Skip to content

Beamer 1.4.3

Choose a tag to compare

View all tags
@TK9443 TK9443 released this 30 Sep 13:43
· 28 commits to main since this release
v1.4.3
8ff1d98

A security fix for pairing, a fix for a pointer left on a locked PC, and Hide addresses hiding the addresses it missed. Update both machines. Your pairing and settings stay as they are, and 1.4.3 and 1.4.2 still work together once paired; to pair afresh, both machines need 1.4.3. If you last paired on a network you do not trust, pair again after updating.

Downloads

  • macOS 13 or later, Apple silicon: Beamer-1.4.3.dmg, signed with a Developer ID and notarised by Apple. Intel Macs are not supported.
  • Windows 10 and 11, 64-bit: Beamer-Setup-1.4.3.exe, or winget install KalkmanCode.Beamer once the winget listing is approved.

The Windows installer is not code-signed, so Windows shows "Windows protected your PC" the first time. Choose More info, then Run anyway. Everything in it is built from this repository.

Fixed

  • Someone on your network while you paired could have found the code. Up to 1.4.2, each machine proved it knew the six-digit code with a value computed from it. Someone on your network during the minute a code was on screen could capture the Mac's proof, try every one of the million codes against it on their own hardware, and, with enough of it, pair with the PC as the Mac. SECURITY.md said so; it is now closed.

    From 1.4.3, pairing is CPace, a password-authenticated key exchange, with the code as the password. Nothing either machine sends can be tested against a list of codes, so an attacker gets at most one guess against each machine, two chances in a million, for each code you show, and a new code needs someone at the PC to press Pair a Mac. The exchange is written out in PAIRING.md, with test vectors, and SECURITY.md says what it protects and what it does not.

  • The Mac's pointer could be left on a locked PC. If the PC locked while the Mac was driving it, or you switched to a PC that was already locked and would not unlock itself, the pointer stayed there until the PC was unlocked by hand. The PC now sends the pointer home when it finds itself locked.

  • Hide addresses left a few addresses showing. With Hide addresses on, Windows still showed the Mac's address in the note under Send input to your Mac and in tray alerts, and the Mac still showed the PC's in its footer after a failed switch, in the heading for a PC with no name, and in notifications. All of them are now hidden with the rest.

Thanks to simplyJW for the report (#5).

SHA-256

ef2ee5ec24866ed90b470a1e5baf21b5e1f9a87c6e8f93e667daf20fb8be6e75  Beamer-1.4.3.dmg
5ca24fcf5db969fda4f8668d9df7f41f6ef097305642ca15b8619239d18992dc  Beamer-Setup-1.4.3.exe
Assets 5
Loading