Skip to content

v1.10.2 - Passy Cloud - Security Hotfix

Latest

Choose a tag to compare

@GleammerRay GleammerRay released this 05 Aug 21:23
82fe9fa

Visit https://glitterware.github.io/Passy/ for easier installation with direct links to downloads, the website has recently been updated to provide a user-friendly installation experience.

Version shields

Github Latest Release F-Droid Latest Release Flathub Latest Release AUR Latest Release
Snapcraft Latest Release

You may see the current major release notes over at https://github.com/GlitterWare/Passy/releases/tag/v1.10.0

Fixes:

  • CWE-295 addressed:
    • Affected users: Passy Cloud users (QR sync users not affected).
    • Compromised data: encrypted data.
    • Issue: MITM attacks were possible due to disabled TLS certificate validation, however no decrypted data is currently transmitted to/from Passy Cloud servers, everything is decrypted and processed offline on end user devices. New Passy accounts use dargon2 key derivation by default, so risk of decryption by an attacker is moderately low.
    • Solution: TLS certificate validation enabled.
  • PDF file UI fixed.
  • Unknown file type UI now displays file size and a small hex preview instead of an error.

Localizations: