SecretSpace for Windows 3.0.0-alpha.8 (test version)

SecretSpace for Windows 3.0.0-alpha.8: a test version, not for real passwords yet, and a security fix for the earlier test versions. For real use, take the release marked Latest; it is not affected.

Security fix

• Who is affected: the test versions alpha.6 and alpha.7, when an account syncs with a server. Update if you tried them.
• The problem: the app took whatever vault key the server listed for it. A dishonest server, or someone who broke into it, could hand out a key of its own and read the vault the app uploaded under it at the next sync.
• The fix: every vault key is now signed by the account that made it, and the app checks the signature before it takes a key.
  • A key for a vault this device already has must be signed by your own account, by whoever signed the key it holds, or by a member whose fingerprint you compared.
  • A key with no signature, an older key put back, or a second key in place of the current one is refused. Nothing is changed and nothing of that vault is uploaded.
• Needs SecretSpace Sync Server 2.0.0-alpha.5. With an older server only the Personal vault syncs.
• Vaults made with alpha.6 / alpha.7 are signed at the next sync by a device that already holds them.

Also new

• A vault shared by someone whose fingerprint you have not compared shows them as not checked. Compare fingerprints in Members to change that.
• Remove and Change key name the members whose fingerprint was never checked on this device.
• An unencrypted http:// address of another machine asks before it is used.
• Not yet: the company setup (admin, invites) and recovery with an admin's approval.

Install

Download SecretSpace-Client-Installer.exe and run it. It needs Windows 10 or 11 (64-bit) and no admin rights. Don't install it over the 2.x release you use for real passwords: it opens SecretSpace 3 accounts only.

SHA-256 checksums are in SHA256SUMS.txt.

🤖 Generated with Claude Code