When using '-k image.jpeg' the image's 'Date Accessed' attribute should NOT be modified [feature request]

[tombraidr]

It's not difficult to find keys hidden in JPEG files -even if you have zillions of them in your system- . You only need search for and sort JPEG images by 'date accessed' in descending order to see a list of potential keys.

It would be great if when using tomb open -k path/to/image.jpeg secret.tomb something behind the scenes triggers something like:
datetime = getDateAccessed(path_to_image, image.jpeg) (pseudo code)
and then...
touch -a -m -t [datetime] image.jpeg

That way it will give the impression the image hasn't been accessed recently.

What do you think?

[arthaud]

That would be great. +1

[jaromil]

Yes, I think you spotted another practical vulnerability in the steganographic mechanism of Tomb, well done! we shall address this either within Tomb or within steghide. I am not sure how to best implement the pseudo-code to retrieve the date in shell, perhaps using stat(1)

[roddhjav]

I did a implementation of this proposal using stat and touch. In order to be sure access time is restored in all uses cases and in order to keep the code clean, the time is restored in the endgame function.

See: roddhjav@1c5852f
Please note it has not been tested yet.

[tombraidr]

Thanks @jaromil , @roddhjav

As soon as people say the commit is working for them I shall close the issue.

[tombraidr]

@roddhjav

Ops! I forgot to clarify the touch -a -m -t command I wrote above (probably you know already but it's nice to remind us) -a is for 'date accessed' and -m is for 'date modified'. Both should be considered separately when restoring datetimes.

[jaromil]

@roddhjav would you like to pack your commit into a PR?

[roddhjav]

@jaromil done! see #320