Securing Desktop Search

Desktop search applications need to rethink data security. The index files created by desktop search applications provide in-the-clear paths to potentially sensitive information stored in my email, my browsing history and within files on my hard drive. Both Copernic Desktop Search and Google Desktop Search provide the means to search within history from secure Web pages, which likely means they are searching information like my credit card data. While this feature is turned off by default in Copernic and Google Desktop Search offers to turn off secure page search immediately after install, a novice user may not recognize the threat this potentially poses. All of this information is in the clear. The index files generated by desktop search apps are a road map to the information. Password protection at the operating system level doesn't improve security for reasons I mention in a recent article on securing your laptop data. It's not easy to park the indexes on an encrypted volume because they are stored in system folders that don't readily function when moved outside their expected location. When Longhorn provides full hard disk encryption for desktops, this problem may resolve itself. Over the short term, the safest course of action is to not index Web history, which in turn eliminates the possibility of maps to personal information being generated. If you send sensitive email transitions, you may be using PGP to encrypt the actual data transfer, but that doesn't prevent the contents from being indexed by way of your local Sent Items folder, which is another potential pathway to privacy or security violation. Long term, desktop search applications need a way to self police these security gaps. Encrypting the index files when the user is not authenticated would be the best mechanism for this. Yes, if someone discovers my Windows XP password, they still get access to the data, but with encryption on these indexes, no one will be able to access the index files by bypassing the operating system.