Tao Effect Blog

Espionage 3.7.4 Released + Notarization-free Release

Wed, 22 Jan 2025 18:42:54 GMT

Espionage 3.7.4 introduces some minor (but necessary) updates as we migrate our mailing list.

We’re also doing something new for this release: we’re releasing two versions of this app: one that is “Apple approved (but messed with)” and another that comes directly from us.

You see, many years ago, Apple decided that Apple developers were no longer allowed to distribute apps directly to users. Instead, they require that, in addition to local code signing, apps be first uploaded to Apple’s servers to be messed with (for “notarization”), and then redownloaded before distributing it to users.

We think this is a terrible idea.

What’s stopping … Read more

Espionage 3.7.2/3.7.3 — Native Apple Hardware Universal Binary

Thu, 31 Dec 2020 02:01:29 GMT

Espionage 3.7.2 (and 3.7.3) bring a notarized universal binary with better M1 and Big Sur support, and some minor bug fixes. Many thanks to Jeff Johnson of Lapcat Software for help with this release!

Changes

Improvements!
- Univeral Binary for full native compatibility with M1 processor. (EDIT: hopefully for real in 3.7.3!)
- Updated OpenSSL and Sparkle.
Fixes
- Crash during setup on macOS Big Sur + M1.
- Text shadow direction in notifications on Catalina and higher.
Misc.
- Added Jeff Johnson to credits.
- Updated Readme to remove mention of iSpy & other minor changes.
- Removed Growl.

The signature for Espionage.dmg is Read more

Espionage 3.7 Released!

Wed, 31 Oct 2018 02:54:14 GMT

Espionage 3.7 (and 3.7.1) bring improved macOS Mojave support.

Changes

New!
- macOS Mojave Dark Theme support.
Fixes
- macOS Mojave broke restoring folders, this build fixes that.
- Fixed some potential memory leaks and new compiler warnings.
- (3.7.1) Crash during setup on macOS Mojave.

The signature for Espionage.dmg is here and also Read more

Espionage 3.6.6 Released!

Mon, 26 Sep 2016 03:54:54 GMT

Nothing exciting, just an important bug fix. In the meantime, we’re continuing our work to sustainably open-source Espionage.

Fixes
- Fixed crash on macOS Sierra during installation.

The signature for Espionage.dmg is here and also here (pubkey here). The SHA256 of the main binary is also noted below.

Enjoy! 😀

[Security] Protecting Mail On Recent Versions Of OS X

Fri, 05 Aug 2016 04:07:46 GMT

It has been brought to our attention that recent versions of Mail on OS X (perhaps starting with 10.10, but definitely since 10.11), will re-download all of your email from your email server. And since your server doesn’t encrypt your email, that’s a serious concern.

This means that the following attack is possible to bypass Espionage’s protection of your email:

While Mail’s folder(s) are locked and empty, open Mail.
Follow the dialogs and allow Mail to import your messages.
Wait for a while as your email is re-downloaded.

We do not believe this behavior existed in older versions of OS X, but we still should have noticed earlier. Our sincere apologies for … Read more

Espionage 3.6.3 drops 10.7, 10.8, 10.9 + Sparklegate Fix

Sun, 14 Feb 2016 01:03:24 GMT

EDIT February 17, 2016: 3.6.4 and 3.6.5 release notes included here as there are only minor changes.

We’re momentarily back from our break in cryptocurrency-research-land (where we’ve been advancing our goal of sustainably open-sourcing Espionage) to bring you the immediate release of Espionage 3.6.3!

“But wait! This doesn’t seem like such an exciting release! What is this business about dropping support for three operating systems? Are you trying to screw us over?! Bad Tao Effect, bad!”

*ahem*

Our dear customers, we love you, we only want what’s best for you, and we will never try to screw you over. ^_^

10.7, 10.8, and … Read more

Apologies! Sky Kinda Falling + Protecting Yourself From Sparklegate

Tue, 02 Feb 2016 05:38:10 GMT

This is a followup to yesterday’s post: Sky Not Falling: Sparklegate Not As Bad As It Could Be

After trying and failing to reproduce Sparklegate, I arrived at the conclusion that Gatekeeper and Quarantine did in fact protect OS X users from the Remote Code Execution (RCE) attack.

What I Missed

Radek, the discoverer of the vulnerability, insisted that I was mistaken and that Gatekeeper really did get bypassed. So today I attempted to reproduce the attack using a fresh account on a different machine.

It turns out, if you’ve ever opened Firefox, you are not vulnerable (to the FTP … Read more

(UPDATED) Sky Not KINDA Falling: Sparklegate Not As Bad As It Could Be

Mon, 01 Feb 2016 03:11:37 GMT

UPDATE February 1, 2016: It turns out some users are vulnerable to this attack. Read this followup post!

Sparklegate is the term I’ve coined for the recent discovery that, allegedly, every OS X machine out there is vulnerable to RCE (remote-code-execution) attacks because the widely used Sparkle framework, along with OS X’s standard WebView component, allow webpages to mount FTP volumes and run arbitrary programs on your computer.

The first report of this insane vulnerability restricted itself to the use of a terminal settings file to achieve this feat. Shortly after followed a second post, t … Read more

[Job] Design focused Cocoa developer for Espionage 3

Thu, 19 Mar 2015 22:00:09 GMT

Espionage is a highly rated personal data encryption app for Mac OS X.

It currently follows a “source code available” policy, but we think the right thing to do is to completely open source the product.

However, this comes with two significant challenges:

If we open source Espionage improperly, there is an extremely significant risk that it will face the same fate as TrueCrypt. More important than open sourcing the app is ensuring its health. A dead, unsupported app is useful to few, whether or not it’s open source.
We do not have control or ownership of one of the most critical … Read more

Espionage 3.6.2 Released!

Sun, 16 Nov 2014 17:13:14 GMT

Espionage 3.6.2 delivers an important security fix to address a plausible deniability issue with folders that were set to auto-lock, and it also brings important improvements and bug fixes:

Security
- The path for folders set to auto-lock was leaked in previous versions, compromising their plausible deniability (PD). If you require PD for those folders make sure to change the mountpoint for the affected folders after updating to 3.6.2! If you have any questions about this please contact us.
Improvements!
- If a folder fails to lock, Espionage will now tell you the application(s) that’s preventing it … Read more