Wiping sensitive data

[hakavlad]

Sensitive data, such as cryptographic keys, should be erased from memory after use, to reduce the risk that a bug will expose it to the outside world.

-- https://www.gnu.org/software/libc/manual/html_node/Erasing-Sensitive-Data.html

Privacy

• Sensitive data is wiped from the heap asap

-- https://github.com/cryptomator/cryptomator

Please clarify if Kryptor does the same.

Sensitive bytes SHOULD be zeroed from memory once they are no longer required.

-- https://www.kryptor.co.uk/specification

Does Kryptor actually do this? This is not described in Features and README.

[samuel-lucas6]

Yes, Kryptor attempts to zero sensitive bytes. However, it isn't guaranteed to work in this project or in certain programming languages, which is why that's a SHOULD rather than a MUST.