CloudAuth v1.0.1

Points the extension at the hosted backend instead of localhost, so you no
longer need to run a server yourself.

Install

Chrome — unzip cloudauth-chrome-v1.0.1.zip, go to chrome://extensions,
enable Developer mode, then Load unpacked on the folder.

Firefox — unzip cloudauth-firefox-v1.0.1.zip, go to
about:debugging#/runtime/this-firefox, click Load Temporary Add-on and
pick manifest.json.

If you already have v1.0.0 installed, replace it and hit reload — the manifest
changed, so it will not update in place.

Changes

• API_BASE now points at the hosted backend
• Both manifests carry the matching host_permissions
• http://localhost:4000/* stays permitted, so switching back to a local server
  is a one-line change in config.js with no permissions edit

Everything else is unchanged from v1.0.0. Same code in both builds; only the
manifest differs (Chrome side_panel, Firefox sidebar_action).

Still unsigned, so Chrome shows the developer-mode notice and Firefox drops the
add-on on restart.

CloudAuth v1.0.0

Browser extension authenticator with end-to-end encrypted sync. Codes are
generated locally and the vault is encrypted before it leaves the browser, so
the server only ever stores ciphertext.

Install

Chrome — download cloudauth-chrome-v1.0.0.zip, unzip it, then go to
chrome://extensions, turn on Developer mode, and click Load unpacked on
the unzipped folder.

Firefox — download cloudauth-firefox-v1.0.0.zip and unzip it. Go to
about:debugging#/runtime/this-firefox and click Load Temporary Add-on,
then pick manifest.json from the folder.

You also need the backend running. See the README for setup, or DEPLOY.md to
host it. By default the extension points at http://localhost:4000 — change
config.js and the manifest's host_permissions to use a deployed server.

What's in it

• TOTP (RFC 6238), HOTP (RFC 4226) and Steam Guard codes
• Add accounts by scanning a QR off the page, from an image, by pasting an
  otpauth:// link, or by bulk import from Google Authenticator
• AES-256-GCM vault, PBKDF2-SHA256 at 600k iterations, synced to your own server
• Works offline from a cached copy
• Encrypted backup export and restore
• Autofill codes into the page, search, tags, pinning, drag to reorder
• Popup or side panel, light and dark themes
• Auto-lock, and "sign out all devices" for instant token revocation

Notes

The two builds share the same code and differ only in the manifest: Chrome uses
side_panel, Firefox uses sidebar_action.

Neither build is signed. Chrome will flag it as a developer-mode extension, and
Firefox will drop it on restart — that is expected for an unpacked install and
needs a store listing to change.