Repository navigation
Releases: Qualia2FA/Qualia2FA
Release list
Qualia2FA v0.4.1
本版本是 0.4.0 的修复版。 它处理真机复验发现的问题:Android 上导入保险库不再崩溃,扫描页申请相机权限也不再崩溃;Windows 的文件选择框在文件类型里显示文件后缀;设置界面可以直接导入保险库,导入后要求为这台设备设置新的解锁密码;点击输入框以外的区域会收起键盘与光标;设置密码与修改密码的「再次输入」字段名称正确;导出默认选中「加密保险库」。
保险库文件格式仍是 4,同步载荷仍是 4:0.4.0 与 0.4.1 可以互相打开、互相同步,升级不需要迁移数据。
Qualia2FA,桌面与 Android 应用。
请把所有设备一起升级。 保险库文件格式仍是 4,0.4.1 能直接打开 0.3.x 与 0.4.0 写出的保险库;一旦某台设备启用了锁定,它的主密钥就不在平台密钥库里单独存在了,0.3.x 读不出它。同步载荷仍是 4,0.4.1 与 0.3.x、0.4.0 之间仍可同步。
| 平台 | 产物 | 说明 |
|---|---|---|
| Android 8.0+(64 位 ARM) | Qualia2FA-v0.4.1-arm64.apk |
用项目的发布密钥签名 |
| Windows 10/11(x64) | Qualia2FA-v0.4.1.msi、Qualia2FA-v0.4.1.exe |
未签名,首次运行时会触发 SmartScreen 警告 |
Windows 上的生物识别解锁由 Windows Hello 提供,需要系统支持 WebAuthn 的 PRF 扩展(较新的 Windows 11 构建)。系统不支持时这一项如实报告不可用,密码照常可用。
应用不在后台同步。配对与同步的局域网部分只在需要它的界面打开时启用;首次配对仍然要读二维码,它把两台设备绑定在一起。
This release fixes defects in 0.4.0. It addresses what a pass on real devices
found: importing a vault no longer crashes on Android, and neither does the camera
permission request the scanner opens with; the desktop file dialog shows
the file suffixes in its file-type entry; a vault can be imported from the settings,
which asks for a new unlock password for this device afterwards; a tap outside a
field dismisses the keyboard and the caret; the repeat fields of both password
screens carry the right names; and the export screen starts on the encrypted vault.The vault file format is still 4 and so is the sync payload: 0.4.0 and 0.4.1 open
each other's vaults and still synchronize, with no data migration.
Qualia2FA, the desktop and Android application.
Upgrade every device together. The vault file format is still 4, and 0.4.1 opens a
vault written by 0.3.x or 0.4.0 directly. The one direction that does not hold is
0.3.x reading a locked device's vault: once the lock is enabled, the master key no
longer exists in the platform key store alone. The sync payload is still 4, and 0.4.1
still synchronizes with 0.3.x and 0.4.0.
| Platform | Artifact | Notes |
|---|---|---|
| Android 8.0+ (64-bit ARM) | Qualia2FA-v0.4.1-arm64.apk |
signed with the project's release key |
| Windows 10/11 (x64) | Qualia2FA-v0.4.1.msi, Qualia2FA-v0.4.1.exe |
not code-signed, so SmartScreen warns on first run |
Biometric unlock on Windows is Windows Hello, and it needs a system that supports the
PRF extension of WebAuthn (recent Windows 11 builds). Where the system does not, the
option reports itself as unavailable and the password keeps working.
Nothing is synchronized in the background. The local-network half of pairing and
syncing is opened while a screen that needs it is up, and the first pairing still
reads a QR code, which is what pins the two devices to each other.
