561cb122ea
Theseus's own quick-unlock PIN had the same limit as Aegis's: once the DPAPI seal is opened (as the user, or from a disk image plus the Windows password) the 6-digit PIN falls to an offline search. The PIN is now also the authorization value of a Platform Crypto Provider TPM key whose secret is mixed into the wrapping key, so the chip's lockout bounds guessing; lib/tpm-pin.cjs is the same module Aegis uses. set() now refuses when there is no real OS keystore (Linux basic_text included) instead of writing the blob in the clear, an unsealed record from an older build is deleted, and Settings says what the PIN actually protects against on this machine. |
||
|---|---|---|
| .. | ||
| addon-store.cjs | ||
| hermes.js | ||
| package.json | ||
| publisher-sig.mjs | ||
| tpm-pin.cjs | ||
| update-helper.cjs | ||
| vault-pin.cjs | ||