With OSX 10.10 Yosemite, Apple has moved iCloud Drive, their Dropbox competitor, to the forefront. Other features include Continuity, the ability to seamlessly switch from editing a file on one’s Mac to an iOS device.
Prior to 10.10, a change was made that abolishes the save/delete “What do you want to do with this file?” prompt when you’d quit a document-based application. Files in open windows were saved to a buried “Saved Application State” directory, and automatically reopened in the same place when you relaunched the app. This enabled restarting without user intervention, quitting apps and automatically restarting them exactly where one left off.
I had a dozen such documents open in TextEdit, the text editor that Apple ships with OSX. Somewhat akin to what Stickies used to do, I kept various notes here, knowing they’d be stored locally on my computer, knowing that they’d survive quits/reboots without me picking a place to save them.
Fast forward to 10.10. Presumably to support Continuity, current document state is no longer only saved locally - those in-progress (not yet explicitly “saved”) documents live in iCloud Drive, so that they can be opened on other devices without ever having to hit “save”. This is useful, however, all of my previous open files have now been synchronized to Apple servers.
This was the sequence:
- Open text editor, create some new documents. Store PII, passwords, seed values, phone call notes, love letters, et c. in them.
- Quit text editor.
- Reopen text editor several times over the course of a year, add more notes. Previous notes remain, safely in
~/Library/Saved Application State/on my local, encrypted computer. - Upgrade to Yosemite
- Notice that all of my locally-stored, “unsaved” documents open in my text editor have now been uploaded in full to a partner in NSA’s PRISM program.
Update, 26 October 2014: This happens for all applications (think iA Writer, Pixelmator, et c) that had saved application state. Any open and yet-unsaved document within an app is now silently and automatically uploaded to iCloud Drive, and, by extension, the government.
This is unacceptable.
Before you comment with the location in System Preferences wherein I can disable iCloud document support for TextEdit.app: you are missing the point.
Apple has taken local files on my computer not stored in iCloud and silently and without my permission uploaded them to their servers - across all applications, Apple and otherwise.
What now?
Update
Turns out it’s even worse.
iCloud Preferences Sync PII Leakage
Check out~/Library/Containers/com.apple.corerecents.recentsd/Data/Library/SyncedPreferences/recentsd-com.apple.mail.recents.plist. It would appear that iCloud is synchronizing all of the email addresses of people you correspond with, even for non-iCloud accounts, to their recent addresses service. This means that names and email addresss that are not in iCloud contacts, not synchronized to your device, and only available in an IMAP-accessed inbox are now being sent to Apple, silently.