PGP Tools

Recent Commits

• James Arnott(28 Oct 26)

  Merge pull request #11 from Am-I-Being-Pwned/chore/badges chore: update README badges

• James Arnott(28 Oct 26)

  chore: update README badges

• James Arnott(28 Oct 26)

  Merge pull request #10 from Am-I-Being-Pwned/feat/escape-to-encrypt Escape spam goes back to Encrypt

• James Arnott(28 Oct 26)

  feat(workspace): a third Escape after a clear goes back to Encrypt Escape spam now resets everything: the double-tap clears the box as before, and one more press within 700 ms switches the mode back to Encrypt (focus stays in the message box). A lone Escape on an empty workspace still only refocuses, so the mode never changes by surprise.

• James Arnott(28 Oct 26)

  Merge pull request #9 from Am-I-Being-Pwned/fix/ci-wasm-pack ci: don't fail when wasm-pack is already installed

• James Arnott(27 Oct 26)

  ci: don't fail when wasm-pack is already installed cargo install refuses to overwrite a wasm-pack the runner image or the restored cargo cache already has. Keep it when it is the pinned 0.13.1, otherwise reinstall the pinned version with --force.

• James Arnott(27 Oct 26)

  Merge pull request #8 from Am-I-Being-Pwned/fix/identity-binding Identity binding, message trust and storage integrity hardening

• James Arnott(27 Oct 26)

  docs: security notes for this round, and README badges SECURITY.md: storage not securely erased (8.13), history padding, canary label, storage-writer defences and their limits (17), who a key belongs to (18), context-menu click-time check; matching threat-model entries. README badges re-measured.

• James Arnott(27 Oct 26)

  ci: least-privilege token, pinned actions, and a stricter contacts audit - CI runs with contents: read, every action pinned to a commit SHA, checkout without persisted credentials, and wasm-pack built with cargo install --locked instead of curl | sh. - The contacts-only-after-review audit covers every exported contact writer (updateContact, removeContact...) and any use, alias, namespace or dynamic import of reviewed(), plus casts into contact adds.

• James Arnott(27 Oct 26)

  fix(messages): hidden characters, output caps, reader parity and routing - One hidden-character detector for Sign, Verify and Decrypt; signing text with bidi, zero-width, tag or variation-selector characters asks first ("Sign anyway" / "Remove them"); only real subdivision flags may carry tag characters. - Unattended (context-menu) decrypt/verify is capped at 1 MiB inside the engine, including Sequoia's read-ahead; user-started runs and the signer-lookup re-run stay uncapped. A correct password on a file too large to open is no longer called wrong. - Encrypted messages wrapped in a compressed packet open again; the unencrypted path frames non-ASCII prose strictly; Copy and Download keep a leading BOM (PGP and age). - The reader tab shows the panel's signer card (clash, verified, forwarded and lookalike notes) without public keys, and only our own reader page may connect. - A signed message quoting a key opens in Verify, not Import; the key banner refreshes on every output and names every key; same-named outputs get distinct names. - The context menu works in webmail's about:blank / srcdoc frames: checked on click, never acting on the extension's own pages.

• James Arnott(27 Oct 26)

  fix(identity): check every key against who it claims to be, quickly - Private and CRX keys in a paste or backup are checked against contacts too; conflicting ones start on Skip and are listed on the Review (backups now list their private and CRX keys). - Same-name policy: identical names with different addresses are not flagged; a name that only matches through lookalike letters is ("Lookalike name"), and so is the same name where a key has no address. Kelvin/Ohm-style singletons count as lookalikes. - Confusables: ~240 more mappings, and any letter or digit from a script other than the word's is treated as a lookalike; ideographic dots and quoted local parts in addresses. - The clash check is indexed (1000 contacts: ~24 s -> ~40 ms) and memoised; aliases are compared; SSH rows show a short key id. - Keyserver key-id lookups accept only the primary key or a back-signed signing subkey, and signer lookups by subkey fingerprint work. - "Check revocation" never adds User IDs without the Review. - Replace only acts when exactly one contact holds the address; two copies of one key are merged before the Review; a pasted SSH key keeps its comment; backup CRX parsing is a linear scan. - A GitHub refresh that leaves only turned-off keys is flagged and the card updates at once; panels close themselves by id, so Back no longer closes the page opened next.

