Biscuit 1.0.12

Download Biscuit 1.0.12 for Windows, macOS (Apple Silicon and Intel) or Linux (AppImage, .deb, .rpm, Arch, .tar.gz). If you already use Biscuit, it will offer you the update.

This version fixes three security issues, found by checking Biscuit against the fixes in Monero GUI 0.18.5.3, released yesterday.

A node only gets its own login

If you connected to a Monero node that needs a username and password, such as your own, then switched to another node, Biscuit kept offering that login to the new one. A malicious node could ask for it and try to guess your password. Each node now only ever receives its own login, even if you switch quickly.

No more shortcuts around Tor

Biscuit reaches addresses on your own network directly, without Tor or your proxy, so that your node at home keeps working. It recognized them by how the name starts, so a public server named like 10.example.org was taken for one of yours and reached directly, and an Electrum server with such a name could even use an unencrypted connection. Now only real local addresses skip Tor: localhost, .local names and private IP addresses.

The converter tells the truth about rates

The Converter tab on Home said "No new exchange rates received for over 10 minutes" a few minutes after every start, and kept saying it, even while prices were arriving normally. It was checking a service Biscuit doesn't use. It now looks at when the prices were actually fetched, and only warns if they are more than 30 minutes old.

A stricter update check

Biscuit checks every update against our signed list of files before installing it. It now refuses signatures that claim any hash algorithm other than SHA-256, the one our releases are signed with.

Monero 0.18.5.3 itself also brings more protection against malicious nodes. It will come in a next version of Biscuit, once it's merged into the Monero code Biscuit is built on.

Biscuit is new, and in its first weeks we shipped fixes as soon as they were ready. From now on, releases will come every two weeks, sooner only for an urgent security fix.

Verify your download

Every file is listed with its SHA-256 checksum in hashes-1.0.12-plain.txt, signed with the Biscuit release key:

Biscuit Wallet releases
D714 332E 6101 C1DA AC60  E644 202F 1FA3 98DE CEFA

Releases are built with Guix from the source archive. How to check them: Verifying your download.

Found a bug, or have an idea? Tell us.