vauly 0.2.2

Limits on how often sign-in and two-step codes can be tried, and session tokens that count only with their signature. A migration runs on its own.

Updating from 0.2.1? Nothing to do but update: the migration runs on its own, and everyone stays signed in, the browser extension too. Update the extension along with the server. Updating vauly has the details. Copies made with the Deploy to Cloudflare button update with Actions → Update vauly.

Try it: the live demo at https://demo.vauly.app (shared, resets every hour).

Deploy your own in one click: .

Install the CLI on macOS or Linux; it checks the download against SHA256SUMS:

curl -fsSL https://vauly.app/install.sh | sh

On Windows, download vauly-windows-x64.exe below and check it against SHA256SUMS.

Browser extension: vauly-extension-0.2.2-chrome.zip below. Until vauly is listed on the Chrome Web Store, unzip it and load the folder unpacked in chrome://extensions, or build it yourself as the docs describe.

Check what a vauly serves: vauly verify <url> rebuilds the commit an instance names and compares every file and security header. vauly-build.json below is this release's own build.

Known limits: no independent security audit yet, and no native mobile apps yet. Security describes the design and where it stops protecting you.

What's in 0.2.2

Changed

• Sign-in is harder to guess at. One address gets a run of ten sign-ins, then waits a minute, counted across the whole server. After three wrong two-step codes in a row, an account's next sign-in waits five seconds, then twice as long after each wrong one, up to five minutes, and a right one starts the count again; the master password and the codes checked inside a session are counted apart, so guessing codes at sign-in never holds up a session that's already open, and nothing locks the account. The browser extension's session token now counts only with its signature, like the web app's cookie. A migration adds the counts; see Updating from 0.2.1.