Skip to content

GVault 0.1.10

Choose a tag to compare

View all tags
@guberm guberm released this 18 Jul 22:39
v0.1.10
832ebac
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Account and vault-password separation release.

  • Regular Web and Android login uses only email and the server account password.
  • Registration requires a confirmed master password without sending it to the server.
  • Vault unlock/restore is a separate client-side step after login.
  • Restore candidates are authenticated against all ciphertext, including deleted tombstones, before decrypted state or Autofill becomes available.
  • Web restore is pull-only until the candidate key is authenticated.
  • Browser-extension/desktop/Linux future account flows must follow the same documented contract.
  • Secure account-password recovery remains tracked by #501.

Validation: 138/138 repository tests, server smoke 1/1, independent Reviewer approval, production Web browser acceptance, and full Pixel 7 Pro Android 17/API 37 device acceptance.

PR: #502

Assets 4
Loading