[pfandrade]

Secrets 2 is out and it's going Freemium!

For the past 6 months since our initial release, we've been squashing bugs, implementing features that didn’t make our MVP and applying polish throughout. At the same time, we’ve been studying various options to provide a trial for users wanting to test Secrets before buying.

To address this need and to show users new to password managers just how easy and efficient using one can be, we're making Secrets and all its features free to use with up to 10 items. Unlocking unlimited items is done via an In-App purchase.

With Secrets we put security first. Secrets stores your data using the OpenPGP standard, a battle proven standard that has already seen a few revisions. This also allows users to easily self verify how their data is stored using third party tools.

We also strived to make it extremely simple to work with, not just from an UX perspective but also from a security perspective. Only the main app will ever handle your passphrase and encryption/decryption. Helper apps, browser extensions, etc must go trough it to get to your data (and require user confirmation).

So if you haven't tried Secrets yet now is the time! Download Secrets for Mac and iOS today.

[nixgeek]

What's the communication path between untrusted <-> trusted components look like and are you doing anything special which might prevent the vulnerabilities which Project Zero recently reported in 1Password[1], LastPass[2], Dashlane[3] et al?

[1] https://bugs.chromium.org/p/project-zero/issues/detail?id=88... [2] https://bugs.chromium.org/p/project-zero/issues/detail?id=88... [3] https://bugs.chromium.org/p/project-zero/issues/detail?id=89...

[pfandrade]

No untrusted component will have access to your data without user confirmation. This means you'll always have to click a button on the main app to fill a login for example.

There are two ways in which logins are filled in the browser:

- One is based on OS X Automation and AppleScript (this will work with Chrome and Safari without our Safari App Extension enabled). Succinctly, with this solution, Secrets will execute a small JS script on your frontmost browser windows to see if there are any logins to be filled. If so, it will present you a "Fill" button. Pressing that button will execute another JS script that will fill that form. In this scenario your data is send via Apple Events.

- When you have the Safari App Extension enabled, the process is similar. But instead of Secrets actively looking for logins forms on frontmost browser windows, the extension will let it know what is available. Again you will still need to press a "Fill" button on Secrets. Once you do your data is placed on a private clipboard that the extension uses to then fill the login.

There are no local servers, and the extension doesn't have access to your data. By design, none of the linked vulnerabilities would apply.

If you're wondering why the two methods, the Safari App Extension came later and the reasons are detailed here: https://outercorner.com/2016/10/19/version_1.4.0.html