Bare 2.0.4

Bare 2.0.4

Bare 2.0.4 adds backup and transfer on top of 2.0.3. Chromium is unchanged at 157.0.8103.46.

Two changes affect what Bare sends over the network. First, uBlock Origin now also fetches a phishing list, the Phishing URL Blocklist by curben, from its maintainers' sites whenever uBlock Origin updates its lists. The badware and malware lists were already on; only the phishing list is new. It is on for new installs, and once for existing installs that still follow uBlock Origin's malware defaults. To stop it, untick it in uBlock Origin's Filter lists. Second, Bare keeps its Certificate Transparency log list current through Chromium's usual component update. Backup, automatic backup and Direct transfer make no internet request; Direct transfer runs over local Wi-Fi Direct. The details are in docs/network-behaviour.md.

Which APK to download

For most phones, download Bare-2.0.4-arm64-v8a.apk. Use Bare-2.0.4-armeabi-v7a.apk only on 32-bit ARM devices. Bare runs on Android 10 or later. There is no x86 build.

There are also two Bare-crashlab APKs for finding crashes. You do not need them for normal use. See docs/crashlab.md for what they do and what the log can hold. The CrashLab hashes are in SHA256SUMS-crashlab.txt.

The log lists the sites you visited and other app messages. Look through it before you send it to anyone.

Installing and updating

Install over Bare 2.0.0, 2.0.1, 2.0.2 or 2.0.3 and do not uninstall first. The package name and signing key are the same and the version number is higher, so Android should treat it as an update that keeps your data. You cannot go back to an older version without wiping Bare's data.

The GitHub build checks for updates, so Bare's own update check will offer 2.0.4. After you update, you see What's new, then a one-time backup page. Choosing "Not now" leaves automatic backup off. The Google Play build does not check for updates.

What's new

Backup and transfer

• Back up everything to one file, encrypted with a 30-digit number or your own passphrase. The number is shown once and cannot be recovered, so write it down. Without it or your passphrase, a backup cannot be opened.
• Automatic backup: Daily, Weekly, Monthly or Manual. It runs when you leave Bare. There is no background service.
• Backups and transfers include your open tabs, history and signed-in sessions. Treat a full or automatic backup file like a password, because it can sign someone in as you.
• Send your setup or everything to another phone with Direct transfer, or move it for good. Files made with "Share my setup" are not encrypted. Move erases the old phone after the new one confirms it has everything.
• New installs offer to restore or set up backups. If you are updating, you see a one-time backup page.
• Backups can be restored only by Bare 2.0.4 or newer. Bare cannot import from or export to other browsers.

Other changes

• Long-press the address bar and choose Scroll to top.
• Downloads go to your other download app only when you ask, and only with the cookies a normal request would send.
• While the Incognito lock is on, screenshots and the Recents preview are always blocked.
• Bare checks that certificates appear in public Certificate Transparency logs.
• uBlock Origin now has a list of known phishing sites switched on.

Versions

• Version name: 2.0.4
• Version codes: 802000415 (arm64), 802000410 (32-bit ARM)
• Chromium: 157.0.8103.46

Verifying the download

SHA256SUMS.txt has the SHA-256 of the two Bare APKs. The CrashLab hashes are in SHA256SUMS-crashlab.txt.

8309a3b1ec23c1881b91bff2a69ef7856fa25818d3451c8bc8c6c5f64b4c19c8  Bare-2.0.4-arm64-v8a.apk
92f75ce6224bcb9a1e20b067c7273f2be0a0b78dc2223b81fc523926733878bb  Bare-2.0.4-armeabi-v7a.apk

Both are signed with Bare's release key, the same one as earlier releases. apksigner verify --print-certs should show the certificate SHA-256 ae2a0e7fb7a132ec517d26a8e7c83d275e83747b0a777d4a42225b1d343271a0.

Contact

Problems and questions: support@barebrowser.org. Please include your device, Android version and what you were doing.