Private items that are hidden can be printed without knowing the password

Support related problems and questions

Moderators: TerryRogers, Max

Post Reply
MetalDrop
Guru
Posts: 866
Joined: Sat Apr 09, 2016 10:19 pm
Been thanked: 189 times

Private items that are hidden can be printed without knowing the password

Post by MetalDrop »

Because private items that are hidden can still be found in advanced search and tag explore they can have quick print used on them, which allows the data to breached without knowing the password.

Funny note: This security hole is brought to you by my 8yo nephew.
2020-11-03_125521.png
EPIM Portable Pro Running/Tested On: Windows 11 Pro 64-bit US-ENG|i5-6400+Quadro P620|i7-7700K+1050ti|i7-8700K+970GTX|AMD 5600x+1080ti|16GB+RAM&NVMe SSDs
[I'm helpful and often reply to questions, however I am just a fellow user and not staff.]
a8907433
Guru
Posts: 1047
Joined: Fri Mar 12, 2010 11:57 pm
Been thanked: 170 times

Re: Private items that are hidden can be printed without knowing the password

Post by a8907433 »

But you only can do an advanced search, when you type in the password! At least in my database I am asked for the password, every time I do an advanced search.
MetalDrop
Guru
Posts: 866
Joined: Sat Apr 09, 2016 10:19 pm
Been thanked: 189 times

Re: Private items that are hidden can be printed without knowing the password

Post by MetalDrop »

a8907433 wrote: Wed Nov 04, 2020 5:12 am But you only can do an advanced search, when you type in the password! At least in my database I am asked for the password, every time I do an advanced search.
Interesting, all my databases are encrypted with private items hidden and I have never been asked for a password to do an advanced search, and I don't see any options that would effect that.
EPIM Portable Pro Running/Tested On: Windows 11 Pro 64-bit US-ENG|i5-6400+Quadro P620|i7-7700K+1050ti|i7-8700K+970GTX|AMD 5600x+1080ti|16GB+RAM&NVMe SSDs
[I'm helpful and often reply to questions, however I am just a fellow user and not staff.]
admin
Site Admin
Posts: 15601
Joined: Thu Nov 25, 2004 3:12 am
Has thanked: 1411 times
Been thanked: 984 times

Re: Private items that are hidden can be printed without knowing the password

Post by admin »

Interesting find, indeed. Will take care of that in the next update.
Android version of EssentialPIM. Keep all your data in sync!
admin
Site Admin
Posts: 15601
Joined: Thu Nov 25, 2004 3:12 am
Has thanked: 1411 times
Been thanked: 984 times

Re: Private items that are hidden can be printed without knowing the password

Post by admin »

This is fixed in EPIM 9.5.1.
Android version of EssentialPIM. Keep all your data in sync!
MetalDrop
Guru
Posts: 866
Joined: Sat Apr 09, 2016 10:19 pm
Been thanked: 189 times

Re: Private items that are hidden can be printed without knowing the password

Post by MetalDrop »

admin wrote: Thu Nov 05, 2020 9:32 pm This is fixed in EPIM 9.5.1.
This just made it so a password is required for advanced searched, which is an unusable change for me.

I want my nephew to be able to do advanced search without me having to give him the password.

The idea of having the items private and hidden is so that I can let people(kids) like my nephew use the open copy of EPIM on my computer without worrying about them getting into documents they sholdn't.
EPIM Portable Pro Running/Tested On: Windows 11 Pro 64-bit US-ENG|i5-6400+Quadro P620|i7-7700K+1050ti|i7-8700K+970GTX|AMD 5600x+1080ti|16GB+RAM&NVMe SSDs
[I'm helpful and often reply to questions, however I am just a fellow user and not staff.]
admin
Site Admin
Posts: 15601
Joined: Thu Nov 25, 2004 3:12 am
Has thanked: 1411 times
Been thanked: 984 times

Re: Private items that are hidden can be printed without knowing the password

Post by admin »

So what you're suggesting is to simply ignore and do not show private and hidden items in the advanced search results?
Android version of EssentialPIM. Keep all your data in sync!
Rose Ford
Guru
Posts: 187
Joined: Sun May 08, 2016 8:39 am
Has thanked: 1 time
Been thanked: 30 times

Re: Private items that are hidden can be printed without knowing the password

Post by Rose Ford »

admin wrote: Thu Nov 05, 2020 10:07 pm So what you're suggesting is to simply ignore and do not show private and hidden items in the advanced search results?
+1 requiring a password to do advanced search is causing issues for me and my family/friends.

My suggestion would be:

1: An option in security. [My preferred option, as I've never liked the fact hidden items show up anywhere.]

or

2: Ask for a password before quick printing if an item is private/hidden.
TumbleDoor
Guru
Posts: 138
Joined: Tue Jun 21, 2016 7:19 am
Been thanked: 15 times

Re: Private items that are hidden can be printed without knowing the password

Post by TumbleDoor »

Had to roll back from this update.

I use advanced search so often having to enter my password every time would be crazy.

I like option 1, suggested by Rose. I've always a bit bothered by the fact they showed up in advanced search.
Keldi
Guru
Posts: 377
Joined: Thu Aug 23, 2012 11:42 am
Has thanked: 26 times
Been thanked: 92 times

Re: Private items that are hidden can be printed without knowing the password

Post by Keldi »

If we are speaking of an option, I'd much prefer it to be right in the Advanced Search, so there was an indicator right away that something will be excluded from the search. It's too easy to forget about setting something somewhere else that might influence the search results.
epim_advanced-search.png
epim_advanced-search.png (9.37 KiB) Viewed 907 times
The way I see it:
- the checkbox is unchecked = private items are excluded from the search, the password isn't asked to start the advanced search;
- clicking on the unchecked checkbox = one-time entering the password to start including private items;
- the checkbox is checked = private items are included into the search, the password isn't asked to start the advanced search (the state of the checkbox is remembered between re-opening the Advanced Search/re-starting EPIM);
+ an option in the Security settings: Automatically lock the Advanced Search if private items are included into the search = the password is asked every time to start the Advanced Search when the checkbox is checked to include private items. Clicking on Cancel of the password window will still open the Advanced Search but also will clear the checkbox to exclude private items.

Regards
admin
Site Admin
Posts: 15601
Joined: Thu Nov 25, 2004 3:12 am
Has thanked: 1411 times
Been thanked: 984 times

Re: Private items that are hidden can be printed without knowing the password

Post by admin »

Thanks very much for your thoughts! Will improve how the feature works in the next update based on your feedback.
Android version of EssentialPIM. Keep all your data in sync!
Post Reply