Bramble now supports passkey PRF secrets, including when importing Proton Pass passkeys and during credential exchange. Fastmail Masked Email is available as an alias provider.
- Proton Pass imports now also bring files and every website across, and 1Password imports now bring files across.
- Logins with multiple websites now group those websites under one label when viewing the login.
- Import previews now count attachments in their summary, and KeePass file attachments on logins stay pinned to their port.
- Saves no longer hang on a breach check, and Bramble now tells you when a save is stuck and what it is waiting on.
- Security fixes stop a crafted pairing file from pairing, bind passkey requests to the page that made them, verify the user before the extension claims a passkey, and reject sync joiners with another device's roster ID.
All changes (26)
Features
- group a login's websites under one label in its view mode
- count attachments in the preview's summary line
- bring Proton Pass files and every website across (#166)
- bring a 1Password export's files across
- carry passkey PRF secrets and other FIDO2 extension data through credential exchange
- keep Proton Pass passkeys' PRF secrets
- carry PRF secrets through the TS crypto surface and the stored passkey
- mint PRF secrets and evaluate the WebAuthn prf extension in the core
- Fastmail Masked Email (#133)
- bring Proton Pass passkeys across (#166)
Bug Fixes
- stop a breach check that never answers from holding a save
- say when a save is stuck, and what it is waiting on
- ship the proxy once on Linux so the .rpm bundles again
- take Tauri 2.12 so the updater unpacks with zip 9
- seal the browser-link allowlist so writing pairing.json cannot pair
- refuse a joiner whose roster id belongs to another device
- bound relay-forward reassembly before allocating for a frame
- carry an HLC counter past its limit into the wall instead of throwing
- keep a KeePass file on a login pinned to its port
- validate stored PRF secrets and cap credential-exchange and zip imports
- verify the user for real before claiming it in the extension
- bind each request to the page that made it, not the focused tab
- use a passkey's rpId when a transfer has no website
- read a website saved without a scheme as https
Refactors
- fold the duplicated ceremony and request plumbing
Other
- chore(nix): refresh the pnpm hash for the new lockfile
Full Changelog: 0.14.0-desktop...0.15.0-desktop