Optional in-memory viewer mode to avoid exposing plaintext to external apps

オープン
  • 何か問題がありますか？
#1,881 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
12/100
issue の種類
機能追加
明瞭さ
説明が足りない
活発さ
活発
技術スタック
c
領域
cryptography, security

調査の方向性

This is a design proposal that names no specific source files or tests, so there is no code entry point yet. Start by reading the existing screen-capture protection and sensitive-buffer handling the issue mentions, then ask the maintainers whether they want a design doc. Done means an agreed scope and sandboxing decision, not a patch.

索引モデルが issue の本文から書いたものです。

説明

When you mount a volume, that part is solid. But the moment you open a file
with an external app — image viewer, PDF reader, media player — VeraCrypt
loses all control over it. That app can cache a thumbnail, write a temp file,
add the filename to a recent-files list, or just let the OS page its
unlocked memory to swap. None of that is VeraCrypt's fault, but in practice
the confidentiality guarantee mostly disappears the moment you actually use
the files instead of just mounting the container.

The screen capture protection you added recently protects VeraCrypt's own
window, but not whatever app ends up opening the file. Hidden volumes solve
a different problem (deniability, not this). Mounting to a RAM disk doesn't
help either — external programs reading from it still behave exactly the
same way.

What I'm proposing: an optional mode where the user can browse the file list
straight from VeraCrypt, and opening a file decrypts it directly into a
locked memory buffer shown through small built-in viewers (text, images,
PDF) — no external process, no mounted path, nothing for the OS to cache or
index. Memory handled the same way you already handle sensitive buffers:
locked, zeroed on close, no core dumps while live.

I know this isn't free. Putting image/PDF parsers inside a security-critical
process is real attack surface — parser bugs are one of the biggest sources
of CVEs in general (libpng, pdfium, etc.). If you ever build this, I'd start
small — text, one image format, basic PDF — and honestly the parsing should
probably run in a separate sandboxed process talking to the core over a
narrow channel, not inside the privileged code. Video/audio without ever
touching disk is genuinely hard cross-platform (decoders usually want a real
file handle), so I'd leave that out of a first version entirely.

This wouldn't replace mount-as-drive, which is still needed for anything
that does real file I/O. It's for the specific case of looking at a handful
of sensitive files without ever handing them to anything outside VeraCrypt.

I built a working proof of concept doing this end-to-end (Python, not
proposing the code itself gets used, just showing it's doable): double-layer
AES-GCM+CBC container kept fully in RAM, locked/zeroed memory, built-in
viewers for images/PDF/text/audio/video, screen capture protection on every
window. Repo: https://github.com/zmykerd/bcypherpy

Before I spend time on an actual design doc scoped to your codebase — is
this a direction you'd consider, or is the sandboxing requirement a
dealbreaker for maintenance reasons?

主要言語
C
スター
11.7k
フォーク
1.4k
平均マージ
1日 1時間
マージ済み PR（30日）
28

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

veracrypt/VeraCrypt のほかの issue

veracrypt/VeraCrypt の issue をすべて見る

似ている issue

C の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。