tag:support.primatelabs.com,2011-01-31:/discussions/voodoopad/17921-encrypted-pages-are-cached-unencryptedPrimate Labs: Discussion 2019-12-21T04:01:58Ztag:support.primatelabs.com,2011-01-31:Comment/469664172019-02-16T00:00:17Z2019-02-16T00:00:17ZEncrypted pages are cached unencrypted<div><p>I just noticed that the pages of my encrypted VoodooPad document also exist as unencrypted copies with the file type .vpspotlight in Library/Caches/Metadata/VoodooPad</p>
<p>As the cached pages are indexed by Spotlight a Finder search for "bank" (for example) will locate the cached unencrypted copy of the VoodooPad page with my bank details which can then be opened and read in TextEdit.</p>
<p>I'm running VoodooPad 5.3.0 on a MacBook Pro (Retina 13", early 2015) with OS 10.14.3</p></div>Hawfinchtag:support.primatelabs.com,2011-01-31:Comment/469664172019-03-28T13:32:56Z2019-03-28T13:32:58ZEncrypted pages are cached unencrypted<div><p>Jesus---this is a major security hole!!</p>
<p>Primate Labs, are you going to release a fix for this anytime soon???</p>
<p>Can you tell us when we can expect the fix to be available?</p></div>Marcustag:support.primatelabs.com,2011-01-31:Comment/469664172019-04-04T03:38:40Z2019-04-04T03:38:40ZEncrypted pages are cached unencrypted<div><p>We've looked into this issue and are unable to reproduce it on our systems. The VoodooPad Spotlight plugin should not be able to read encrypted documents as it executes in a separate process.</p>
<p>Hawfinch, was the document always encrypted? Do you recall what versions of VoodooPad have opened that document on your Mac? Do you store the document password in your keychain?</p></div>Johntag:support.primatelabs.com,2011-01-31:Comment/469664172019-04-04T15:18:06Z2019-04-04T15:18:06ZEncrypted pages are cached unencrypted<div><p>Hi John,</p>
<p>The document has always been encrypted since I started using it (about 2 years ago) on this MacBook. I've always kept VoodooPad up to date, so all previous versions going back 2 years would have opened it on this Mac. Before that, I was using the document on another Mac going back to 2012.</p>
<p>The password is not in Keychain or anywhere else on my Mac.</p>
<p>Some further info. I store the document in my Dropbox folder for syncing. Today I created a new page in the encrypted document, and within seconds the page appeared (unencrypted) as a .vpspotlight file in Username/Library/Caches/Metadata/VoodooPad</p>
<p>It looks very much like Spotlight is able to see and cache the contents of open tabs in VoodooPad.</p></div>Hawfinchtag:support.primatelabs.com,2011-01-31:Comment/469664172019-04-07T04:23:02Z2019-04-07T04:23:02ZEncrypted pages are cached unencrypted<div><p>Thank you for the additional information. I'll continue to investigate, and I will let you know if I have any additional questions.</p></div>John