Sync code import between browsers was failing with "Wrong key or
corrupted data" because each browser derives a different AES key
from the same password (different salt). The decrypt function was
using the local device's salt instead of the source device's salt
embedded in the sync envelope.
Fixed _decryptFromSync to always use the sync envelope's salt for
decryption. If the cached key's salt doesn't match, forces re-auth
so the password is re-entered and a new key is derived with the
correct salt.
Also fixed WebAuthn "device can't be used" error on extension pages.
chrome-extension:// and moz-extension:// origins are not valid for
WebAuthn. isWebAuthnAvailable() now returns false on extension pages.
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
- CryptoKey now persists in IndexedDB forever — never auto-deleted
- TTL controls when re-verification is needed, not key lifetime
- WebAuthn is the primary re-auth method (not a post-expiry fallback)
- Password only needed once per device (first-time setup)
- Added needsReverification() and markVerified() to crypto.js
- Auth prompt adapts message: first-device vs re-verify vs decrypt
- Biometric button hidden on first-device setup (no credential yet)
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Sync encryption:
- AES-256-GCM encryption for all sync channels (browser sync, gist,
custom URL, folder sync, sync codes)
- Password with optional TOTP (RFC 6238) second factor
- Configurable auth TTL: session, 30/90/180/365 days, or never
- CryptoKey cached in IndexedDB — auth only needed when cache expires
AND new data exists (lastModified check runs before auth prompt)
- WebAuthn (biometric/PIN) as low-friction re-authentication gate
- Full options UI for setup, password change, and inline auth prompt
Smart reveal:
- Track which substitute values were actually sent outbound per session
- Reveal mode only replaces values that were genuinely substituted,
preventing false positives (e.g. AI using the word "user" won't be
replaced with a real username that maps to "user")
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
License: Changed from MIT to BSL 1.1. Free for personal use,
commercial use requires a paid license. Auto-converts to MIT
on March 26, 2030.
Export/Import: Options page now has "Transfer Data" section:
- Export All (plain) — JSON file with all identities, mappings, settings
- Export Encrypted — AES-256-GCM with PBKDF2 password derivation,
saved as .ssbackup file
- Import — handles both plain and encrypted backups, prompts for
password if encrypted
Crypto uses Web Crypto API (browser-native, no dependencies):
100k PBKDF2 iterations, random salt + IV per export.
https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw
Claude