Optional in-memory viewer mode to avoid exposing plaintext to external apps

未关闭
  • 哪里不对？
#1,881 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
12/100
Issue 类型
功能
描述清晰度
需要澄清
活跃度
活跃
技术栈
c
领域
cryptography, security

调研方向

This is a design proposal that names no specific source files or tests, so there is no code entry point yet. Start by reading the existing screen-capture protection and sensitive-buffer handling the issue mentions, then ask the maintainers whether they want a design doc. Done means an agreed scope and sandboxing decision, not a patch.

由索引模型根据 Issue 内容生成。

描述

When you mount a volume, that part is solid. But the moment you open a file
with an external app — image viewer, PDF reader, media player — VeraCrypt
loses all control over it. That app can cache a thumbnail, write a temp file,
add the filename to a recent-files list, or just let the OS page its
unlocked memory to swap. None of that is VeraCrypt's fault, but in practice
the confidentiality guarantee mostly disappears the moment you actually use
the files instead of just mounting the container.

The screen capture protection you added recently protects VeraCrypt's own
window, but not whatever app ends up opening the file. Hidden volumes solve
a different problem (deniability, not this). Mounting to a RAM disk doesn't
help either — external programs reading from it still behave exactly the
same way.

What I'm proposing: an optional mode where the user can browse the file list
straight from VeraCrypt, and opening a file decrypts it directly into a
locked memory buffer shown through small built-in viewers (text, images,
PDF) — no external process, no mounted path, nothing for the OS to cache or
index. Memory handled the same way you already handle sensitive buffers:
locked, zeroed on close, no core dumps while live.

I know this isn't free. Putting image/PDF parsers inside a security-critical
process is real attack surface — parser bugs are one of the biggest sources
of CVEs in general (libpng, pdfium, etc.). If you ever build this, I'd start
small — text, one image format, basic PDF — and honestly the parsing should
probably run in a separate sandboxed process talking to the core over a
narrow channel, not inside the privileged code. Video/audio without ever
touching disk is genuinely hard cross-platform (decoders usually want a real
file handle), so I'd leave that out of a first version entirely.

This wouldn't replace mount-as-drive, which is still needed for anything
that does real file I/O. It's for the specific case of looking at a handful
of sensitive files without ever handing them to anything outside VeraCrypt.

I built a working proof of concept doing this end-to-end (Python, not
proposing the code itself gets used, just showing it's doable): double-layer
AES-GCM+CBC container kept fully in RAM, locked/zeroed memory, built-in
viewers for images/PDF/text/audio/video, screen capture protection on every
window. Repo: https://github.com/zmykerd/bcypherpy

Before I spend time on an actual design doc scoped to your codebase — is
this a direction you'd consider, or is the sandboxing requirement a
dealbreaker for maintenance reasons?

主要语言
C
星标
11.7k
派生
1.4k
平均合并
1 天 1 小时
30 天内合并 PR
28

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

veracrypt/VeraCrypt 的其他 Issue

查看 veracrypt/VeraCrypt 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。