Qualia2FA v0.4.0
本版本新增解锁密码与生物识别解锁。 主密钥不再只躺在平台密钥库里:它被 Argon2id 派生的密码包裹起来(
master.key.pw),设备支持时再加一层由系统认证放行的包裹(master.key.bio,Windows Hello 或 Android 生物识别)。打开应用凭密码或一次系统认证,密码始终是回来的路——平台凭据被删掉、换了指纹或人脸,仍能用密码进去。锁定可以随时在设置里点,15 分钟没有操作也会自动锁定;应用不在后台锁定,切到别的窗口不会立刻要求解锁。启动时直接弹出系统认证,不需要先点按钮。同时修复真机复验发现的问题:Android 上点「在局域网里查找设备」立即崩溃(权限请求码超出平台允许的范围);局域网在 Android 上收不到任何一台设备(组播 socket 绑在了单播地址上,而组播报文的目的地址是组地址);设备重开一次查找后会被对端一直显示为「已离线」(宣告序号的生命周期跨过了会话);设置页里生物识别的结果提示落在整页最底部,看上去像没反应。
Qualia2FA,桌面与 Android 应用。
请把所有设备一起升级。 保险库文件格式仍是 4,0.4.0 能直接打开 0.3.x 写出的保险库,打开后要求在这台设备上设置解锁密码。反过来不行:一旦某台设备启用了锁定,它的主密钥就不在平台密钥库里单独存在了,0.3.x 读不出它。同步载荷仍是 4,0.4.0 与 0.3.x 之间仍可同步。
| 平台 | 产物 | 说明 |
|---|---|---|
| Android 8.0+(64 位 ARM) | Qualia2FA-v0.4.0-arm64.apk |
用项目的发布密钥签名 |
| Windows 10/11(x64) | Qualia2FA-v0.4.0.msi、Qualia2FA-v0.4.0.exe |
未签名,首次运行时会触发 SmartScreen 警告 |
Windows 上的生物识别解锁由 Windows Hello 提供,需要系统支持 WebAuthn 的 PRF 扩展(较新的 Windows 11 构建)。系统不支持时这一项如实报告不可用,密码照常可用。
应用不在后台同步。配对与同步的局域网部分只在需要它的界面打开时启用;首次配对仍然要读二维码,它把两台设备绑定在一起。
This version adds the unlock password and biometric unlock. The master key no
longer sits in the platform key store on its own: it is wrapped by a key derived from
a password with Argon2id (master.key.pw), and, where the device can do it, by a second
wrap that only a platform authentication releases (master.key.bio: Windows Hello or the
Android biometric prompt). Opening the application costs the password or one system
gesture, and the password always stays the way back in - a deleted credential, a new
finger or a new face still leaves it usable. Locking is there whenever the settings are
asked for it, and fifteen minutes without a touch locks the vault as well; the
application does not lock because another window came to the front. A launch goes
straight to the system gesture instead of waiting for the button to be found.Alongside it, four defects found on a device: on Android, "find devices on the local
network" crashed at once (the permission request code was outside the range the platform
accepts); the local network heard no device at all on Android (the multicast socket was
bound to a unicast address, while a multicast datagram names the group); a device that
reopened its search stayed "offline" on the other side (the announcement counter's
lifetime outlived the session); and the biometric result was written at the very bottom of
a page taller than the screen, which read as no reaction at all.
Qualia2FA, the desktop and Android application.
Upgrade every device together. The vault file format is still 4, and 0.4.0 opens a
vault written by 0.3.x directly, asking for an unlock password for this device afterwards.
The other direction does not hold: once a device has the lock enabled, its master key no
longer exists in the platform key store alone, so 0.3.x cannot read it. The sync payload
is still 4, and 0.4.0 still synchronizes with 0.3.x.
| Platform | Artifact | Notes |
|---|---|---|
| Android 8.0+ (64-bit ARM) | Qualia2FA-v0.4.0-arm64.apk |
signed with the project's release key |
| Windows 10/11 (x64) | Qualia2FA-v0.4.0.msi, Qualia2FA-v0.4.0.exe |
not code-signed, so SmartScreen warns on first run |
Biometric unlock on Windows is Windows Hello, and it needs a system that supports the
PRF extension of WebAuthn (recent Windows 11 builds). Where the system does not, the
option reports itself as unavailable and the password keeps working.
Nothing is synchronized in the background. The local-network half of pairing and
syncing is opened while a screen that needs it is up, and the first pairing still
reads a QR code, which is what pins the two devices to each other.
Qualia2FA v0.3.1
本版本修复。 真机复验发现的三处问题:导入 .q2fa 之前一律先确认,明文容器的确认框会额外说明主密钥是明文;只含子分组的分组不再从主界面消失,子分组标题不再悬空缩进;15 分钟自动锁定只计应用在前台的时间,系统文件框打开期间不计时,导出的文件不再可能落成 0 字节。
Qualia2FA,桌面与 Android 应用。
请把所有设备一起升级。 本版本写出保险库格式 4 与同步载荷 4,无法与 0.2.x 同步:载荷只接受当前版本,因此对端得到的是明确的版本错误,而不是认证失败。老版本会把带图标的条目与树状分组读成别的东西,这正是抬高版本号要挡住的事。版本 1–3 写出的保险库文件仍然能打开。
| 平台 | 产物 | 说明 |
|---|---|---|
| Android 8.0+(64 位 ARM) | Qualia2FA-v0.3.1-arm64.apk |
用项目的发布密钥签名 |
| Windows 10/11(x64) | Qualia2FA-v0.3.1.msi、Qualia2FA-v0.3.1.exe |
已签名,但证书尚不被 Windows 信任:安装器会警告;在证书来自受信任的签发者之前,这个签名不能当作身份依据 |
应用不在后台同步。配对与同步的局域网部分只在需要它的界面打开时启用;首次配对仍然要读二维码,它把两台设备绑定在一起。
What this version fixes. Three defects found on a device: importing a .q2fa now
always asks first, and the plain container's dialog says the master key is in clear; a
group that holds only child groups no longer disappears from the 2FA list, leaving its
children indented under nothing; and the fifteen-minute lock counts time in front of the
application, so a system file dialog that is open while it fires can no longer leave an
export as an empty file.
Qualia2FA, the desktop and Android application.
Upgrade every device together. This version writes vault format 4 and sync
payload 4, and it cannot synchronize with 0.2.x at all: a payload accepts the current
version only, so what comes back is a version error rather than a failed
authentication. An older device reads an icon-carrying entry and the tree of groups as
something else, which is exactly what the version bump prevents. Vault files written by
versions 1 through 3 still open.
| Platform | Artifact | Notes |
|---|---|---|
| Android 8.0+ (64-bit ARM) | Qualia2FA-v0.3.1-arm64.apk |
signed with the project's release key |
| Windows 10/11 (x64) | Qualia2FA-v0.3.1.msi, Qualia2FA-v0.3.1.exe |
signed, with a certificate Windows does not trust yet: the installer will warn, and the signature is not an identity to rely on until the certificate comes from a trusted issuer |
Nothing is synchronized in the background. The local-network half of pairing and
syncing is opened while a screen that needs it is up, and the first pairing still
reads a QR code, which is what pins the two devices to each other.
Qualia2FA v0.3.0
本版本新增。 分组成了保险库里的树(格式 4):父关系与「条目 / 子分组」的混合顺序都随文件走,两台设备同步后树一致。条目可以带图标,随条目加密、随同步传输;二维码这类限长通道会明确拒绝带图标的载荷。导入与导出各只有一个入口:导入能识别 .q2fa 备份和别的应用的导出;导出先给出「保险库」「加密保险库」两个含主密钥的 .q2fa,再是纯文本、JSON、加密 JSON 与 HTML。界面按 0.3.0 的计划重做:浅色 / 深色 / 跟随系统,按窗口宽度自适应,分组树可折叠、可拖动换位。
Qualia2FA,桌面与 Android 应用。
请把所有设备一起升级。 本版本写出保险库格式 4 与同步载荷 4,无法与 0.2.x 同步:载荷只接受当前版本,因此对端得到的是明确的版本错误,而不是认证失败。老版本会把带图标的条目与树状分组读成别的东西,这正是抬高版本号要挡住的事。版本 1–3 写出的保险库文件仍然能打开。
| 平台 | 产物 | 说明 |
|---|---|---|
| Android 8.0+(64 位 ARM) | Qualia2FA-v0.3.0-arm64.apk |
用项目的发布密钥签名 |
| Windows 10/11(x64) | Qualia2FA-v0.3.0.msi、Qualia2FA-v0.3.0.exe |
已签名,但证书尚不被 Windows 信任:安装器会警告;在证书来自受信任的签发者之前,这个签名不能当作身份依据 |
应用不在后台同步。配对与同步的局域网部分只在需要它的界面打开时启用;首次配对仍然要读二维码,它把两台设备绑定在一起。
What this version adds. Groups are now a tree in the vault (format 4): parent links
and the mixed order of entries and child groups travel with the file, and the tree is the
same on both devices after a sync. Entries can carry icons, encrypted with the entry and
moved by sync; a length-limited channel such as a QR code refuses a payload with icons
rather than dropping them. Importing and exporting each have one entry: import recognises
a .q2fa backup and another application's export; export offers the two .q2fa
containers first (the plain one and the passphrase-protected one), then text, JSON,
encrypted JSON and HTML. The interface is the 0.3.0 redesign: light / dark / system theme,
adaptive columns, and a group tree that can be collapsed and rearranged.
