Skip to content

KeyVault v1.12.0

Latest
Latest

Choose a tag to compare

View all tags
@sevmorris sevmorris released this 17 Oct 06:02
· 4 commits to main since this release
v1.12.0
cbd5c4f

Before you update

  • No downgrading. Older builds can't read secrets once they're re-saved in the new encryption format. Each secret is now bound to its own Keychain item, so ciphertext copied from one item onto another no longer opens there. Export a backup before updating.

Added

  • Change Passphrase. Settings ▸ Change Passphrase… re-encrypts every note, API key and file under a new master passphrase. If it is interrupted, the next launch finishes it or rolls it back.
  • Locking on sleep, screen lock and user switch. The vault now locks at once in each case, whatever the idle setting. On a Mac without Touch ID, the idle lock also forgets the key, the way Lock Vault Now does, because nothing could use a kept key to reopen the vault.
  • Search, with ⌘F. A search field in the toolbar filters the list by name, service, category and notes. Secrets are never searched.
  • Backup shows when this Mac last exported, in orange once that was more than 30 days ago.

Changed

  • Backup passphrases now need at least 12 characters. Restore still accepts whatever passphrase an older archive was made with.
  • Notes and files appear before the key lists finish loading. A gpg or ssh-keygen that hangs is stopped after a time limit, so "Loading keys…" can no longer stay up forever.
  • Backup says up front when GnuPG isn't installed, and now also finds the gpg that GPG Suite installs.

Fixed

  • A login keychain KeyVault can't read no longer looks like a vault with no passphrase. Before, KeyVault then listed every stored file as unreadable, offered to set up a new master passphrase, which would have made every secret and file unreadable, and could save new notes unencrypted. Now it says the keychain can't be read and offers to try again once it is unlocked.
  • Secrets stored without a master passphrase keep the Keychain's permission prompt. Every save used to open the item to any app on the Mac, so until a passphrase was set, any app could read notes and API keys without asking. Notes saved by earlier versions stay readable that way until they are encrypted under a master passphrase.
  • SSH key passphrases no longer appear in the process list. ssh-keygen now gets the passphrase through a helper instead of on its command line, and if a key still comes out unprotected, it is deleted rather than kept.
  • Cancel in Settings discards your changes. Before, edits took effect as you made them, and Cancel only skipped saving them to disk.
  • Smaller fixes.
    • A wrong archive passphrase is recognised even when gpg is translated.
    • Locking clears a secret you had just copied, if it is still on the clipboard.
    • A colon in a GPG name now shows as a colon.
    • A passphrase with accented characters opens the vault however it was typed.

Requires macOS 15.0 or later.

Assets 3
Loading