Letterbox v3.3.0

v3.3.0 — 2026-05-10
Security fix
lookup_receive_pad_v3 did not reject send pads. A message crafted with one of the vault's own send pad IDs would have been accepted for decryption. Fixed. Test 7.1 now covers this.
Added

Main menu shows ✓ next to completed setup steps
Vault wipe after 10 consecutive failed passphrase attempts — 3-pass random overwrite of all data files
Optional duress passphrase (DURESS_PASSPHRASE in core/constants.py) — silently wipes all data and returns "Wrong passphrase."
Escalating lockout delays after failed attempts: 30s / 1m / 5m / 30m for attempts 6–9; survives quit-and-restart
Warning after attempts 8 and 9: "N attempt(s) remaining before data wipe"

Changed

Duress check fires before lockout delay — wipe is instant regardless of lockout state
Test suite fully updated for v3 architecture; 143 tests passing

Letterbox v3.2.0

Passphrase strength enforcement added to all passphrase set and change operations. Passphrases must now be at least 10 characters, contain at least one uppercase letter, and at least one non-alphanumeric character (space does not count). Failed requirements are shown individually before the user is asked to retry.

v3.1.0 — initial release

v3.1.0 — initial rerelease to simplify. See documentation.