Qualia2FA, the desktop and Android application.
Upgrade every device together. This version writes vault format 4 and sync
payload 4, and it cannot synchronize with 0.2.x at all: a payload accepts the current
version only, so what comes back is a version error rather than a failed
authentication. An older device reads an icon-carrying entry and the tree of groups as
something else, which is exactly what the version bump prevents. Vault files written by
versions 1 through 3 still open.
| Platform | Artifact | Notes |
|---|---|---|
| Android 8.0+ (64-bit ARM) | Qualia2FA-v0.3.0-arm64.apk |
signed with the project's release key |
| Windows 10/11 (x64) | Qualia2FA-v0.3.0.msi, Qualia2FA-v0.3.0.exe |
signed, with a certificate Windows does not trust yet: the installer will warn, and the signature is not an identity to rely on until the certificate comes from a trusted issuer |
Nothing is synchronized in the background. The local-network half of pairing and
syncing is opened while a screen that needs it is up, and the first pairing still
reads a QR code, which is what pins the two devices to each other.
Qualia2FA v0.2.2
本版本新增。 界面跟随系统的浅色或深色设置;应用有了新的标志:一个右下角被切掉的圆角方形,这也是该标志的第一个版本,在启动器与安装器绘制它的尺寸下仍然清晰。同一个图形就是启动器、安装器与界面里的图标。
Qualia2FA,桌面与 Android 应用。
请把所有设备一起升级。 本版本写出保险库格式 3 与同步载荷 3,完全无法与 0.1.x 同步:载荷只接受当前版本,因此对端收到的是版本错误,而不是认证失败。老版本会把 mOTP 条目读成普通 TOTP,静默丢掉 PIN 与步长,这正是抬高版本号要挡住的事。版本 1 与版本 2 写出的保险库文件仍然能打开。
| 平台 | 产物 | 说明 |
|---|---|---|
| Android 8.0+(64 位 ARM) | Qualia2FA-v0.2.2-arm64.apk |
用项目的发布密钥签名 |
| Windows 10/11(x64) | Qualia2FA-v0.2.2.msi、Qualia2FA-v0.2.2.exe |
已签名,但证书尚不被 Windows 信任:安装器会警告;在证书来自受信任的签发者之前,这个签名不能当作身份依据 |
应用不在后台同步。配对与同步的局域网部分只在需要它的界面打开时启用;首次配对仍然要读二维码,它把两台设备绑定在一起。
What this version adds. The interface follows the system's light or dark setting, and the
application has a new mark: a rounded square with its bottom-right corner cut away, which is
also the first version of the mark that stays legible at the size a launcher and an installer
draw it at. The icon is that same drawing in the launcher, in the installers and in the
interface itself.
Qualia2FA, the desktop and Android application.
Upgrade every device together. This version writes vault format 3 and sync
payload 3, and it cannot synchronize with 0.1.x at all: a payload accepts the current
version only, so what comes back is a version error rather than a failed
authentication. An older device reads an mOTP entry as an ordinary TOTP and silently
loses its PIN and its step, which is exactly what the version bump prevents. Vault
files written by version 1 and version 2 still open.
| Platform | Artifact | Notes |
|---|---|---|
| Android 8.0+ (64-bit ARM) | Qualia2FA-v0.2.2-arm64.apk |
signed with the project's release key |
| Windows 10/11 (x64) | Qualia2FA-v0.2.2.msi, Qualia2FA-v0.2.2.exe |
signed, with a certificate Windows does not trust yet: the installer will warn, and the signature is not an identity to rely on until the certificate comes from a trusted issuer |
Nothing is synchronized in the background. The local-network half of pairing and
syncing is opened while a screen that needs it is up, and the first pairing still
reads a QR code, which is what pins the two devices to each other.