• James Arnott(27 Oct 26)

  fix(storage): keep history, settings and the vault intact through upgrades, switches and tampering - History padding no longer loses ~45% of a 2.x user's history on upgrade: segments seal before their padded size passes 64 KB, and the budget never shrinks because a re-pad grew recorded sizes. History segments and their manifest sizes are padded (no length leak). - The strictest-preset overlay (lost ledger, rolled-back or missing settings) applies only to what the panel uses, never to what is saved, so one routine save can't make it permanent; a rolled-back settings blob is held on that overlay until acknowledged. - A 2.0.x device sharing a sync vault gets a softer, separately worded warning instead of a tamper alarm; the revocation floor still holds. - Storage switches record the device location only on success, copy the master protection first and delete it last, and other windows drop their cached location when it changes. - The ledger is created with the master protection (no false "lost" after a crash), resets quietly for a vault recreated elsewhere, and a deleted ledger is reported again -- the legacy-settings migration runs before any save instead of racing onboarding. - Passkey unlock saves the re-seal before the key shows unlocked. - Vault-problem and settings-save errors are shown, not swallowed.

• James Arnott(27 Oct 26)

  chore: update README badges

• James Arnott(27 Oct 26)

  docs(security): storage writers, forwarded signatures and who a key belongs to SECURITY.md 8.12 (signed messages re-encrypted to you), 17 (storage you can write but not read) and 18 (who a key belongs to), with the matching threat-model entries: T-LEGACY-PLAINTEXT-ADOPTION, T-BOOTSTRAP-FORGERY, T-STORE-ROLLBACK and T-SIG-FORWARDED.

• James Arnott(27 Oct 26)

  feat(workspace): keep Tab on the form, and put focus in the box after a clear - Tab no longer stops on the Main/Keys/Settings tabs, the mode switch or the recipients' clear-all button: the tabs are a click, the palette or the arrow keys away, the modes have mod+digit, and Backspace removes chips. Segmented gains skipTab. - A clear (double Escape, the reset button, Clear text) puts focus in the message box: the next thing to do is type.

• James Arnott(27 Oct 26)

  fix(identity): close the SSH, invisible-character and lookalike-address gaps - Pasted SSH lines sharing a comment merged silently into an existing contact, or over the user's own key, adding the attacker as a recipient and hiding the real row in the picker. Every line is now checked against every held key: a set that changes one contact is a reviewed update ("N keys added/removed", on Skip), any other set that touches a held key is flagged, and an own key always wins its id. - SSH comments get the same identity checks, pills and cleaning as User IDs; so do GitHub lookups, and a refresh that drops a key is an update, never "duplicate". - Names and addresses are compared after stripping invisible characters (engine and TS tables pinned equal) and on a confusable skeleton, so an address with a trailing variation selector, or a dotless i, clashes with the real one. - Keys the user turned off stay off: a contact with none left is refused for encryption instead of falling back to all of them. - Key details name the other key behind a Same address / Same name pill and link to it.

• James Arnott(27 Oct 26)

  fix(decrypt): say when a message was never encrypted, and when line breaks lie - A signed-only (or bare literal) PGP MESSAGE "decrypted" to the same green private-message card as a real one: anything Alice ever signed in public could be re-sent as a private note from her. The engine now refuses to decrypt a message with no encryption layer, and the panel opens it without a key as amber "Not encrypted", with no Reply. - A decrypted message whose signature names no intended recipients gets a note that it may have been forwarded (surreptitious forwarding); one naming only others was already amber. - Sequoia reads a lone CR as a line break in text signatures, so a signature over "Approved:<LF>NO" verified over "Approved:<CR>NO", which Chrome draws as "Approved:NO". A lone CR under a good signature is now amber and drawn as a visible mark (copy and download keep the bytes), and decrypt gets the hidden-character note Verify had. - User IDs lose every default-ignorable and format character, from one documented table.

• James Arnott(27 Oct 26)

  fix(storage): never trust what a storage writer planted, rolled back or deleted Anyone who can write chrome.storage without the vault password -- for a sync user, whoever holds their Google account -- could: - plant plaintext "legacy" records that the migration sealed as genuine (a Verified contact holding their key, an own key, a CRX key). The plaintext migration is gone: only 0.x builds wrote that format. - plant legacy settings (auto-lock off, their default key). The settings migration runs once, from local only, behind a sealed marker, and every field is type- and range-checked. - forge onboardingComplete / storageLocation so re-onboarding overwrote the real vault. "Set up" is decided by what is stored, each device keeps its own vault location, a master protection is never overwritten, and an ambiguous or misplaced vault gets its own screen. - roll sealed stores back (un-revoking a contact) or delete settings. Every sealed store carries a generation; a sealed local ledger keeps this device's high-water marks and an append-only revoked set; a rollback, missing or unreadable settings or a lost ledger warns, and settings read as the strictest preset meanwhile. Master-protection and ledger writes take a cross-window Web Lock. Also: a contact whose keys the user all turned off is refused for encryption instead of falling back to every key, and an own key wins an id it shares with a contact.

• James Arnott(27 Oct 26)

  docs(security): say where RSA's Marvin timing channel applies RustCrypto's rsa crate -- behind OpenPGP RSA keys, ssh-rsa age identities and CRX signing -- has an accepted, unfixed timing side channel (RUSTSEC-2023-0071). Recorded as T-RSA-MARVIN and in SECURITY.md §8.3, and the key generator's RSA hint now says so and recommends ECC.

• James Arnott(27 Oct 26)

  fix(verify): mark a signer who wears the user's own identity The signer card's Same name / Same address pill compared the signer with the other contacts only. A contact signing as the user -- the classic impersonation -- now gets it too, as on the contact card and in the recipient picker.

• James Arnott(27 Oct 26)

  test(e2e): cover the import Review and identity checks The bundle-impostor advisory end to end (file drop and context menu), single-key and name conflicts, symmetric bundle clashes, Replace, Mark as verified, picker key ids, backup Import all and the signer note. Bulk-import helper confirms the Review. Fixtures are generated public keys only. Badges re-measured.

• James Arnott(27 Oct 26)

  fix(import): review every key before it is bound to a person A bundle holding a stripped copy of a contact plus a new key with the same name and address imported the new key silently (bulk paste, drop, Open in PGP Tools, backup restore), and it then sat in the encrypt picker as that person. - Every import now lists its keys on a Review before anything is saved: name, address, 16-hex key id, status. A key claiming an identity someone else holds (a contact's or your own address, or a name that reads the same) says so and starts on Skip; Keep both / Replace are the user's call, and bundles and backups get a labelled Import all. - Claims are read wherever an address sits in a User ID, names through a UTS #39-style skeleton (look-alike letters, capital I, fillers, punctuation); new keys in one bundle are checked against each other both ways, an update only on the User IDs it adds, and a revoked contact's address still asks. - Contacts can only be saved as a ReviewedContact, minted by applyReview; audit-invariants enforces where that happens. - Mark as verified on a contact's details (compare the fingerprint), shown as a pill; it never carries to a different key or key set. Same address / Same name pills on contact cards, the recipient picker (which now always shows the key id) and the signer card; a good signature from an unverified contact says so, quietly.

• James Arnott(27 Oct 26)

  Merge pull request #7 from Am-I-Being-Pwned/fix/signature-trust Verify view and focus after clearing

• James Arnott(27 Oct 26)

  chore: update README badges Re-measured: 187 e2e tests.

• James Arnott(27 Oct 26)

  feat(workspace): after a clear, focus the top of the form Double-tap Escape, Clear text and the reset button now put focus back on Recipients in Encrypt, or the first control of the message card in other modes, so Tab carries on from the top instead of from the control that cleared it.

• James Arnott(27 Oct 26)

  feat(verify): show a verified message like a decrypted one Once a signature checks out, the panel shows the signer's card and then only the text the signature covers, full height with Download, Copy and Back -- the same view a decrypted message gets. The pasted armor and the input box are gone rather than sitting under the verdict, which replaces the separate "Signed text" box. Reply stays decrypt-only.

• James Arnott(27 Oct 26)

  Merge pull request #6 from Am-I-Being-Pwned/fix/signature-trust Signature trust and security hardening (2.0.1)

• James Arnott(27 Oct 26)

  chore: update README badges Re-measured: 1775 unit tests, 184 e2e tests, 82.4% lib coverage.

• James Arnott(27 Oct 26)

  fix(lint): allow control characters in the file-name regexes no-control-regex failed CI on the two regexes whose job is to find control characters (to strip them from file names and flag them in signed text). Disabled for exactly those two declarations.

• James Arnott(27 Oct 26)

  chore: bump version to 2.0.1