v2.14.77

Highlights

• PIN unlock is rebuilt on device hardware. The vault key is sealed by the Android Keystore instead of by the PIN, and every attempt spends a hardware-limited gate, so a copied copy of app storage can no longer be used to guess your PIN offline.
• Autofill no longer generates or copies a two-factor code before you choose an entry.
• Site icons now ask before they are switched on, and say what enabling them shares.

Fixes

• Autofill no longer trusts a claimed website unless the app making the request is a verified browser.
• The encrypted sync spool is excluded from cloud backup and device-to-device transfer.
• Biometric escrow keys must now report a hardware-backed security level.
• Bouncy Castle is upgraded to 1.84.
• Debug builds no longer log two-factor codes or entry titles.
• Sync handshakes reject small-order Diffie-Hellman keys.
• Unfolding or rotating the device no longer signs you out of the vault.
• Onboarding offers create-a-vault as an explicit choice on the final card, and labels the pair-with-another-device option with a Pro badge.

Notes for PIN users

• You may be asked to set your PIN up again after this update. Your old PIN material is removed on upgrade because it was not protected by hardware.
• Your master password is unaffected and always works.
• If your device's hardware cannot enforce limited PIN attempts, PIN unlock is switched off on that device and you continue with your master password.