Skip to content

v0.1.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Aug 04:52
· 2 commits to main since this release
v0.1.1
d411bf1

SeedMask Firmware v0.1.1 (preview)

Highly experimental early public build. Not a finished product.

This release is for development, testing, and source verification only. Expect bugs, incomplete flows, and breaking changes. Do not treat it as production-ready or as a safe store of significant funds.

What’s new

  • Hardened backup codes (new format). Old backup codes will not restore.
  • Backup password: min 12 chars, uppercase + digit + symbol; blocks obvious weak passwords.
  • Backup QR now shows the backup code (not the password-vault QR).
  • Backup code shown as numbered boxes (12 or 18); last 24-word box has 5 characters. Restore → type into the same boxes. QR stays a QR.
  • Fix Seed Settings still showing “Create a Backup code” after a 24-word backup was already made.
  • After create, show the microSD filename: “Backup code saved to microSD as Backup_….bin”. Also SD not ready for backup when there is no card.
  • Wipe Device now securely erases NVS and SPIFFS (and FAT/coredump if present): erase, overwrite with random, erase again. Firmware and microSD are not touched..
  • First Add (passwords / notes / 2FA) asks for a vault password only if no backup code exists yet. After that, Add is just the login/note/2FA itself.
  • While creating a vault password or a backup-code password, a highlighted card says to save it (vault recovers everything / vault reuses the backup password).
  • Saving a password, note, or 2FA requires microSD. Without a card, it shows Insert microSD to save and does not keep the entry (not in the list, not after reboot).
  • Create seed: Dice is the recommended path. Standard now shows a warning first (unmeasured chip RNG, not a certified TRNG; no second mixer or health tests yet). You can still continue.

Known limitations (examples)

  • Vault / master-password KDF currently uses PBKDF2 at only 10,000 iterations (far below a hardened final target; we plan to raise this)
  • PIN / lock KDF is 20,000 iterations
  • Backup-code wrap is 100,000 iterations (stronger than v0.1.0, still not a substitute for the words)
  • Many rough edges, errors, and unfinished behavior remain
  • UX and security posture will change as the firmware matures

Verify the build

Reproducible Docker builds: see docs/REPRODUCIBLE_BUILD.md in this repo. Compare SHA256SUMS from this release with a local ./scripts/docker-build.sh on tag v0.1.1.

Flash

Browser flasher: https://seedmask.io/features/firmware
Primary app image: SeedMask_Firmware.bin
(Optional full image: SeedMask_Firmware.merged.bin)

Source: GPLv3 — https://github.com/SeedMask/SeedMask-Firmware

Assets 7
Loading