To clarify this directly. I mean what if every (even malicious) 3rd party software running on this OS gets never access to its data and rather 'describes' what to do with?

So for example 'here at index x change this byte to y', 'if at index x is "01" change it to y'. This would obviously be hard for developers to do. That's why I suggest using something like an interface where data types are defined and can be defined by every software. It could range from primites like int,char to literally HTML,JSON and include default operations based on this data type.

Now any software running on this OS needs to handle data with a some kind of interface and will never have directly access to its underlying data.

However this will only apply to files which are publicly accessible like Pictures/Documents, giving the software the possiblity to handle its configuration files ( myapp.conf ) how it wants to, but not the secret Message in secret_text.txt (making sure these files cannot accessed by anyone, but the creator/application).

The GUI is really tricky because it has to display the actual data to the user. Therefore it needs to a part of the OS, otherwise the effort is worthless.

Now I got a few questions I can't answer myself:

  • will exploits effect this design in more dramatic way than on Linux/Windows?
  • how much of a benefit do I get compared to different approaches?
  • in which way are applications limited by this design?
  • where should this approach be implemented? (Kernel space/User space)
  • due to the reason that the GUI needs to be a part of the OS what are downsides or benefits from this?

So, with this questions in mind, will this be a secure way of handling (sensitive) data?

PS: It is my first question here, if anything is unclear please let me know.

2 Answers 2


If I understand this question correctly, you are proposing a system where applications never gets to read a file, but only send commands to an interface that reads and modifies data. That way, the application will know nothing about the data it operats upon. That is not going to work as a way to protect your data. Let me explain why.

So let's say I have some photos I want to crop, but I don't want my photo editing application to see them. The photo editing application would then just send the crop command to the JPG interface, and the interface then does the cropping.

And if I want to see the image on the screen while I crop it, I guess the interface will have to take care of that as well. And if the photo app window should resize to fit the image, the interface would have to do that as well because the app wouldn't know the size of the image. But know the photo app doesn't know the size of it's own window... so how can it control what buttons are shown in the toolbar? I guess the interface will have to take care of that too.

Do you see what is happening here? The interface is taking over all the complexity that the app handles. There simply is no clean interface between reading and writing, so the interface will just swallow more and more of the app until the app is just an empty shell around the interface.

And if the interface is as complex as the app used to be, one has to ask the question: Where does the interfaces come from? People will just be downloading trojan filled interfaces instead of trojan filled apps.

  • Good points, but here the JPG interface will only crop the image. The OS windowing system will then resize the window (App specifies wanted behaviour [match jpg size]). Now this UI framework must be used by everyone (think of androids flat design which almost every app uses). However it's true that simple apps will almost be nothing, but what about layout,theming and usability. This framework needs to deal with the apps specifications and current enviroment (screen size, input type) and the developer focus on content and functionalites. If this UI framework is powerful enough, no Issue? Oct 25, 2017 at 12:46
  • All these things that you are trying to separate can't really be separated. You will end up with an extremely limited but still very complex environment.
    – Anders
    Oct 25, 2017 at 13:01
  • If you want you could explain further why. Because I think its possible, like for example a programming language does the same thing on different/specific set of data. Take for instance (C++) templates that will do x+1 and returns it. Floats, Doubles, Ints it can handle them all without knowing exactly what it's being applied to. So it should be also possible for much more complex data. However I'm glad for your opinion, I should really provide a good well thought concept (also to check if I'm wrong) before further questions here. Thank you for your answer! Oct 25, 2017 at 13:22
  • I think if you spend some time on designing actual "apps" and "interfaces" you will see the problem yourself. There simply is no way to divide the work between the "app" and the "interface" where any meaningfull tasks are left for the "app".
    – Anders
    Oct 25, 2017 at 13:42
  • oh, Thank you for elaborating, that cleared it up for me. May I add, what if every "app" can bring in it's own "interface" or use already brought in "interfaces" from other apps. Then if JPG isn't implemented by default, It's the task of the "app" to provide this feature and also let the user by using the UI framework take usage of this data type. I mean these "interfaces" are like a programming language everyone can use to describe what needs to be done (it does not feature io/network stuff so it's secure to execute by the OS). However that's almost their only purpose, beside prensenting it. Oct 25, 2017 at 14:02

This type of information hiding has a few key weaknesses.

First, to be useful, the hidden data must produce some kind of visible output. That visible output can be analysed for a given input and it is generally possible to work backwards to determine what at least part of the original must have looked like. Eventually, you can build up enough to make malicious modifications without having to directly see the data you are changing.

Second, not all attacks are concerned with data capture. This system does nothing to prevent data corruption or destruction. It doesn't matter if I can see your financial records if I can say "set all balances due to 0". If someone can trash your system, it doesn't help much that they didn't have access to SEE your data.

Lastly, such a system would still be potentially vulnerable to exploits that might be able to compromise the OS functionality. The OS still needs to be able to write to it and the more complex the instructions get that operate on the data, the more potential there is that a software bug will allow breaking the system to some greater or lesser extent.

That doesn't mean that such systems are useless, but they have very specific use cases and are used as part of a defense in depth to prevent misuse. There is an entire type of cryptography called homomorphic encryption which allows mathematical operations to be carried out on encrypted data without decrypting it. Such systems are quite complex, but they are useful in situations where operations need to be performed by systems that should not have awareness of the data they are actually operating on.

The key, as with anything in security, is to understand the threats you need to mitigate and the capabilities and weaknesses of the tools you are using to address those threats. Opaque data operations are a tool, but a very specialized and limited one that fits a very specific and generally small niche.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .