MasterSafe Authenticator 1.5.0

Accessibility

• Screen readers: every input, button, list and progress bar now has an accessible name, headings carry their level, status messages are announced, and the automatic-lock warning is announced at once. A test opens every page and fails if a control has no name.
• Text and window size 100 to 200% in Settings, and Ctrl and plus / minus / 0 anywhere. The layout reflows.
• High contrast theme, also chosen automatically when Windows high contrast is on and the theme is "Follow the system".
• Keyboard: access keys on the navigation (Alt and the underlined letter), F1 for help, Ctrl+L to lock.
• Time: a warning with "Keep unlocked" 30 seconds before the automatic lock.
• Easier reading in Settings: more space between letters, words and lines.
• New accessibility statement.

Getting started

• Exit button in the sidebar and on the sign-in screen: locks the vault and closes the program, whatever the tray setting.
• First-run guide: after a new vault is created, one page lists the steps that matter (recovery key, quicker unlock, first account, passwords), shows what is done and goes to the right page. Every step can be skipped.

Languages

• Spanish (Español) and Finnish (Suomi) besides English: every screen, the Help, the tray menu and the app's messages. System error texts stay in the language they come in. The language follows the computer and can be chosen in Settings; a change applies fully after a restart. See docs/Translating.md for how texts are translated and how to add a language. A test fails when a text on a screen has no translation.

Security

• Security check-up at the top of the Health page: looks at the lock time, lock on computer lock, screen capture block, clipboard clearing, recovery key, recovery backup, second unlock method and breach check, and says what to change. Nothing is changed for you.
• Test and strengthen in Settings: measures this computer and moves the vault to the strongest Argon2id setting (up to 512 MiB) that still unlocks in about a second. The master password does not change; the page also shows the current setting.
• Quick lock: "Lock vault" in the tray menu and, if you turn it on in Settings, Ctrl+Alt+L from any program (Windows).
• Revealed passwords hide again by themselves after 20 seconds.
• Review fixes:
  • Changing the master password, strengthening the protection or removing an unlock method now removes vault.sauth.bak and the daily snapshots. Those copies still opened with the old password and hold the same data key as the current vault.
  • Password boxes no longer give their plain text to accessibility tools; they report dots, so a screen reader cannot speak a master password.
  • Moving a vault to the archive removes its snapshots, so "delete forever" really is the end of it.
  • The password typed for "Test and strengthen" is cleared when the vault locks or the step fails.
  • Translation no longer touches your own text (an entry called "Password" keeps that name).
  • A WebDAV server can no longer send DTDs or an unlimited folder listing.
  • GitHub workflows have read-only default permissions, and the release tag is no longer placed directly in a script.
• Removed "Copy recent code" from the tray menu. It did nothing, and it would have put a code on the clipboard without showing which account it belongs to.
• Signing is now offline. The release workflow no longer has the signing key: it builds, tests, records a build attestation and drafts the release. scripts/sign-release.ps1 signs on the maintainer's computer after checking the attestation and checksums of every file. See docs/ReleaseProcess.md.
• All GitHub Actions are pinned to exact commits.
• NuGet lock files: CI fails when a package differs from the recorded version and hash.
• Fuzzing: every reader of outside data (setup links, Base32 keys, KeePass exports, vault contents, vault files) is fed randomly damaged input on each build, with a long run every week. Damaged input must be refused cleanly and a damaged vault must never open with changed contents.
• Daily vault snapshots: the first save of each day keeps a copy of the vault as it was, and the last 7 are kept (only for vaults in the app's own folder).
• Process hardening (Windows): DLLs are not loaded from remote or low-integrity places, system folders come first, legacy extension points are off, Windows Error Reporting does not collect memory dumps, and the data folder is limited to your account and the system.
• Fixed: changing the theme from a background thread could throw.
• Fixed: the automatic lock could be held off by the mouse resting on the window, because the code refresh counted as mouse movement.