2Secret v1.9.2

Security fixes from a review of the apps, the server and the way releases
are made.

• iPhone and iPad: the Secret Key is no longer included in iCloud and
  computer backups, so a backup never holds it next to the encrypted vault.
• AutoFill (iPhone, iPad, Mac) and the browser extension: on websites where
  everyone gets a subdomain of their own (such as github.io), a login is
  only offered on its own site, never on someone else's.
• The apps connect to a sync server only over https:// (plain http://
  only to a server on the same device).
• A vault never goes back to a key it had before, so a server cannot give a
  removed member access to new items again.
• Copied passwords stay out of Windows' clipboard history and cloud
  clipboard, and out of clipboard managers on Linux and macOS.
• Website icons are fetched from public websites only, also when an address
  is an IP address written in a short form.
• The server checks the encrypted data it stores, so one account cannot
  disrupt syncing for others, limits sign-in attempts and password checks
  per address, and removes invisible characters from names.
• Updated libraries: rustls, the import of zip and XML files, and SQLite
  3.53.2 in the server.
• Every release's SHA256SUMS is signed (SHA256SUMS.sig), so downloads
  that do not update themselves can be checked: see Checking a download
  in docs/UPDATES.md.

For people who run their own server:

• The invite codes of the examples (change-me…) no longer let anyone sign
  up: choose your own.
• install.sh reads the client's address from CF-Connecting-IP only with
  a Cloudflare Tunnel; set --ip-header for another proxy.

Downloads

File	What
2Secret_*_aarch64.dmg	macOS app for Apple silicon (M1 and newer)
2Secret_*_x64.dmg	macOS app for Intel Macs
2Secret_*_x64-setup.exe	Windows app (installs for your user and can update itself; removes an .msi version of 2Secret up to 1.7.0)
*.deb, *.rpm, *.AppImage	Linux app (x86_64)
2Secret_*_android-arm64.apk	Android app (Android 7 and newer) – allow installing from your browser when asked
2Secret_*_android-arm64.aab	Android app bundle for app stores
2secret-*-<platform>.tar.gz / .zip	2secret CLI and 2secret-server for Linux, macOS (Apple silicon and Intel) and Windows
2secret-web-*.tar.gz	Web vault – serve it with 2secret-server --web-dir
2secret-extension-*.zip	Browser extension for Chrome, Edge, Brave and Firefox (load unpacked)
SHA256SUMS, SHA256SUMS.sig	Checksums of all files, signed with 2Secret's update key (how to check)

Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS):
docker pull ghcr.io/joostiphone/2secret:latest – see
self-hosting.

On macOS, drag 2Secret to Applications and open it. If macOS says it cannot
verify the app, open System Settings → Privacy & Security and click Open
Anyway (on macOS 14 and older you can also right-click the app and choose
Open).
On Windows, SmartScreen may ask you to confirm (More info → Run anyway).

FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the
README.