Security & Privacy

As a professional terminal tool, PhanTerm deeply understands the importance of credential security for every developer and operations engineer. We design our architecture based on extremely rigorous zero-trust principles.

Core Security Commitment

Caution

Your SSH keys and passwords will absolutely never leave your device. PhanTerm does not contain any built-in telemetry or reporting mechanisms. The application will under no circumstances transmit your host lists, identity credentials, terminal contents, or operation logs to external servers.

Tri-Track Credential Storage Model

We employ an industry-best-practice tri-track storage model when saving your sensitive data (such as server passwords, jump host passwords, and private key passphrases):

1. Windows CNG Envelope Encryption (Windows Default) On Windows, updating to version 0.13.0 automatically handles and migrates your credentials to be protected by the higher-level Windows CNG (Cryptography Next Generation) API. The master key is securely isolated within the operating system’s user credential storage. If VBS is enabled (e.g., Win11 22H2+), the key gains further hardware-level isolation. For most Windows 10 users or environments where VBS is disabled, it falls back to software-level CNG protection due to the lack of hardware isolation support, but this remains significantly more secure than the traditional system keyring.

   Tip: For Windows users with extremely high security requirements, we strongly recommend using Windows Hello hardware encryption to completely replace password authentication (see the “Authentication & SSH Agent” documentation for details), though this introduces the interactive cost of biometric verification for every connection.

2. OS Native Keyring (macOS / Linux Preferred) For macOS and Linux systems, PhanTerm prioritizes calling your operating system’s underlying security framework (macOS Keychain / Linux Secret Service). This means even if malware reads your configuration files, it cannot directly view any passwords.

3. AES-256-GCM Local Encryption (Fallback) If running in specific headless Linux environments that lack a native keyring, PhanTerm silently generates a highly randomized local master.key and securely encrypts the passwords using the robust AES-256-GCM algorithm.

Caution

Security Advisory for Linux Users

Because the local encryption fallback relies solely on file system permissions, it cannot defend against malware stealing credentials. This is insecure in environments with high security requirements. We strongly advise Linux users to install the necessary system components before running to enable the much more secure OS-native keyring service:

Ubuntu / Debian

sudo apt install libsecret-1-0 gnome-keyring dbus

Fedora / RHEL / CentOS

sudo dnf install libsecret gnome-keyring dbus

Arch Linux

sudo pacman -S libsecret gnome-keyring dbus

Strict Host Trust Model

Defending against Man-In-The-Middle (MITM) attacks is the paramount priority for any SSH client.

PhanTerm’s trust model is not based on loose domain matching; it is precisely bound to the combination of host, port, and encryption algorithm type (host:port + key_type). This means:

• If the target host changes its encryption algorithm type, the application blocks the connection and asks you to reconfirm.
• If the target host returns the same algorithm type but a completely different fingerprint, the application instantly throws a high-severity red screen warning and hard-blocks the operation.

Clipboard Security & Isolation

Many security professionals are concerned about OSC 52 remote scripts polluting the local clipboard. PhanTerm mitigates this with an on-demand authorization mechanism based on session isolation. Any remote session’s first cross-boundary write attempt must receive your explicit approval.