2Secret 1.9.2

Security fixes from a review of the apps, the server and the way releases are made.

iPhone and iPad: the Secret Key is no longer included in iCloud and computer backups, so a backup never holds it next to the encrypted vault.
AutoFill (iPhone, iPad, Mac) and the browser extension: on websites where everyone gets a subdomain of their own (such as github.io), a login is only offered on its own site, never on someone else's.
The apps connect to a sync server only over https:// (plain http:// only to a server on the same device).
A vault never goes back to a key it had before, so a server cannot give a removed member access to new items again.
Copied passwords stay out of Windows' clipboard history and cloud clipboard, and out of clipboard managers on Linux and macOS.
Website icons are fetched from public websites only, also when an address is an IP address written in a short form.
The server checks the encrypted data it stores, so one account cannot disrupt syncing for others, limits sign-in attempts and password checks per address, and removes invisible characters from names.
Updated libraries: rustls, the import of zip and XML files, and SQLite 3.53.2 in the server.
Every release's SHA256SUMS is signed (SHA256SUMS.sig), so downloads that do not update themselves can be checked: see Checking a download in docs/UPDATES.md.

For people who run their own server:

The invite codes of the examples (change-me…) no longer let anyone sign up: choose your own.
install.sh reads the client's address from CF-Connecting-IP only with a Cloudflare Tunnel; set --ip-header for another proxy.

Downloads

File	What
`2Secret_*_aarch64.dmg`	macOS app for Apple silicon (M1 and newer)
`2Secret_*_x64.dmg`	macOS app for Intel Macs
`2Secret_*_x64-setup.exe`	Windows app (installs for your user and can update itself; removes an `.msi` version of 2Secret up to 1.7.0)
`.deb`, `.rpm`, `*.AppImage`	Linux app (x86_64)
`2Secret_*_android-arm64.apk`	Android app (Android 7 and newer) – allow installing from your browser when asked
`2Secret_*_android-arm64.aab`	Android app bundle for app stores
`2secret-*-<platform>.tar.gz` / `.zip`	`2secret` CLI and `2secret-server` for Linux, macOS (Apple silicon and Intel) and Windows
`2secret-web-*.tar.gz`	Web vault – serve it with `2secret-server --web-dir`
`2secret-extension-*.zip`	Browser extension for Chrome, Edge, Brave and Firefox (load unpacked)
`SHA256SUMS`, `SHA256SUMS.sig`	Checksums of all files, signed with 2Secret's update key (how to check)

Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS): docker pull ghcr.io/joostiphone/2secret:latest – see self-hosting.

On macOS, drag 2Secret to Applications and open it. If macOS says it cannot verify the app, open System Settings → Privacy & Security and click Open Anyway (on macOS 14 and older you can also right-click the app and choose Open). On Windows, SmartScreen may ask you to confirm (More info → Run anyway).

FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the README.

Downloads#

Downloads