Qualia2FA v0.2.1
Qualia2FA,桌面与 Android 应用。
请把所有设备一起升级。 本版本写出保险库格式 3 与同步载荷 3,完全无法与 0.1.x 同步:载荷只接受当前版本,因此对端收到的是版本错误,而不是认证失败。老版本会把 mOTP 条目读成普通 TOTP,静默丢掉 PIN 与步长,这正是抬高版本号要挡住的事。版本 1 与版本 2 写出的保险库文件仍然能打开。
| 平台 | 产物 | 说明 |
|---|---|---|
| Android 8.0+(64 位 ARM) | Qualia2FA-v0.2.1-arm64.apk |
用项目的发布密钥签名 |
| Windows 10/11(x64) | Qualia2FA-v0.2.1.msi、Qualia2FA-v0.2.1.exe |
已签名,但证书尚不被 Windows 信任:安装器会警告;在证书来自受信任的签发者之前,这个签名不能当作身份依据 |
应用不在后台同步。配对与同步的局域网部分只在需要它的界面打开时启用;首次配对仍然要读二维码,它把两台设备绑定在一起。
Qualia2FA, the desktop and Android application.
Upgrade every device together. This version writes vault format 3 and sync
payload 3, and it cannot synchronize with 0.1.x at all: a payload accepts the current
version only, so what comes back is a version error rather than a failed
authentication. An older device reads an mOTP entry as an ordinary TOTP and silently
loses its PIN and its step, which is exactly what the version bump prevents. Vault
files written by version 1 and version 2 still open.
| Platform | Artifact | Notes |
|---|---|---|
| Android 8.0+ (64-bit ARM) | Qualia2FA-v0.2.1-arm64.apk |
signed with the project's release key |
| Windows 10/11 (x64) | Qualia2FA-v0.2.1.msi, Qualia2FA-v0.2.1.exe |
signed, with a certificate Windows does not trust yet: the installer will warn, and the signature is not an identity to rely on until the certificate comes from a trusted issuer |
Nothing is synchronized in the background. The local-network half of pairing and
syncing is opened while a screen that needs it is up, and the first pairing still
reads a QR code, which is what pins the two devices to each other.
Qualia2FA v0.2.0
Qualia2FA,桌面与 Android 应用。
请把所有设备一起升级。 本版本写出保险库格式 3 与同步载荷 3,完全无法与 0.1.x 同步:载荷只接受当前版本,因此对端收到的是版本错误,而不是认证失败。老版本会把 mOTP 条目读成普通 TOTP,静默丢掉 PIN 与步长,这正是抬高版本号要挡住的事。版本 1 与版本 2 写出的保险库文件仍然能打开。
| 平台 | 产物 | 说明 |
|---|---|---|
| Android 8.0+(64 位 ARM) | Qualia2FA-v0.2.0-arm64.apk |
用项目的发布密钥签名 |
| Windows 10/11(x64) | Qualia2FA-v0.2.0.msi、Qualia2FA-v0.2.0.exe |
已签名,但证书尚不被 Windows 信任:安装器会警告;在证书来自受信任的签发者之前,这个签名不能当作身份依据 |
应用不在后台同步。配对与同步的局域网部分只在需要它的界面打开时启用;首次配对仍然要读二维码,它把两台设备绑定在一起。
Qualia2FA, the desktop and Android application.
Upgrade every device together. This version writes vault format 3 and sync
payload 3, and it cannot synchronize with 0.1.x at all: a payload accepts the current
version only, so what comes back is a version error rather than a failed
authentication. An older device reads an mOTP entry as an ordinary TOTP and silently
loses its PIN and its step, which is exactly what the version bump prevents. Vault
files written by version 1 and version 2 still open.
| Platform | Artifact | Notes |
|---|---|---|
| Android 8.0+ (64-bit ARM) | Qualia2FA-v0.2.0-arm64.apk |
signed with the project's release key |
| Windows 10/11 (x64) | Qualia2FA-v0.2.0.msi, Qualia2FA-v0.2.0.exe |
signed, with a certificate Windows does not trust yet: the installer will warn, and the signature is not an identity to rely on until the certificate comes from a trusted issuer |
Nothing is synchronized in the background. The local-network half of pairing and
syncing is opened while a screen that needs it is up, and the first pairing still
reads a QR code, which is what pins the two devices to each other.
