Optional in-memory viewer mode to avoid exposing plaintext to external apps

Abierto
  • ¿Algo no está bien?
#1,881 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
12/100
Tipo de issue
Nueva funcionalidad
Claridad
Necesita aclaración
Estado de actividad
Activo
Stack tecnológico
c
Área
cryptography, security

Línea de trabajo

This is a design proposal that names no specific source files or tests, so there is no code entry point yet. Start by reading the existing screen-capture protection and sensitive-buffer handling the issue mentions, then ask the maintainers whether they want a design doc. Done means an agreed scope and sandboxing decision, not a patch.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

When you mount a volume, that part is solid. But the moment you open a file
with an external app — image viewer, PDF reader, media player — VeraCrypt
loses all control over it. That app can cache a thumbnail, write a temp file,
add the filename to a recent-files list, or just let the OS page its
unlocked memory to swap. None of that is VeraCrypt's fault, but in practice
the confidentiality guarantee mostly disappears the moment you actually use
the files instead of just mounting the container.

The screen capture protection you added recently protects VeraCrypt's own
window, but not whatever app ends up opening the file. Hidden volumes solve
a different problem (deniability, not this). Mounting to a RAM disk doesn't
help either — external programs reading from it still behave exactly the
same way.

What I'm proposing: an optional mode where the user can browse the file list
straight from VeraCrypt, and opening a file decrypts it directly into a
locked memory buffer shown through small built-in viewers (text, images,
PDF) — no external process, no mounted path, nothing for the OS to cache or
index. Memory handled the same way you already handle sensitive buffers:
locked, zeroed on close, no core dumps while live.

I know this isn't free. Putting image/PDF parsers inside a security-critical
process is real attack surface — parser bugs are one of the biggest sources
of CVEs in general (libpng, pdfium, etc.). If you ever build this, I'd start
small — text, one image format, basic PDF — and honestly the parsing should
probably run in a separate sandboxed process talking to the core over a
narrow channel, not inside the privileged code. Video/audio without ever
touching disk is genuinely hard cross-platform (decoders usually want a real
file handle), so I'd leave that out of a first version entirely.

This wouldn't replace mount-as-drive, which is still needed for anything
that does real file I/O. It's for the specific case of looking at a handful
of sensitive files without ever handing them to anything outside VeraCrypt.

I built a working proof of concept doing this end-to-end (Python, not
proposing the code itself gets used, just showing it's doable): double-layer
AES-GCM+CBC container kept fully in RAM, locked/zeroed memory, built-in
viewers for images/PDF/text/audio/video, screen capture protection on every
window. Repo: https://github.com/zmykerd/bcypherpy

Before I spend time on an actual design doc scoped to your codebase — is
this a direction you'd consider, or is the sandboxing requirement a
dealbreaker for maintenance reasons?

Lenguaje dominante
C
Estrellas
11.7k
Forks
1.4k
Merge medio
1 d 1 h
PR fusionados (30 d)
28

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de veracrypt/VeraCrypt

Todos los issues de veracrypt/VeraCrypt

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.