Data Loss in PGP 9 for MacOS X 10.4 | Dafacto
Dafacto

The personal website of Matt Henderson.

Data Loss in PGP 9 for MacOS X 10.4

13 May 2005

This is what I get for being an early adopter. I figured once the beta campaign was over, the release version of PGP 9 would be safe. Actually, it *is* generally safe, but I discovered a bad bug today. Here's what I sent to the PGP Support Forums:

Hello,

Today I lost a considerable amount of work, encrypting files with
PGP 9.0.0 for Mac OS X. Here's what happened:

I have the following directory structure:

Customer/
--Proposal/
----Issue 1/
------Proposal.doc
----Issue 2/
------Proposal.doc
------Analysis.xls

In the Finder, I select the three files (Proposal.doc,
Proposal.doc and Analysis.xls), control-click, and choose PGP
Encrypt. I then specify, in the subsequent dialog window to PGP
Shred the originals after encryption.

In version 8 of PGP, this operation would have resulted in:

Customer/
--Proposal/
----Issue 1/
------Proposal.pgp
----Issue 2/
------Proposal.pgp
------Analysis.pgp

In PGP 9, this operation resulted in:

Customer/
--Proposal/
----Issue 1/
----Issue 2/
------Untitled.pgp.zip

When I unpacked the resulting PGP file, it contained the
following:

------Proposal.pgp
------Analysis.pgp

In other words, the whole operation caused me to LOSE Issue
2 (the most current, and the one I'd been working on today) of my
Proposal.doc file.

As far as I can tell, there is no preference governing the new
behaviour -- i.e. creating a Zip archive, instead of simply
encrypting the individual files. When a new version of the
software deviates so greatly from a previous version, it seems to
me an injustice to the user to not at least warn them of this, or
provide the option to revert to the previous behavior.

Matt Henderson

What's particularly annoying is that apparently I can't even report this to PGP without paying $2.95 per minute. :-(

Enjoy this article? — You can find similar content via the category and tag links below.

Questions or comments? — Feel free to email me using the contact form below, or reach out on Twitter.