6

Recently I found out that macOS saves full download link to metadata of file which kept when file moves between computers which I found a big security risk for me. Is it possible to disable saving this attribute? I'm using Google Chrome 99.0

To be clear: I don't need to remove metadata from specific file, as it can be easily done with xattr -d com.apple.metadata:kMDItemWhereFroms filename, but I want to stop it from being saved to new files.

2
  • 2
    You could perhaps set up a Folder Action script that deletes the metadata as soon as the file is added. But I'm interested to know bout the security risk of having the URL in the metadata. What happens if someone else knows where you downloaded the files from?
    – benwiggy
    Mar 6, 2022 at 18:23
  • 2
    What if URL has token in it? So anyone who knows this token may download my other files. I know this is bad protection on website, but I prefer not to disclose any extra information in files I share.
    – VityaSchel
    Mar 6, 2022 at 18:30

1 Answer 1

10

There's no setting in Google Chrome that disables the metadata from being saved. It is done by Google Chrome itself - it's not something that is forced on it by the operating system or anything like that.

You could switch to using a browser that doesn't save this attribute. That could for example be the open-source version of Chrome, Chromium. You would then remove the code that writes the attribute and rebuild Chromium.

Another option is to remove the attributes after the files have been downloaded. You could use "Folder Actions" for this by attaching AppleScript like the following to your Downloads folder:

on adding folder items to theFolder after receiving theFiles
    repeat with aFile in theFiles
        set filePath to quoted form of POSIX path of aFile
        do shell script "xattr -d com.apple.metadata:kMDItemWhereFroms " & filePath
    end repeat
end adding folder items to
1
  • 1
    Excellent! I do something similar to remove the quarantine attribute. Mar 6, 2022 at 23:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .