Add section about security considerations

1 files changed, 6 insertions, 0 deletions

diff --git a/README.md b/README.md
index 568a041..c03c02b 100644
--- a/README.md
+++ b/README.md
@@ -56,3 +56,9 @@ Or, use the package from your distribution:
 ### Bug reports
 
 Report any bugs to <jason@zx2c4.com>.
+
+### Security Considerations
+
+This runs as root and auto-`sudo`s itself to achieve that. As such, you shouldn't run this on paths you don't trust that could be controlled by malicious users.
+
+Since `ctmg` uses `cryptseup` and the LUKS infrastructure, it uses the Linux block device encryption APIs. The state of the art in block device encryption, as of writing, is [XTS mode](http://csrc.nist.gov/publications/nistpubs/800-38E/nist-sp-800-38E.pdf), which is what `ctmg` uses. But do note that this does not guarantee, entirely, the integrity of data, just the secrecy. As such, if a malicious user is able to modify the encrypted content, it is possible this could result in differing decrypted content without you noticing. So, `ctmg` is useful for keeping things secret, but not for guaranteeing the authenticity of the data. If your laptop gets stolen, sleep safely knowing that your `ctmg`-secured data is safe, but if an attacker is actively modifying the `.ct` file while you're using it in one way or another, you've got trouble.