Qualia2FA v0.1.0
Qualia2FA,桌面与 Android 应用。
| 平台 | 产物 | 说明 |
|---|---|---|
| Android 8.0+(64 位 ARM) | Qualia2FA-v0.1.0-arm64.apk |
用构建时拿到的密钥签名;debug 密钥签名能安装、能运行,但不是可以对外发布的身份 |
| Windows 10/11(x64) | Qualia2FA-v0.1.0.msi、Qualia2FA-v0.1.0.exe |
未做代码签名,首次运行会触发 SmartScreen 警告 |
应用不在后台同步。配对与同步的局域网部分只在需要它的界面打开时启用;首次配对仍然要读二维码,它把两台设备绑定在一起。
Qualia2FA, the desktop and Android application.
| Platform | Artifact | Notes |
|---|---|---|
| Android 8.0+ (64-bit ARM) | Qualia2FA-v0.1.0-arm64.apk |
signed with the key the build was given; a debug-key signature installs and runs and is not an identity to publish under |
| Windows 10/11 (x64) | Qualia2FA-v0.1.0.msi, Qualia2FA-v0.1.0.exe |
not code-signed, so SmartScreen warns on first run |
Nothing is synchronized in the background. The local-network half of pairing and
syncing is opened while a screen that needs it is up, and the first pairing still
reads a QR code, which is what pins the two devices to each other.
Qualia2FA v0.0.2
Qualia2FA,桌面与 Android 应用。
| 平台 | 产物 | 说明 |
|---|---|---|
| Android 8.0+(64 位 ARM) | Qualia2FA-v0.0.2-arm64.apk |
用构建时拿到的密钥签名;debug 密钥签名能安装、能运行,但不是可以对外发布的身份 |
| Windows 10/11(x64) | Qualia2FA-v0.0.2.msi、Qualia2FA-v0.0.2.exe |
未做代码签名,首次运行会触发 SmartScreen 警告 |
应用不在后台同步。配对与同步的局域网部分只在需要它的界面打开时启用;首次配对仍然要读二维码,它把两台设备绑定在一起。
Qualia2FA, the desktop and Android application.
| Platform | Artifact | Notes |
|---|---|---|
| Android 8.0+ (64-bit ARM) | Qualia2FA-v0.0.2-arm64.apk |
signed with the key the build was given; a debug-key signature installs and runs and is not an identity to publish under |
| Windows 10/11 (x64) | Qualia2FA-v0.0.2.msi, Qualia2FA-v0.0.2.exe |
not code-signed, so SmartScreen warns on first run |
Nothing is synchronized in the background. The local-network half of pairing and
syncing is opened while a screen that needs it is up, and the first pairing still
reads a QR code, which is what pins the two devices to each other.
Qualia2FA v0.0.1
Qualia2FA,桌面与 Android 应用。
| 平台 | 产物 | 说明 |
|---|---|---|
| Android 8.0+(64 位 ARM) | Qualia2FA-0.0.1-arm64.apk |
用 debug keystore 签名:能安装、能运行,但不是可以对外发布的身份 |
| Windows 10/11(x64) | .msi 安装器、.exe 安装器 |
未做代码签名,首次运行会触发 SmartScreen 警告 |
应用不在后台同步。配对与同步的局域网部分只在需要它的界面打开时启用;首次配对仍然要读二维码,它把两台设备绑定在一起。
Qualia2FA, the desktop and Android application.
| Platform | Artifact | Notes |
|---|---|---|
| Android 8.0+ (64-bit ARM) | Qualia2FA-0.0.1-arm64.apk |
signed with the debug keystore: it installs and runs, and it is not an identity to publish under |
| Windows 10/11 (x64) | .msi installer, .exe installer |
not code-signed, so SmartScreen warns on first run |
Nothing is synchronized in the background. The local-network half of pairing and
syncing is opened while a screen that needs it is up, and the first pairing still
reads a QR code, which is what pins the two devices to each other.