/thumbnails
DESCRIPTION
This is a privacy risk.
Files for encrypted file systems, including:
- fuse.gocryptfs
- fuse.cryfs
- fuse.encfs (potentially)
potentially extending to all file systems, are raw saved in
~/.cache/thumbnails, rendering the encryption useless as now anybody can open
the thumbnails directory and find thumbnails belonging to files in a vault.
This includes mounted Vaults and file systems mounted by standalone programs
like gocryptfs and cryfs, so a general rule to avoid saving thumbnails for the
listed above shall be applied.
STEPS TO REPRODUCE
1. Enable previews for remote files in Dolphin.
2. Make a vault and mount it.
3. Paste an image in it.
4, Unmount (close) the vault.
5. Close all tabs in Dolphin and finally close Dolphin itself.
6. rm -rf ~/.cache/thumbnails
7. From the Plasma Vaults applet, unlock it again.
8. Click the "Show in file explorer button" for it.
OBSERVED RESULT
A thumbnail was just generated for it, saved in ~/.cache thumbnails and visible
to anyone.
EXPECTED RESULT
Files for encrypted filesystems should never be saved outside of its tree,
including ~/.cache/thumbnails.
SOFTWARE/OS VERSIONS
Operating System (available in the Info Center app, or by running `kinfo` in a
terminal window):
KDE Plasma Version: 6.8.1
KDE Frameworks Version: 6.31.0
Qt Version: 6.12.0
ADDITIONAL INFORMATION
Potential solutions:
1. Restrict to save the thumbnails in:
- /thumbnails, where / is the encrypted file system mount
- An encrypted tmpdir, inaccessible by just browsing through /tmp
2. Disable thumbnail save to disk (not thumbnail generation) for encrypted file
systems
--
You are receiving this mail because:
You are watching all bug changes.
