2Secret 1.9.4: a security review, known keys and Touch ID on the Mac

Version 1.9.4 of 2Secret is out for every platform: the apps for Mac, Windows and Linux, the command line, the web vault, the browser extension and the sync server. It is a security update; nothing changes in how you use 2Secret.

What we checked

We went through the cryptography of 2Secret with three situations in mind: someone steals a copy of the sync server's database, someone steals a device or a backup of it, and someone controls a sync server for a while.

The design holds. Everything that matters on the server (items, vault names, keys, the sync token) is encrypted with keys the server never has, and the master password cannot be guessed from the database, because every account also has a Secret Key of 130 random bits that never leaves your devices. Of the sign-in key and of session tokens the server keeps only a hash. The weak spots we did find are fixed in 1.9.4.

Known keys

When you share a vault with someone, or trust them as an emergency contact, 2Secret encrypts the vault's key to their public keys, which the server reports. Until now a hostile server could put its own keys in someone's place. For an emergency contact that would even happen without you doing anything, at the next sync.

From 1.9.4 every device remembers the public keys of everyone it has sent a vault key to. If the server later reports other keys for that person, nothing is sent to them. The app shows both fingerprints, so you can compare the new one with that person through another channel (a call, in person) and trust it if it is right. On the command line: 2secret account trust-keys.

Replaced vault keys

A manager can give a shared vault a new key, for example after removing a member. A new key that the server offers for a vault without other members, but that did not come from your own devices, is now refused: only your own devices could have made it. After each sync the app tells you which vaults got a new key from another member, and which keys it refused.

Touch ID on the Mac

The key that unlocks 2Secret with Touch ID was kept in the Mac's login keychain, which has no Touch ID protection of its own. A copy of the Mac's disk, together with its login password, could open the vault without the master password or the Secret Key. The key is now a keychain item that the Secure Enclave releases only after Touch ID with the enrolled fingers, on that Mac, as on the iPhone. The app moves the key the first time you unlock after the update.

Share links

The server now stores only a hash of what opens a share link, so a copy of its database can neither open a link nor use up its views. Links made before keep working. Give a link a strong password when you send it through a channel others can read: someone who has both the link and a copy of the server's database can try passwords without limit.

What is still on the list

Two things remain; both are described in the security white paper. The first time a device sends a vault key to someone, it takes their public keys as the server reports them, so compare the fingerprint then. And a replaced key of a vault with other members is accepted as it comes, because replacements are not signed yet. Signed key replacements are planned for a later version.

Updating

• Mac, Windows and Linux: apps with automatic updates turned on offer 1.9.4 by themselves. Otherwise get it from the download page.
• iPhone and iPad: the App Store version is in Apple's review queue and follows in the App Store.
• Your own server: update it too, see self-hosting. The hashed share-link proof needs the new server.

Version 1.9.3, released the day before, brought the new look on phones: a floating tab bar of glass, menus on a long press, selecting several items at once, and website icons that are found faster and more often. Everything that changed is in the changelog.