-
-
Notifications
You must be signed in to change notification settings - Fork 2.3k
Description
Describe the new feature
Currently, when opening an encrypted database via SQLCipher, the password/key prompt is rendered on the standard user desktop. In hardened environments (such as Windows Server 2022/2025), this leaves the master key vulnerable to:
User-mode Keyloggers: Malicious processes can "hook" the input stream of the active window.
Screen Scrapers/RATs: Malware can observe the UI or monitor the clipboard if the user attempts to paste the key.
Describe the solution:
I would like an option (perhaps a checkbox in the "Enter Password" dialog or a global setting) to use the native Windows Credential UI API (CredUIPromptForWindowsCredentials) with the CREDUIWIN_SECURE_PROMPT flag enabled.
When this flag is used, Windows dims the screen and switches to the "Secure Desktop" (the same one used for UAC and Windows Logon). This environment is isolated from standard user-mode processes, ensuring that the key is entered in a trusted space that malware cannot monitor.
###Alternatives i've considered
Manual Typing: Still vulnerable to keyloggers on the default desktop.
Password Managers (Auto-Type): While safer, they are still typing into a "non-secure" window buffer.
Does this feature exist in another product or project? Please provide a link
KeePass and VeraCrypt both have this exact feature:
https://keepass.info/help/kb/sec_desk.html
Do you have a screenshot? Please add screenshots to help explain your idea.
No