Skip to content

TeroVPN v1.2.0 - Security Hardening & Authentication Release

Latest
Latest

Choose a tag to compare

View all tags
@smartworldarafath smartworldarafath released this 07 Nov 20:11
· 1 commit to main since this release
v1.2.0
fb13952

TeroVPN v1.2.0 - Security Hardening, E2EE QR Sync & Mozilla Authentication Release

🛡️ Security Hardening (GitHub Issue #1 Fix)

  • End-to-End Encryption (E2EE): All cross-device QR authorization synchronization payloads (LAN HTTP & cloud relay) are now encrypted using AES-256-CBC with HMAC-SHA256 authenticated integrity verification.
  • Session Authentication & Secret Verification: Device pairing now requires a cryptographically secure 256-bit random session secret (secretKey) encoded directly into the QR code. Local pairing server strictly refuses unauthorized incoming pairings (401 Unauthorized).
  • Encrypted Password Storage: SharedPreferences credentials are no longer stored in plaintext. Passwords are saved with salted AES-256 encryption (enc:v1:) and legacy plaintext keys are safely migrated and purged.
  • Android App Sandbox Protection:
    • android:allowBackup="false" to prevent adb backup extraction.
    • Backup and data extraction rules explicitly exclude sharedpref.
    • Removed broad QUERY_ALL_PACKAGES permission in favor of scoped <queries>.
  • Desktop CI Binary Integrity: Added SHA256 checksum integrity verification for Windows, Linux, and macOS bundled core release binaries in .github/workflows/desktop.yml.

🔑 Mozilla Sign-In Flow Enhancements (GitHub Issue #2 Fix)

  • Email Link Confirmation: Added support for need_email_link authentication step ("Confirm Sign In via Email") with dedicated UX, automatic polling, and "I Confirmed in Email" action button.
  • Secondary Verification Steps:
    • need_unblock_code: Support for alphanumeric Mozilla account unblock codes.
    • need_totp: Support for 2FA authenticator codes.
    • need_captcha: Graphical CAPTCHA resolution.
  • Web Browser Fallback: One-tap fallback option to sign in through Mozilla's web dashboard via dashboardLink.
  • Friendly Error Messages: Clear error messages for unblock_code_rejected, too_many_codes, timed_out.

📱 Cross-Device QR Sync (Phone-to-Phone & Phone-to-Tablet)

  • Fixed cross-device authorization where phone-to-phone or tablet QR scanning previously failed to sign in.
  • Synchronously synthesizes authenticated accounts into the receiving device's active state and immediately persists them locally.
  • Dynamic LAN IP and port resolution during QR code generation.

📦 Release Assets

  • TeroVPN-Android-v1.2.0.apk (59.2 MB)
Assets 9
Loading