MacTomb: enhance your privacy on Mac OS X

In the previous blog post I described how to compile the Tutanota web client on your Mac OS X.

Tutanota encrypts your emails on the server, so you – and only you – can access them through the webmail using your password as encryption/decryption key.

Either if you login into their webmail or in your local webclient, the browser caches the content of the page, thus your emails are stored on the browser cache in plain text and can be recovered, defeating Tutanota’s goal of keeping them safe.

There are tons of tools out there that can recover fragments of web pages from your hard disk; I personally used IEF from MagnetForensics and it’s quite scaring how many informations can be recovered from the browser cache.

So, if you are not using hard disk encryption and don’t want to reformat or enable it, you need to protect your browser cache while reading your Tutanota emails.

If you’re using a GNU/Linux distro, you can check out Tomb and some useful scripts to run software on a sandbox with Tomb. It’s awesome and everyone should use it (spoiler: I was one of the devs back in the days).

But we’re on Mac OS X, so you can’t use Tomb since it’s based on dm-crypt (that’s not present on the Apple’s operating system).

Since I like the idea, I tried to code a Tomb-like tool that would give me an encrypted container to store my sensitive data in.

And guess what? I coded MacTomb.

MacTomb creates an encrypted DMG with AES256 in CBC mode. By default it uses HFS+, but you can customise those values in the script. But it does more than this: it will helps you to create a bash script to launch your preferred software with data inside the container (called mactomb) plus an Automator App that call the bash script just mentioned. Confused eh?

It’s fairly simple actually. The workflow is: you click on the App, it will call the bash script that in turn mounts the mactomb and executes a software that you will have defined.

What’s the benefit? Think again about the previous blog post: you want to run your Tutanota webclient in a secure way, with data encrypted on disk, that can be even shared online and syncronized between computers.

Not convinced yet? Let’s take a look at how you can do it.

First, clone the MacTomb repository:

$ git clone
Cloning into 'MacTomb'...
remote: Counting objects: 91, done.
remote: Total 91 (delta 0), reused 0 (delta 0), pack-reused 91
Unpacking objects: 100% (91/91), done.
Checking connectivity... done.
$ cd MacTomb

Let’s see the full command needed to create the whole thing:

bash forge -f ~/graveyard/tutanota.dmg -s 100m -p ~/tutanota/web/build/ -a "/Applications/ -p tutanota \$VOLNAME/index.html" -b ~/ -o ~/Downloads/tutanota_ui

Breaking the command above:

  • forge is a key command: based on its arguments it can create from scratch a mactomb, the bash script and the Automator app
  • -f selects a mactomb to be created or already created (creation depends on the -s flag)
  • -s tells forge to create the mactomb with the size specified on this flag (in this case, 100 MB)
  • -p copies the content of that folder into the mactomb; be careful: the trailing / tells cp to copy the files inside that folder to the root of the encrypted container, as it was build/* on Linux. To copy the full path (including the partent folder), the argument should be written as ~/tutanota/web/build
  • -a specifies the application and/or the command line to put in the bash script (specified by the -b flag). In the command above, we’re telling to the bash script to run Firefox with the tutanota profile and open the file $VOLNAME/index.html. $VOLNAME is a special word to identify the root of your mactomb: forge will take care of evaluating the value of that variable for you
  • -b flag selects or creates the bash script specified as argument; that script will be used by the Automator App (the -o flag) to trigger the mount of the mactomb and execute the command line (the -a flag)
  • -o flag, finally, creates an Automator App named (the .app extension is added automatically if missing) with the only task of calling the bash script. In this way, the only thing to do to is clicking on the app to open your now encrypted Tutanota web client.

The last step to complete our setup is to mount the mactomb (double click on it is sufficient) and create a Firefox profile inside it named tutanota (/Applications/ –ProfileManager is the key).

Et voila`, here is a screenshot of the web client indextutanota_webui

Of course, mactomb can be used also to create only the Automator App or the bash script. I suggest to run mactomb help to discover the full potentiality of this tool.

Just a side note: since everything is created with absolute paths, moving the mactomb or the bash script will break the setup. You can move the App around, but if you want to move the bash script you have to edit the App and if you move the mactomb, you have to edit the bash script.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s