Isn't the Spotlight Index File a Massive Security Threat?

Question

I'm wondering about the concept that Spotlight makes a really deep search -- and record -- of all user-created text files on your computer.
In order for Spotlight to know that a file called "My Personal Stuff.rtf" contains the words "bank", "account", "number", "1234-567890" it needs to copy each of those keywords into the Spotlight index. That means in effect that Spotlight is making a *complete copy* of *all words* in *all text documents* ever on or temporarily connected to your computer, except for un-searched words like "the", "and", etc.
If you've ever plugged your thumb drive into a public Mac somewhere, Spotlight got to work and copied all the (key-) words in every file on your thumb drive into the Spotlight index on that computer.
If you're happy that at least you had Filevault turned on when your laptop with the big corporate secrets and list of thousands of people's personal info got stolen -- there was also a non-Filevaulted Spotlight index on that computer with all the contents of every document extracted as keywords, for the sophisticated cyber criminals to pore over.
Of course, you can turn off Spotlight indexing -- if you never want to be able to find a file on your computer even by file name... on your own computer at least. Not on that other computer you're plugging your drive into.
Is there something I'm missing here?
I'm not the first to wonder this -- see this archived, and cluelessly unanswered and unconcluded -- post from last year:
http://discussions.apple.com/thread.jspa?threadID=1390619

Answer 1

glkdfhgkdfjghdfkgjhdfkgjh wrote:
I'm wondering about the concept that Spotlight makes a really deep search -- and record -- of all user-created text files on your computer.
In order for Spotlight to know that a file called "My Personal Stuff.rtf" contains the words "bank", "account", "number", "1234-567890" it needs to copy each of those keywords into the Spotlight index. That means in effect that Spotlight is making a *complete copy* of *all words* in *all text documents* ever on or temporarily connected to your computer, except for un-searched words like "the", "and", etc.
If you've ever plugged your thumb drive into a public Mac somewhere, Spotlight got to work and copied all the (key-) words in every file on your thumb drive into the Spotlight index on that computer.
If you're happy that at least you had Filevault turned on when your laptop with the big corporate secrets and list of thousands of people's personal info got stolen -- there was also a non-Filevaulted Spotlight index on that computer with all the contents of every document extracted as keywords, for the sophisticated cyber criminals to pore over.
Of course, you can turn off Spotlight indexing -- if you never want to be able to find a file on your computer even by file name... on your own computer at least. Not on that other computer you're plugging your drive into.
Is there something I'm missing here?
yes, you are. spotlight index for a drive is kept on that drive. it's not copied to any other drive. that also applies to virtual volumes contained in disk images like a filevaulted home directory. that is, spotlight index for a filevaulted home directry is stored inside the sparse bundle with that home directory. nobody else has access to it and when you are not logged into a filevaulted account there is no trace of the spotlight index for it on the system.
I'm not the first to wonder this -- see this archived, and cluelessly unanswered and unconcluded -- post from last year:
http://discussions.apple.com/thread.jspa?threadID=1390619
Message was edited by: V.K.