MAJOR privacy bug on Mac!

[Tony Montana 0]

Hi!

I have tried to reach out to the Evernote team about this earlier, but I got no response. So now I will try here instead.

If you press Cmd + space on your Mac, you can search for everything on your computer. And if you have Evernote installed, you can search for everything that's been written in Evernote, even if you're not logged in. Because when you do that search (on the Mac), you get a little preview/thumbnail that shows the some of the text that's been written in Evernote.

In my case, I had a note with passwords in Evernote. And when I searched for the word "password" on my Mac, a small thumbnail showed up and revealed the first password in that note. And I had Evernote installed on my work computer, and even though I'm the only one using it, other people can access my computer when I'm not at work.

This is a MAJOR privacy conflict in my opinion, and I really hope you will fix this as soon as possible. I have now uninstalled Evernote from my work computer until this bug gets fixed. Because this this is not good at all.

[Tony Montana 0]

Why doesn't anyone from Evernote respond to this?

[jefito 5,589]

Moved to Mac-specific forum.

This is mainly a user forum, and not an official Evernote support forum, so while Evernote employees do sometimes respond here, it's not all that often. You might be better off trying the advice from the top of the forum: " If you're active on Twitter, try your hand with our @evernotehelps feed. It's helmed by a crack team out of Austin, TX who are here to answer your questions. They're generally active from 7am-4pm CST.  https://twitter.com/evernotehelps  "

That being said, if you have passwords in Evernote, you should be using some form of encryption on them, particularly if other people have access to your machine. In particular, you should never assume that information on a work computer is private. You should be able to use the in-built Evernote encryption facilities to secure your passwords  See  https://help.evernote.com/hc/en-us/articles/209005547-How-to-encrypt-content-inside-Evernote. There may be other methods on Mac, but I'm not a Mac user, so maybe someone else might help.

Edit:

On 9/21/2017 at 2:39 AM, Tony Montana said:

This is a MAJOR privacy conflict in my opinion, and I really hope you will fix this as soon as possible. I have now uninstalled Evernote from my work computer until this bug gets fixed. Because this this is not good at all.

Unless Evernote is exposing encrypted content to Mac search, this is not a bug. You have no expectation of privacy on a machine that's provided by your employer. If that's the case for you, then you need to take steps to protect your private personal information from prying eyes. There are any number of things that you can do: keep separate work and personal accounts (I do this), use Evernote's encryption to protect private information, use third-party tools, etc.

 

[DTLow 5,736]

On 2017-09-20 at 11:39 PM, Tony Montana said:

This is a MAJOR privacy conflict in my opinion

You might want to use a password to protect access to your computer

[upnix 36]

Even when logged out of Evernote, the content is still all on the hard drive, unencrypted for the logged in user (macOS user).

I can imagine a way of preventing Spotlight from using Evernote's index, so your notes wouldn't show up in Spotlight searches. Of course, now you can't search your notes at all in Spotlight. Another workaround could be to put passwords farther down in the note so they don't appear in the preview.

Encrypting your passwords in the note, or just not keeping there might be most realistic.

 

Long story short, I think this is just the nature of the beast.

[Metrodon 2,184]

Switch on FileVault to encrypt your hard drive.

Exclude the Evernote data folder from Spotlight

Use a password to protect your account and lock your machine when you're not in front of it

Don't store passwords in a notes app...

 

MAJOR privacy bug (it's not a bug) averted

[evernoteforumQ 4]

Which Evernote data folder should be excluded from Spotlight?  I have tried to exclude many Evernote folders from Spotlight by dragging them to the exclusion list but that doesn't seem to work. This pathway mentioned by Engberg in the thread below in 2011 is out-of-date