mirror of
https://github.com/narrrl/proton-drive-linux.git
synced 2026-11-03 16:41:26 +01:00
nvrl
69d4feaa07
Readers asked whether the client can be trusted with their files. The threat model in ARCHITECTURE.md is written for contributors, so docs/SECURITY_MODEL.md summarises it for users: encryption comes from the SDK and rPGP, sign-in uses SRP, what is stored where and how it is protected, who can reach the daemon, every network connection, what the client does not protect against, and how each package is built and signed. It says that there has been no independent audit. It is linked from the README, the documentation index and SECURITY.md.
43 lines
2.1 KiB
Markdown
43 lines
2.1 KiB
Markdown
# Security Policy
|
|
|
|
## Supported versions
|
|
|
|
Fixes land on the latest release. Please reproduce on the most recent version before reporting.
|
|
|
|
For what the client protects and what it does not, written for users, see the
|
|
[security model](docs/SECURITY_MODEL.md).
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Do not open a public issue.** Report privately through GitHub's
|
|
[private vulnerability reporting](https://github.com/narrrl/proton-drive-linux/security/advisories/new),
|
|
or by email to <contact@narl.io>.
|
|
|
|
Please include the version (`pdfs --version`), your distribution and desktop environment, what an
|
|
attacker gains, and a reproduction if you have one. You can expect an acknowledgement within a few
|
|
days; a fix ships in the next release, and you are credited in the advisory unless you ask
|
|
otherwise.
|
|
|
|
## Scope
|
|
|
|
This client holds Proton account credentials and decrypted file content on the local machine, so
|
|
the interesting boundaries are:
|
|
|
|
- **Credentials.** Sessions and the mailbox password live in the system Secret Service. Anything
|
|
that writes them elsewhere — logs, temp files, crash dumps — is a vulnerability.
|
|
- **The control socket.** Anything that can connect to `control.sock` has the daemon's
|
|
authenticated session. It is `0600`, and the state, cache, and config directories must be real,
|
|
current-user-owned `0700` directories; the daemon fails closed otherwise. Reports that defeat
|
|
those checks are in scope.
|
|
- **Local cache and staging.** Decrypted block content and staged writes on disk.
|
|
- **Cryptography.** Key derivation, signature handling, and anything that could publish plaintext
|
|
or the wrong key material to Proton.
|
|
|
|
What the client deliberately keeps in plaintext on disk, and why, is documented in the
|
|
[threat model](docs/ARCHITECTURE.md#10-threat-model-what-this-client-writes-to-disk-in-plaintext).
|
|
Behaviour described there is known and not a vulnerability by itself; a way to make it worse
|
|
than described is.
|
|
|
|
Out of scope: vulnerabilities in Proton's own service (report those to Proton AG), and issues that
|
|
require an attacker who already has your user account on the machine.
|