Add Windows Hello protection for saved vault credentials
Problem
cppcryptfs currently relies on DPAPI to protect saved passwords.
While useful, DPAPI does not require fresh user verification when the Windows session is already accessible. As a result, access to the Windows user context may potentially provide access to saved cppcryptfs credentials.
An unlocked Windows session should not automatically grant access to every encrypted vault.
Proposal
Add an optional Windows Hello protected mode for saved vault credentials.
When enabled, unlocking a vault would require a fresh Windows Hello verification using fingerprint, face recognition, or PIN, potentially backed by the TPM:
Windows session → Windows Hello → protected credential → vault unlock
This would add a stronger security boundary than DPAPI alone.
Security benefit
The main benefit is security, not convenience:
- an unattended unlocked workstation would not automatically expose saved vault credentials;
- access to the Windows session alone would not be sufficient to unlock the vault;
- a fresh user verification would be required before releasing the protected credential.
The original vault password could remain available as a fallback or recovery method.
Existing precedent
This approach is already used by major security-focused applications:
- Bitwarden
- KeePassXC
- Cryptomator
- 1Password
Cryptomator is especially relevant because it also protects encrypted vaults and supports Windows Hello for vault unlocking.
Adding Windows Hello support would therefore bring cppcryptfs in line with established security practices and provide a meaningful security improvement, rather than merely a convenience feature.
Add Windows Hello protection for saved vault credentials
Problem
cppcryptfs currently relies on DPAPI to protect saved passwords.
While useful, DPAPI does not require fresh user verification when the Windows session is already accessible. As a result, access to the Windows user context may potentially provide access to saved cppcryptfs credentials.
An unlocked Windows session should not automatically grant access to every encrypted vault.
Proposal
Add an optional Windows Hello protected mode for saved vault credentials.
When enabled, unlocking a vault would require a fresh Windows Hello verification using fingerprint, face recognition, or PIN, potentially backed by the TPM:
Windows session → Windows Hello → protected credential → vault unlock
This would add a stronger security boundary than DPAPI alone.
Security benefit
The main benefit is security, not convenience:
The original vault password could remain available as a fallback or recovery method.
Existing precedent
This approach is already used by major security-focused applications:
Cryptomator is especially relevant because it also protects encrypted vaults and supports Windows Hello for vault unlocking.
Adding Windows Hello support would therefore bring cppcryptfs in line with established security practices and provide a meaningful security improvement, rather than merely a convenience feature.