Are there risks that are specific to working with an encrypted container on a system that does not have full disk encryption? Could programs running outside of that container cache or store parts of this sensitive information in a non-secure location?
1 Answer
I would say the biggest practical risk would be that a 'store my password' 'remember me' etc. option would be set. If this were done without FDE, an attacker could simply (with physical access) change the password for the account with the stored encryption key.
Any programs running on the system with sufficient privileges could take what they want regardless of FDE (e.g. a keylogger would just wait until you typed the encryption key/pw)
Applications running without sufficient privileges shouldn't be able to read memory outside of their own processes, but this relies on the OS and sandboxing not being exploitable. Also, temporarily decrypted data shouldn't be stored anywhere someone else could get to it (usually stays in memory). But that would depend on how the encryption software was written (use third-party-vetted software).
FDE is designed to stop offline (someone pulls your HDD out of the machine) attacks. If you're worried about the applications running on your system, that is not a system you should be using, or at least not using to handle sensitive data.
