Skip to content

Commit

Permalink
Prepare new release.
Browse files Browse the repository at this point in the history
  • Loading branch information
walterpg committed Feb 1, 2021
1 parent 6140ada commit ea444b0
Show file tree
Hide file tree
Showing 2 changed files with 19 additions and 47 deletions.
64 changes: 18 additions & 46 deletions ChangeLog.md
Original file line number Diff line number Diff line change
@@ -1,61 +1,33 @@
# 4.0.4-beta
## 4.0.5-beta

* Transparently support [Drive shortcuts](https://support.google.com/drive/answer/9700156?co=GENIE.Platform%3DDesktop&oco=1) (issue #20).
* Fix unexpected "upgrade" popup dialog after changing the sync
configuration entry.
* Disable default sync ops to
[shared files](https://support.google.com/drive/answer/2494822?co=GENIE.Platform%3DDesktop&hl=en)
due to a potential security problem (issue #21).
* Implement a [session-stored authorization token](https://www.kpsync.org/usage/authorize#session-stored-tokens)
option.
* Fix unexpected "upgrade" popup dialog after changing the sync configuration entry.
* Disable default sync ops to [shared files](https://support.google.com/drive/answer/2494822?co=GENIE.Platform%3DDesktop&hl=en) due to a potential security problem (issue #21).
* Implement a [session-stored authorization token](https://www.kpsync.org/usage/authorize#session-stored-tokens) option.
* Fixed privacy policy link on authorization upgrade form.
* Many minor UI tweaks for better KP integration.
* Update Google support packages.
* Fix config upgrade crash, #30 (thanks to @Rookiestyle).

##### Drive Shortcut Feature
The release includes a solution for syncing databases to Drive files
referred to by "internal" Drive shortcuts. Please see the
[kpsync.org documentation](https://www.kpsync.org/usage/shortcuts) for
details.
The release includes a solution for syncing databases to Drive files referred to by "internal" Drive shortcuts. Please see the [kpsync.org documentation](https://www.kpsync.org/usage/shortcuts) for details.

##### Addressing Shared Database Security
As of this release, the plugin, by default, will not synchronize with Drive files
that are shared with other Drive accounts via Drive's
[shared file feature](https://support.google.com/drive/answer/2494822?co=GENIE.Platform%3DDesktop&hl=en).
As discussed in issue #21, and detailed in a published
[security bulletin](https://www.kpsync.org/notices/sharedsec),
such usage enables a means to obtain unauthorized access
to the Drive account of the sharer (or a sharee). While there remain many
less convenient ways to share a KP database containing valid Drive
authorization tokens, the plugin is no longer complicit in such
usages.

Since the shared file issue is considered a long-standing *defect*, some
users may already be aware of it. Others may be unexpectedly impacted
by the security implications and/or the change in default behavior mentioned
above. The latter should follow the guidance contained in the
[security bulletin](https://www.kpsync.org/notices/sharedsec).

To address security hazards, the **optional**
[session-stored authorization token](https://www.kpsync.org/usage/authorize#session-stored-tokens)
feature was implemented. *Safe* access to databases shared by any
means, including Drive's shared file feature, can be enabled
with this option. The security issue is mitigated by displacing
authorization tokens from the database into secure
KeePass session storage. To synchronize with this feature, users are required
to authorize the plugin with Google Sign-in once per open database at
*each* restart of KeePass. It is thus an effective but inadequate solution.

A more general solution for shared file security will be a subject
of a future release.
As of this release, the plugin, by default, will not synchronize with Drive files that are shared with other Drive accounts via Drive's
[shared file feature](https://support.google.com/drive/answer/2494822?co=GENIE.Platform%3DDesktop&hl=en). As discussed in issue #21, and detailed in a published [security bulletin](https://www.kpsync.org/notices/sharedsec), such usage enables a means to obtain unauthorized access to the Drive account of the sharer (or a sharee). While there remain many less convenient ways to share a KP database containing valid Drive authorization tokens, the plugin is no longer complicit in such usages.

Since the shared file issue is considered a long-standing *defect*, some users may already be aware of it. Others may be unexpectedly impacted by the security implications and/or the change in default behavior mentioned above. The latter should follow the guidance contained in the [security bulletin](https://www.kpsync.org/notices/sharedsec).

To address security hazards, the **optional** [session-stored authorization token](https://www.kpsync.org/usage/authorize#session-stored-tokens) feature was implemented. *Safe* access to databases shared by any means, including Drive's shared file feature, can be enabled with this option. The security issue is mitigated by displacing authorization tokens from the database into secure KeePass session storage. To synchronize with this feature, users are required to authorize the plugin with Google Sign-in once per open database at *each* restart of KeePass. It is thus an effective but inadequate solution.

A more general solution for shared file security will be a subject of a future release.

##### Still in Beta
Maybe the last?

Do you use shared KeePass databases? If you have ideas for safely,
*conveniently* doing so with the plugin, please raise an issue or
submit a pull request.
Do you use shared KeePass databases? If you have ideas for safely, *conveniently* doing so with the plugin, please raise an issue or submit a pull request.

*As always,*
**Thank you for your feedback.**
*As always,* **Thank you for your feedback.**

---
## 4.0.3-beta
Expand Down
2 changes: 1 addition & 1 deletion src/Properties/AssemblyInfo.cs
Original file line number Diff line number Diff line change
Expand Up @@ -35,4 +35,4 @@ You should have received a copy of the GNU General Public License

[assembly: AssemblyVersion("4.0.5.0")]
[assembly: AssemblyFileVersion("4.0.5.0")]
[assembly: AssemblyInformationalVersion("4.0.5-unstable")]
[assembly: AssemblyInformationalVersion("4.0.5-beta")]

0 comments on commit ea444b0

Please sign in to comment.