Skip to content

v1.1.13

Choose a tag to compare

View all tags
@manu-tech-code manu-tech-code released this 17 Oct 15:00
v1.1.13
8a92999

Passwords, new in this release

Drift can keep your logins now.

  • An encrypted vault. Logins are sealed with AES-GCM under a key derived from your master password by PBKDF2-HMAC-SHA256 at 600,000 rounds. The master password itself is never stored, so the file on disk holds only a version, the iteration count, the salt and the ciphertext — and a wrong master password is refused by the authentication tag rather than being allowed to produce nonsense.
  • Save when you sign in. Submit a login form and Drift offers to save it, naming the user name it caught. It offers only over https (or loopback), never in a private space, never on a site the lookalike guard has flagged, and only while the vault is unlocked.
  • Fill with ⇧⌘F, or from the command bar. Several accounts for one site get a picker. Logins match on the registrable domain, so a saved example.com never answers for notexample.com.
  • Unlock with Touch ID. The vault asks for your fingerprint when its window opens and falls back to the master password on a failed or cancelled read. The fingerprint check is Drift's own: a system-gated keychain item needs a provisioning profile this build doesn't carry, and the setting says exactly that.
  • Drift → Passwords… (⌘⌥P). Search, add, edit, delete, reveal, copy (cleared from the clipboard after 45 seconds), generate a password, and lock. Closing the window locks it; it also locks itself after a configurable idle period, and locking throws the key away and empties the entries from memory.

Fixes

  • IP addresses in the vault. The registrable-domain helper turned 127.0.0.1 into 0.1, so the save prompt offered to file a login for "0.1", and two unrelated addresses ending .0.1 would have shared one entry. IP literals are recognised and kept whole now.
  • Unlabelled fields. The add-login sheet drew its fields with no labels and no placeholders at all. Every vault field now has a visible name and an example, the way the rest of the app's settings do.

Everything else is as it was in 1.1.12: extensions, fingerprint protection, site permissions and the page rendering are untouched.

Assets 4
Loading