1

We want to create a secure email client based on Thunderbird source code and looking for a method to encrypt files or to isolate files from being stolen by some malware. and to avoid infecting pc via malicious emails. Which method is more secure to use? to encrypt files or to make it run in virtual sandbox.

if you have more suggestions,you are Welcome!

2
  • 1
    Unfortunately, I'm afraid neither is. A crypto malware will encrypt the sandbox outer container, or doubly-encrypt already encrypted files. In both cases you'll have to rely on backups.
    – LSerni
    Jan 7 '17 at 13:03
  • maybe it would help to know some more details about the options, i.e. what files do you intent to encrypt (e.g. the files used to store the emails, or rather the files that represent the program you create, or else?), as well as to know what you mean by a virtual sandbox? Lastly it would help to have the info what OS you plan on running this secure email client. Jan 7 '17 at 13:13
1

Without more details about your suggested options only more general advice can be provided.

With regards to encrypting files (assuming it is the data of the received email communication), certain malware might be prevented from reading and maliciously modify the data, much less from deleting the data altogether (something that also LSerni comment hinted on). Consider that efficient malware would strive to gain (or already have) access to the memory of your application , including the key used for encrypting the data. With encryption you might only protect against malware running as unprivileged (non-root/non-admin/non-ring0) code.

With regards to the virtualization sandbox, which sadly is not a very explicit thing to discuss much about, I would state that again this could prevent some sort of malware interaction, only under the condition that the malware again is not running in a privileged code. Frankly it is mostly the way that virtualization is a technology with merits as to contain (restrict/limit) malware, as is the concept of a sandbox. To my knowledge sandboxes are not the method of choice to prevent a program from attacks (by malware), but sandboxes are rather the tool to prevent potential malware to attack legitimate programs/data/systems.

Anyway it seems that a reason to employ either method (encryption/sandbox) would be to protect your email-client-users from receiving malware from the emails, in which case your software (email client) is the vector, in which case it seems that a sandbox might -imho- be much more effective (when well designed) to protect the host system, then the encryption of emails.

TL;DR

  1. both options, encryption and virtualization, cannot reasonably protect you against bad malware (rootkit, ring 0).
  2. a sandbox (well designed) might be a more effective tool to secure the host system from your email-client (and the emails), then encryption.
3
  • i want to encrypt files that store emails or another data, Jan 10 '17 at 12:31
  • @ArthurWento the intention being to protect maily those stored emails from malware on the host system, or the host system from malware in the emails? or both, as hopefully clear from my post those specifics matter Jan 10 '17 at 12:42
  • Thank you for your replies @humanityANDpeace i want to protect in both ways Jan 10 '17 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.