Kasmaristo-Delvakto/memoro-vault v1.1.0

Memoro Vault v1.1.0: Vault Editor and In-App Viewer

on GitHub

Open a vault, change what is inside and save it again without rebuilding it from scratch. This release also adds a viewer for images, PDFs, text, audio and video, and a round of entropy and security hardening that finished with a full pre-release audit.

Vault editor

• After recovery, choose Open Vault Editor to add, rename and remove files, add or edit seed phrases (hidden until you press Show) and rewrite the final message. Files can be dropped straight onto the editor.
• Saving lists your changes, seals a new vault with the same questions and answers, re-opens it and verifies every file, then asks where to save it. Edits count as saved only once the file is written.
• Every save uses fresh salts, IVs, file IDs and a new hidden answer order, so no salt, key or ciphertext is reused between versions.
• A new QR paper backup can be made as part of the save.
• Older copies still open with the same answers and keep their old contents, so replace every stored copy after saving.

Viewer

• Images, PDFs, text, audio and video open inside the app, straight from memory, with zoom for images and PDFs.

Security and entropy

• All vault randomness now comes from crypto.getRandomValues with unbiased sampling (replacing Math.random for question selection, hidden order and multiple-choice order).
• Every recovered file is verified against its SHA-256; new vaults are fully re-opened and checked before they are handed over.
• The recovery screen no longer shows answers or a hash of them.
• App storage is kept in memory only, so nothing sensitive is written to the browser profile on disk. Leftover storage from older versions is overwritten and deleted on first launch.
• Electron upgraded from 25.3.1 to 44.9.2, with hardened fuses on release builds.
• Pre-release audit: hostile vaults and paper backups can no longer inject markup, Argon2 settings and archive sizes are bounded, file names are cleaned, no page allows inline script, the app cannot resolve host names or open arbitrary links, saves confirm overwrites and write atomically, DevTools are off in release builds, and no unused npm packages ship with the app.

Fixes

• A red herring could be set on a chosen unlock question; this is now blocked.
• The entropy meter no longer counts the red herring's decoy answer.
• The final message now appears on the recovery screen.

Compatibility

• Same vault format as 1.0.8, in both directions.
• Vaults up to 1.9 GB (single files up to 1.5 GB), tested end to end with a 1 GB vault from 1.0.8. Large vaults need plenty of RAM while open: editing a 1 GB vault used close to 10 GB.
• macOS builds require macOS 13 or later.

Downloads

The Windows installer and PGP signatures will be added to this release.

Verify a download with sha256sum -c SHA256SUMS.txt --ignore-missing:

21f883036c529455633a9f4552d1bf0b1ec3042ecd9c1be1a4674dda3b86fe2e  Memoro.Vault-1.1.0-linux-amd64.deb
c6f7a40ba057acb8c08206d661c63dd0787f00b6b06396a120694363a5a78ad0  Memoro.Vault-1.1.0-linux-x86_64.AppImage
4186ac3e7200c8e6c47c862ff391fa8f111e8fd79c633883fa11dfaddf6f11a5  Memoro.Vault-1.1.0-linux-x86_64.rpm