v1.16.1

Warnings on look-alike sites

Fake sign-in pages copy the real one and pass whatever you type, the 2FA code
included, straight on to the real site. A code can't tell where it is being
typed. The extension can: it knows the page's address and where each account
has been used.

• Before a code goes to a page whose address imitates the account's site,
  the extension asks. That covers copying it from the list, picking it when
  right-click → Insert 2FA code asks which account, and the ⌘⇧2 palette
  in the Mac app. It covers addresses with look-alike letters (g1thub.com, a
  Cyrillic і, rnicrosoft.com), a single typo (githuh.com), the name plus
  a phishing word (github-login.com, secure-paypal.com), and the real
  address worn as a subdomain (github.com.verify-session.xyz).
• Built to stay quiet. It only speaks up when an address imitates a name
  the account already carries: its issuer, a website you tied to it, or a site
  you inserted its code on. A page that is just a different site, the
  service's own other domains (microsoftonline.com, steamcommunity.com,
  amazon.de) and a list of well-known real services never trigger it.
  It's the real site is remembered for that account, and the whole thing
  can be switched off in Settings → Warn about look-alike sites.
• When the warning appears in the Mac palette, a yes copies the code instead
  of typing it.

Security

• Insert 2FA code no longer types a code into a site that only contains
  the service's name. The site's name was matched against the account's
  issuer as a bare substring in both directions, so with one GitHub account in
  the list, right-click → Insert 2FA code on hub.xyz filled in the GitHub
  code without asking; box.com got Dropbox's, lab.io GitLab's. The name now
  has to be whole words of the issuer or the account name. And a name match no
  longer fills on another domain when the account has only ever been used
  elsewhere (github.co for an account used on github.com): it asks once
  and remembers. Reported by kta1kri. Thank you.

The Chrome Web Store update follows after review; until then the store may
still offer 1.16.0.