Pass Tech 2.7.1 — decoy-session oracles

⛔ End of life — this is the last Flutter release

Superseded by Pass Tech 3.0.0,
a rewrite in Kotlin. 2.7.1 gets no further work of any kind, security fixes included.

It stays downloadable on purpose. 2.7.1 runs on Android 7, and 3.0 needs Android 8. Taking
this page down would remove the only working version from the phones least able to do anything
about it. If your phone runs Android 7, this release is still yours to use — just know that
nothing further will be fixed in it.

On any phone running Android 8 or later, move to 3.0. It is a different application, with
its own id, so it installs beside this one rather than over it and your vault here is never
touched. Export an encrypted .ptbak backup from this app, import it into 3.0, check your entries
are all there, and only then remove this one. Nothing is stranded in either direction: 3.0 reads
every .ptbak ever written, and the file it writes still imports back into this version.

---

Decoy vault — three settings surfaces gave it away

The decoy vault exists for one situation: someone is standing over you and you
hand them a password. It only works if nothing on screen behaves differently
depending on which vault is open. Three things did.

Inheritance is now per vault slot. Its five keys and its snapshot file were
global, and the settings screen renders them — so from a decoy session the app
showed the state of the main vault:

• Setting inheritance up was refused with a message naming the main vault.
  Four taps, no secret required: the guard ran before the passphrase prompt.
• The "current inactivity" counter could only read zero from the main vault,
  since unlocking had just written it. Any other value identified the decoy.
  Scrolling was enough.
• "Update" accepted, from the decoy, the passphrase you had just handed over,
  and refused it from the main vault — while overwriting the real snapshot.

Scoping the state removes all three at once: there is nothing left to refuse,
so nothing left to give away. The main vault keeps its historic key names, so
inheritance you have already configured survives this update untouched.

Removing the decoy now also destroys its inheritance, on all three paths that
remove the decoy alone. That file has no dummy twin: left behind, it would
prove after the fact that a decoy had existed.

Also fixed

• The app did not lock after setting up a decoy, nor after panic. It
  returned to the vault screen — empty, because the vault had just been locked,
  which reads as data loss. The decoy flow promised to force a fresh login and
  did not. Present in 2.7.0; found by testing on a device.
• The store listings claimed panic mode destroys the Keystore key. It never
  did, in any version. The dialog inside the app was accurate all along. The
  listings now say what panic actually does: instant lock, biometrics disarmed,
  cached exports shredded.
• The home title overflowed its row by five pixels on a 1080x2220 screen.
  Release builds clip in silence, so 2.7.0 shipped with it unseen.
• disable() now requires an open vault: an auto-lock slipping between the
  confirmation dialog and the tap could have destroyed the owner's snapshot.

What is still not guaranteed

THREAT_MODEL.md now names the decoy oracles that remain, rather than implying
there are none. The plainest: "Delete all data" leads to the creation screen
from the main vault and to the unlock screen from the decoy — the app
promises a permanent deletion, then asks for a password. Closing it needs a
unified home screen, and that is the next piece of work, not this release.

Inheritance set up from a decoy session is also written but never read, and its
storage keys are visible to anyone who can copy the app's private directory.
Both are stated in the threat model with what closing them would cost.

Verification

Four APKs, all signed with the same certificate as every release since 2.6.0
(733cf8b4ffb0ce052ca92604872f781aa29effd38c36cb710faf94d6b3c35794, verified
against the re-downloaded 2.7.0). Permission surface unchanged: INTERNET,
USE_BIOMETRIC, USE_FINGERPRINT.

Install arm64-v8a for any phone from about 2016 onwards; universel works
everywhere and is larger.

52c8f4a53e75dc2918466d3ea67f0459ed7828472b9dfed08e8a41c34b8a02d3  pass-tech-arm64-v8a-2.7.1.apk
0bcfce9146d64cac536d66dad2e6b20b59271891e85f83427a7aa9eb3a11e72a  pass-tech-armeabi-v7a-2.7.1.apk
4c8d6f50a7a1798e1c35319013157f67c53918177d2275725f717a9fe847a2c3  pass-tech-universel-2.7.1.apk
70e6338a423f30204f3c7ccbf7b6b1495ad153ab8f64eddf00f84485d1cbe6ac  pass-tech-x86_64-2.7.1.apk