01 / 04 · Security toolkit
A desktop security toolkit I designed and built. It scans downloads for malware, checks how the computer's own defences are set, encrypts files, keeps passwords in an encrypted vault that spots breached ones, and blocks sites, all behind a master password with an authenticator code or facial recognition.
01 / Features
01
Watches the Downloads folder and checks every new file against 124,000+ known-malware fingerprints and VirusTotal's 70+ antivirus engines, without uploading the file. Threats are moved into quarantine, where they can't be opened or run, and links can be checked before they're opened.
02
Fingerprints only catch exact copies of known malware, so every file is also checked against 12 YARA rules I wrote for the techniques real malware uses: fake password prompts, keychain and crypto wallet theft, programs that start themselves at login and more, each mapped to MITRE ATT&CK. In the demo they catch a fake installer that VirusTotal has never seen, and a copy of the EICAR test file whose fingerprint was changed. You can add your own rules too.
03
Checks nine of the computer's own defences, based on the CIS benchmark: disk encryption, the firewall, Gatekeeper, System Integrity Protection, automatic security updates, waiting system updates, automatic login, the screen lock and remote access. It only reads them, using fixed system commands, and each problem links straight to the setting that fixes it.
04
Encrypts any file with AES-256-GCM, using a password stretched with Argon2id, or an RSA-4096 key so only the right person can open it. A wrong password or any tampering is detected, and a failed decryption never leaves a partial file behind.
05
Every entry is encrypted on its own with a key only the master password can unlock. It has a password generator and a strength meter, and copied passwords clear themselves from the clipboard after 30 seconds.
06
Flags weak passwords and ones reused across sites, then checks every saved password against Have I Been Pwned's database of passwords leaked in real data breaches. It uses k-anonymity: only the first 5 characters of each password's SHA-1 hash are sent, so the password itself never leaves the computer. Each problem opens its entry with a new password ready to generate.
07
Blocks sites in every browser and app on the computer by answering their name lookups from the hosts file, before any DNS server is asked. It only ever changes its own marked lines, and checks every site name before anything is written.
