swpasskey v0.2.0

Security fixes and a redesigned macOS app. Thanks to @Lakr233 (#8).

Download and install

• Apple Silicon, macOS 14 or later: download swpasskey-0.2.0-macos-arm64.zip.
• Extract the ZIP, move swpasskeyd.app to /Applications (replacing 0.1.0), then open it.

The app is Developer ID signed (team 32B45SMMQL), Apple notarized, and has a stapled notarization ticket. It uses the same bundle ID as 0.1.0, so existing passkeys and settings carry over. SHA-256 checksums are in SHA256SUMS.txt. No Intel Mac or Linux binaries.

Security

• hmac-secret without user presence (medium): a getAssertion with up=false returned hmac-secret output with no prompt. It is now released only after user presence (also for getNextAssertion).
• CTAPHID framer (low): channel ownership is checked before BCNT, so an oversized INIT from another channel can no longer wipe the transaction in progress.
• Log file (low): the LaunchAgents no longer log to the shared /tmp/swpasskeyd.log; the daemon writes ~/Library/Logs/swpasskey/swpasskeyd.log (0700 dir, 0600 file, O_NOFOLLOW).
• Terminal prompt (low): site and account text are sanitized like the GUI prompts.
• Stale approval panels from an earlier request can no longer affect a newer one.

macOS app

• New approval panel that names the action ("Sign in to github.com?"), with a short delay before the button enables so a stray keystroke cannot approve. Esc cancels; stays above full-screen apps.
• Passkeys window: search, sortable table (default Last Used), live updates, and type-the-account-name to delete.
• Settings with General, Security and About tabs; a Welcome window on first launch.
• Dock icon appears only while a window or the status menu is open.
• Plain-language copy across prompts and alerts.

Validation

Built with cmake --preset app: 110/110 tests passed; ci preset 112/112. Apple notarization accepted; spctl reports "Notarized Developer ID".

swpasskey v0.1.0

First macOS release of swpasskey, a software FIDO authenticator with Secure Enclave key storage.

Download and install

• Apple Silicon, macOS 14 or later: download swpasskey-0.1.0-macos-arm64.zip.
• Extract the ZIP, move swpasskeyd.app to /Applications, then open it.
• Use the key icon in the menu bar to open Keys and Preferences.
• Set a PIN in Preferences → Set PIN… before passkey sign-in on sites requiring user verification. Approve the app prompt, then enter the PIN when your browser asks.

The app is Developer ID signed, Apple notarized, and includes a stapled notarization ticket. SHA-256 checksums are provided in SHA256SUMS.txt. This release does not include Intel Mac or Linux binaries.

Features

• Virtual USB HID FIDO authenticator for compatible browsers and tools.
• Secure Enclave credential keys, encrypted credential storage, and approval prompts.
• CTAP2, PIN protocol 2, discoverable credentials, hmac-secret, and U2F support.
• Menu bar app with credential management, PIN setup, and launch-at-login preferences.

Security scope

This is a software authenticator, not a hardware security key. Same-user malware can invoke signing even when private keys cannot be exported. The approval dialog is not hardware-enforced user presence. Attestation is self-attestation; sites requiring certified hardware attestation may reject it. See the README for the threat model.

Validation

The release build passed 108 tests and the local CI preset passed 110 tests. The signed app was accepted by Apple notarization. The macOS 14 deployment minimum is explicit; the release was built and validated on the maintainer’s newer macOS system.