4583db39a2
feat(security): switch master key to non-extractable CryptoKey handle and remove direct access
lockbitchat
2025-10-30 15:16:36 -04:00
77ed4b3e4f
remove key/hash logging and debug output from EnhancedSecureWebRTCManager and EnhancedSecureCryptoUtils
lockbitchat
2025-10-30 14:55:46 -04:00
c7b16157fc
Enhanced HKDF-based key derivation with improved security features - Implemented proper RFC 5869 compliant HKDF key derivation process - Added Perfect Forward Secrecy (PFS) key for enhanced session security - Improved key separation using unique info parameters for each derived key - Enhanced salt size from 32 to 64 bytes for increased entropy - Added comprehensive key validation and error handling - Implemented proper ECDH + HKDF integration following Web Crypto API best practices - Added metadata encryption key for enhanced data protection - Improved compatibility with modern cryptographic standards (RFC 7748, NIST SP 800-56A) -Enhanced logging and debugging capabilities for cryptographic operations - Maintained backward compatibility while upgrading security infrastructure Security improvements: - Cryptographic isolation between different key purposes - Enhanced protection against cross-key attacks - Improved resistance to future key compromise scenarios - Better compliance with OWASP cryptographic storage guidelines Technical details: - Refactored deriveSharedKeys() method for proper HKDF implementation - Updated WebRTC manager to use new messageKey API - Added comprehensive error handling and validation - Improved browser compatibility with standardized cryptographic operations - This update strengthens the existing security foundation with modern cryptographic practices while maintaining full system compatibility.
lockbitchat
2025-10-27 15:18:15 -04:00
906562333e
fix(ios): prevent chat crash when Notifications API is unavailable on iPhones - Guarded all Notification API usage to avoid ReferenceError on iOS Safari. - Set default permission to 'denied' when Notification is undefined. - Added early return in notification flow when Notifications API is unavailable. - Wrapped Notification.permission, requestPermission(), and new Notification(...) with typeof checks. - Updated SecureNotificationManager and app.jsx to degrade gracefully. - Verified build passes and chat loads correctly on iOS without notifications.
lockbitchat
2025-10-19 20:51:44 -04:00
5b5cc67fdc
Push to Codeberg
lockbitchat
2025-10-15 04:55:22 -04:00
93e4b7ad19
test
lockbitchat
2025-10-15 04:51:48 -04:00
fce18d27a5
Push to PrivacyGuides
lockbitchat
2025-10-15 04:41:05 -04:00
03e06f59dc
Push to Codeberg
lockbitchat
2025-10-15 04:30:18 -04:00
5df6cb0d16
test ssh
lockbitchat
2025-10-15 04:25:49 -04:00
3730f46a08
test remote
lockbitchat
2025-10-15 04:23:51 -04:00
abd6f9a7f5
Test mirror
lockbitchat
2025-10-15 04:21:20 -04:00
99469e5bd5
Remove experimental Bluetooth key transfer module - Deleted BluetoothKeyTransfer.js and related classes - Removed BluetoothKeyTransfer.jsx UI component - Cleaned up Bluetooth imports from app-boot.js and bootstrap-modules.js - Removed Bluetooth buttons and handlers from main app - Eliminated all Bluetooth functionality due to Web Bluetooth API limitations - Browsers cannot create GATT servers or advertise devices - Reduced bundle size by ~78KB - Application now focuses on supported browser technologies (QR codes, manual key exchange, WebRTC)
lockbitchat
2025-10-15 04:13:14 -04:00
2306b32482
Remove experimental Bluetooth key transfer module
lockbitchat
2025-10-15 01:47:28 -04:00
cbb6a8fa31
Remove experimental Bluetooth key transfer module
lockbitchat
2025-10-15 01:46:54 -04:00
4be6fc55f5
Remove experimental Bluetooth key transfer module
lockbitchat
2025-10-15 01:46:36 -04:00
14b6ae2337
Add to CSP
lockbitchat
2025-09-08 16:10:26 -04:00
0f8399ec88
feat(security,ui): self-host React deps, Tailwind, fonts; strict CSP; local QR; better selection state Replace CDN React/ReactDOM/Babel with local libs; remove Babel and inline scripts Build Tailwind locally, add safelist; switch to assets/tailwind.css Self-host Font Awesome and Inter (CSS + woff2); remove external font CDNs Implement strict CSP (no unsafe-inline/eval; scripts/styles/fonts from self) Extract inline handlers; move PWA scripts to external files Add local QR code generation (qrcode lib) and remove api.qrserver.com Improve SessionTypeSelector visual selection (highlighted background and ring) Keep PWA working with service worker and offline assets Refs: CSP hardening, offline-first, no external dependencies
lockbitchat
2025-09-08 16:04:58 -04:00
lockbitchat