Version: unspecified (using KDE 4.7.2) OS: Linux Currently, some cache files are created under /var/tmp/kdecache-USER directory. Recently, many users encrypt their home directory for security. However, creating user files other than their own home directory may exploit user's private data. Without encryption, data can be read when the PC is stolen. IMHO, /var/tmp/kdecache-USER/http looks risky, because user's browsing history would be leaked. In order to secure the system in the future, I suggest to move whole kdecache directory under the user's home directory. e.g. $HOME/.kde/cache Currently, I have to mount an encrypted file system to /var/tmp to secure my KDE desktop. Reproducible: Didn't try Steps to Reproduce: nada Actual Results: nada Expected Results: nada I also recommend to encrypt /tmp directory of course.
The reason the cached files are not in home directory is because a remote home would be way slower, so a local cache directory is used. To change that behavior, you can change the links in .kde http://techbase.kde.org/KDE_System_Administration/KDE_Filesystem_Hierarchy
Hi Christoph, Thank you for your comment. The KDEVARTMP could be a good solution here. I'd like to have a UI in "System Settings" GUI.
Alternative solution: the symlinks under ~/.kde can be replaced with real dirs, and then /var won't be used. This isn't a security issue in any case, but at most a privacy issue, and even that is dubious, given the permissions on the directory.
Which KDE apps are doing this?
None, anymore. This was the kde4 setup. Qt5 changed this with ~/.cache as default.