safestorage/platform

7 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

safeStorage platform-specific sync API security on macOS

On macOS, encryption keys are stored in Keychain Access in a way that prevents other applications from loading them without user override. Content is protected from other users and other apps running in the same userspace. Access to the system Keychain is required and these calls can block the current thread to collect user input.

safeStorage platform-specific sync API security on Windows

On Windows, encryption keys are generated via DPAPI. Only a user with the same logon credential as the user who encrypted the data can typically decrypt the data. Content is protected from other users on the same machine, but not from other apps running in the same userspace.

safeStorage platform-specific sync API security on Linux

On Linux, encryption keys are generated and stored in a secret store that varies depending on the window manager and system setup. Supported options include kwallet, kwallet5, kwallet6, and gnome-libsecret. If no secret store is available, items will be unencrypted (encrypted via hardcoded plaintext password), which can be detected when safeStorage.getSelectedStorageBackend() returns 'basic_text'. Access to password management tools can block the current thread to collect user input.

safeStorage requires code signing on macOS

On macOS, your app should be code signed for safeStorage to behave consistently. Without a valid, consistent signature, macOS may not recognize different builds of your app as the same application, which can cause the Keychain to re-prompt the user for permission on every update.

safeStorage async API platform-specific security on macOS

On macOS, the asynchronous API stores and retrieves encryption keys from Keychain Access, providing the same security model as the synchronous API, protecting content from other users and other apps running in the same userspace.

safeStorage async API platform-specific security on Windows

On Windows, the asynchronous API protects encryption keys via DPAPI, providing the same security model as the synchronous API, protecting content from other users on the same machine but not from other apps running in the same userspace.

safeStorage async API platform-specific security on Linux

On Linux, the asynchronous API may use multiple key providers depending on the desktop environment: org.freedesktop.portal.Secret (preferred for sandboxed environments like Flatpak), Secret Service API (freedesktop.org Secret Service API, e.g., GNOME Keyring), or a fallback provider for environments without a secret service. Unlike the synchronous API, these operations are non-blocking and support key rotation and temporary unavailability handling.

Give your agent this brain