Skip to content

v3.0.4 🦕 Iguanodon — CSP hardening, anti-framing & checksums

Choose a tag to compare

View all tags
@seQRets seQRets released this 12 Sep 02:52
· 40 commits to main since this release
v3.0.4
88ef720

v3.0.4 🦕 Iguanodon — CSP hardening, anti-framing, published checksums

A security-hardening release, building on v3.0.3. No user-facing
behaviour changes, and the cryptography, container format, wordlist, and
self-tests are untouched.

Changes

  • Hash-pinned Content-Security-Policy. Both shipped files now pin every
    inline <script> block as a script-src 'sha256-…' source instead of
    'unsafe-inline'. The browser executes only those exact blocks and refuses
    to run any injected inline script (hash mismatch). Every other directive is
    unchanged — including default-src 'none', connect-src 'none', and
    style-src 'unsafe-inline'.
  • Anti-framing guard. Both files refuse to initialize if they detect they
    are embedded in a frame (window.top !== window.self, caught for the
    cross-origin case), showing a plain "open it directly" message instead. A
    <meta> CSP cannot set frame-ancestors, so this JS check is the mechanism.
    (The default-src 'none' policy also blocks the pages from framing anything.)
  • Published checksums. SHA256SUMS.txt now ships as a release asset
    alongside ittybitz.html and ittybitz-recovery.html. See
    Verify your download
    in the README for the sha256sum / certutil commands.
  • Maintenance tooling. scripts/update-csp-hashes.mjs (plain Node, zero
    dependencies) recomputes the inline-script hashes, rewrites both files' CSP
    in place, and regenerates SHA256SUMS.txt. It is idempotent and runs
    automatically as part of npm run build.
  • SECURITY-AUDIT.md gained an addendum mapping the v2.8.1 (Next.js) audit
    onto the v3 single-file architecture: the PBKDF2-vs-Argon2id tradeoff still
    applies (crypto unchanged); the Next.js, CI, and bundle findings are obsolete.

For users

Nothing to do. Existing .ibitz files and encrypted text decrypt exactly as
before. If you keep a saved offline copy, you can now verify it against the
SHA256SUMS.txt attached to this release.

Verify your download

e206abbe93c275fce0ffb04bbb0c1536869635f5a2b0b70d4c2a435edf56c1ee  ittybitz.html
952cf09a7595d71d6c2ed7932b11e79c8c53a800b56d947f15609737a62717cb  ittybitz-recovery.html

macOS/Linux: shasum -a 256 -c SHA256SUMS.txt (or sha256sum -c) · Windows: certutil -hashfile ittybitz.html SHA256

Assets 5
Loading