Desktop Search Tools Don't Pose Real Security Risk

Great Utilities To Help Tame The Hard Drive Jungle

It is great to have a huge hard drive. In years gone by I used to have to scour my hard drive on a monthly, or sometimes even weekly, basis to remove files I no longer wanted or needed so that I could free up disk space. It was common to receive messages alerting me to the fact that my hard drive was full and it often showed in the relative speed of my computer as Windows had less hard drive real estate to work with to create a virtual memory page file.

That is simply no longer an issue for me. With almost 200 Gb of hard drive space I can run the complete or full installation of every program I own, rip every compact disc I own and save every song as an MP3 on my computer for quick access, create a virtual memory disk the size of Texas and still have room left to spare. It is great! That is until I have to find something.

I have partitioned the drive space into smaller portions and created folders in an attempt to provide some logical structure to all of this hard drive space. But, inevitably, when I am looking for some specific Word document or Excel spreadsheet I created two years ago it is not in the “appropriate” folder for some reason and I am left trying to hunt and peck my way through 200 Gb of hard drive space to find where I left it last.

Earlier this year I did a review of a product that solves that problem. The X1 Desktop Search program indexes the emails, email file attachments, files and contacts on a computer system. X1 can search through your entire computer in under a second and narrows the search on the fly as you type your search terms or key words. I love the product and I have found it indispensable. I highly recommend it, however it does come with a $99 (currently on sale for $75 on their web site) price tag.

In July of this year Microsoft announced that they are developing their own desktop search tool which they planned to release by 2006 and incorporate into the next incarnation of the Windows operating system currently codenamed “Longhorn”. Google trumped them by releasing a similar tool a couple of weeks ago.

The Google Desktop Search is officially a “beta” version- meaning that it is ostensibly still in testing and may have some minor glitches to be worked out still. But, it does essentially the same thing as the X1 Desktop Search tool except that it is free. Not only does it index and search email and files like X1, but the Google Desktop Search tool also indexes and searches instant message chat sessions and past web searches performed on the computer. The interface for the Google Desktop Search tool has the same look and feel as the Google web site and you can even opt to include your local desktop search results in your Google web search attempts. In other words, if you try to search on “Boston Red Sox” it will return the relevant web sites, but will also return any related files or information located on your local computer.

The bandwagon is picking up speed now. Yahoo has announced plans to release a similar tool and Microsoft has stated that they will release a beta version of an MSN-branded desktop search tool by the end of the year as well. Both the X1 and Google desktop search products are excellent tools to help you tame the expansive jungle of files on your hard drive, but some feel they can also pose a security risk.

The security concerns arise primarily from two issues. First, there is the issue of “What”, as in what sort of information is indexed and whether it may include confidential or private information. Then there is the issue of “Who”, as in who has access to the computer.

The Google Desktop Search utility indexes previous web searches and cached web pages, including secure web pages (commonly denoted by starting with “https” rather than simply “http”). While accessing a secure site like your Hotmail web-based email account generally requires entering the username and password, if Google Desktop Search is allowed to index that information a user could still sit down at the computer and type “hotmail” as a search term and retrieve messages that have been previously viewed and are now stored in the cache on the local computer. Entering search terms like “password” or “social security” might also reveal private or confidential information indexed by the utility.

Google Desktop Search does offer the ability to disable the indexing of secure web pages, making them off limits for future searches. By clicking on the “Desktop Preferences” link just to the right of the search entry field you can choose what types of information you do or do not want indexed and you can turn off the indexing of secure web pages by simply unchecking the box.

However, even with the indexing and searching of secure web pages disabled, there are plenty of other documents and files which might contain personal, private or otherwise sensitive information that others should not have access to. Arguably, if you share the computer with other users you should not install a desktop search tool like X1 or Google Desktop Search. However, the information is still on the computer for anyone who has physical access to the machine to find.

Being aware of or deciding who else should have access to your computer is a much larger security concern than whether or not to use a desktop search tool. Anyone with physical access to the machine can find the same information as the desktop search tool can given the desire, some time and a little bit of knowledge. In other words, a desktop search utility might greatly expedite someone finding information they shouldn’t have access to, but not having a desktop search tool will not completely prevent someone from finding such information. It just means they will have to hunt and peck and search through the files the old-fashioned way.

Where a tool like this becomes more of a security concern is on truly public computers. Computers at libraries, schools, Internet cafes and other such establishments have random users coming and going all the time. Often, these users log on for the sole purpose of checking web-based email or verifying their account balances on credit cards or at their bank. Having a utility like X1 or the Google Desktop Search tool installed on a computer like this would make it very easy for a user to do a search and retrieve information from past user’s sessions.

Again though, the burden lies with the provider of the public computer to ensure some level of safety or security to protect the users as well as with the users themselves to exercise the appropriate level of caution when entering private and personal information on an insecure public computer. While public access computers have even more reason not to install a desktop search tool than say a home computer, the fact remains that any user with physical access to the machine can gain access to the same information given the time and desire.

The administrators of public access computers should have some means in place of ensuring that the temporary internet files and other cached information are purged between user sessions to ensure this sort of information does not linger from one user to the next. When you are using a public computer you may want to look for the colored swirly logo in the systray that indicates the Google Desktop Search tool is installed or check the Add and Remove Programs in Control Panel to verify that no such tool is installed before deciding to enter your private information on the computer.

I highly recommend X1 or the Google Desktop Search tool for any user who is the sole user of their computer. They are invaluable tools and make finding the information you have stored on your computer exceptionally more efficient. Should your computer ever be lost or stolen such a tool will make it easier to sift through and find your personal information, but, to beat a dead horse, if they have physical possession of your computer they can get that information anyway.