We’ve had an excellent and productive year working on Codebook in 2018. As we charge hard into 2019 working on our next major version update, Codebook 4, we’d like to take a look back at some of the improvements we’ve made to our favorite password manager over the last year.

Before we do, though, it should be noted: Codebook has been in the iTunes App Store for over 10 years, since 2008! Originally a reboot of the venerable Palm password manager that had some pull among an earlier generation of sysadmins, it eventually spread from iOS to Android, macOS, and Windows. A lot’s happened since then! I won’t get into it all, but if you’ve been with us all this time, a big hearty cheers from all of us at Zetetic! 🍻 Here’s what we’ve gotten up to in Codebook’s tenth year.

We released an absolute ton of regular updates over the last year for maintenance, operating system and device upgrades, and bug fixes across all platforms, too many to mention here. However, each version of the app now contains a Release Notes feature, providing up to date information about what’s new.

Fingerprint and Facial Recognition Improvements

Codebook for iOS has supported Touch ID authentication for some time now (allowing you to login with your fingerprint instead of your master password), but this year we added support for Face ID authentication on new iPhones and Touch ID authentication on newer MacBook Pro laptops. Also, by popular demand, we’ve added support for Fingerprint authentication on Android.

There is, however, one drawback to this convenience. A new user has only ever entered their master password twice (to set and then confirm it) before they are prompted to enable Touch ID or Face ID login during application setup. They are never required to enter it again until an unforeseen event causes it to be required (for instance, Touch ID can become unavailable for security reasons, like a new finger being added, or when restoring from an iCloud backup on a new device). By that time they may have forgotten it!

We’ve begun taking some steps to help mitigate this problem on iOS, including some more helpful warnings about it on setup, and a reminder that encourages the user to look up the master password and be sure they remember it or have it backed up somewhere safe. We’ve got more planned to help with recovery coming in Codebook 4.

Free Trials on iOS

This is a really big deal. Previously we charged up-front to download Codebook for iOS, meaning you couldn’t try it before you bought it. Well, you could, via the Lite version, but this was less than ideal in that it meant we had to necessarily limit some core features.

With the new ability to offer free trials and a pro upgrade in the App Store via In-App Purchases, and the ability to grandfather in customers who paid up front to download Codebook, we are able to offer a much better experience to anybody who just wants to download the iOS app and try it out before they invest. AND, we were able to offer a smooth upgrade process without confusing or alarming our existing customers about the change in licensing. We appreciate all the help our beta testers gave us with this, and the patience our customers showed when there were hiccups.

This also let us retire the Lite version in the App Store, along with the iPad-only version that had been discontinued. Having just one app in the App Store for all iOS users is less confusing, and less work for us.

Improved Trials on macOS

Codebook for macOS got a solid update to trial behavior as well, in the direct version (the Mac App Store version has no trial mode). We distribute the direct download version as a 14-day free trial, like we do on Windows, but we made some really nice changes:

• Brand new and improved UI for the trial window
• The trial now tracks the number of days that the app was actually used, making the trial a bit more forgiving for someone who hasn’t really had a chance to try the app out
• When the trial expires the app is still functional, in read-only mode. Editing and sync features are disabled, but all other features and the user’s data are still available, passwords can still be filled in with Secret Agent, etc.

These are only some of the changes we’ve been making in order to improve the initial user experience with Codebook. This work benefits our existing customers, too (for instance, you can restore your data onto a new device during setup!)

Improved Downloads for macOS and Windows

People have reported frustration hunting around the website and discussion forum looking for direct download links to the macOS and Windows installers. It’s well-placed criticism, we didn’t want to make such links very public, lest someone download the apps without agreeing to our export compliance requirements! Some folks were signing up in the free trial forms to get access to the link and receiving follow-up emails about a trial they didn’t need. We’ve recently updated the macOS and Windows download pages to make it easier to download the app directly without having to sign up for a trial.

AutoFill Passwords on iOS

This is actually two interesting feature milestones! First we created an application extension called Find in Codebook that allows you to fill in passwords in Safari from the Share Sheet using the passwords you have stored in Codebook (with proper authentication, of course). This works well, including support for filling in TOTP fields, but would have benefited from better system-level integration with iOS.

And then iOS 12 introduced an API for password managers like Codebook to AutoFill Passwords, identifying login forms on websites and third-party apps. So, we did that, too! We were easily able to adapt and improve the UI of Find in Codebook to support AutoFill Passwords. This means that our iOS users can opt to fill in their passwords from Codebook right from login forms on web pages and third party apps. Fantastic!

Password Review / HaveIBeenPwned.com on iOS and macOS

One of the most interesting projects in password research and security is Troy Hunt’s HaveIBeenPwned.com service, and it really is that, a public service. It lets users check their accounts for inclusion in password and account breaches, and at this time contains the details of nearly 7 billion accounts (as I understand it, another large data breach is being added as I edit this!)

The website also offers an API that allows apps and other websites and online services several tools for looking up information about breaches and whether a particular password is included in a breach. In Codebook for iOS and macOS we added a feature called Password Review that uses the HaveIBeenPwned.com API to check if one of your passwords stored in Codebook has been seen in any breaches, and how many. If you have a password you think is super strong, and unique, you might still want to check anyway! Codebook does this without ever sending your actual password to the service due to a rather clever security model used by the API, but the feature is disabled by default and has to be enabled by the user.

Search Scopes on macOS and Windows

When you start typing in the Search field at the top right hand side of Codebook’s main window, the Entries view in the middle of the window is automatically populated with matching entries. Normally, the scope of this search is any entries that have a name matching the search term, and any entries that have a field that matches the search term.

There were circumstances were some customers wanted to be able to change that, and others who would have found it useful for entries that match a particular label name. And so, we implemented search scopes! It’s pretty handy when you want to customize your labels but are unsure exactly what entries are using what labels.

Added support for Dynamic Text and Large Type on iOS

Codebook for iOS got a big improvement in terms of accessibility when we adopted Dynamic Text and Large Type, adapting the UI to the user’s custom Accessibility settings in iOS.

Added new Magnify feature on iOS, macOS, and Windows

Sometimes we have data stored in Codebook like a phone number or a PIN that we want to display very large and prominently across the screen of the device, perhaps in order to enter it on another device or to view it across a short distance. The Magnify feature does just that, displaying the selected field in a modal, heads-up display, with a large, mono-spaced font. This feature is available in all four apps.

Wrapping Up

That’s the major hits, but as noted before, each app has its own Release Notes feature containing many more updates, adjustments, and improvements that may interest you. In addition, we also post to the discussion forum detailing updates to the individual apps as they are released.

It’s been a busy time, but there’s lots more in the works for Codebook 4, including the new sync system we have been working on and are near completing. We’re looking for new beta testers that would be willing to help review and test Codebook 4 and the new replication system, as well some other excellent new features like the recovery/rescue feature we’re working on. If that sounds like you, please sign up here! We have some serious alpha, dog-fooding testing to do first, but we’re hoping to start beta testing by May, and possibly as early as April.

The latest point release update of Codebook for macOS, version 3.7.4, is mostly a well-rounded bugfix release. However, it includes some new resources for our customers who use the popular Little Snitch network monitoring and defense app.

Little Snitch monitors a Mac’s network connections, and when run in Alert mode it will prompt the user about a new network connection with a handy dialog for approving or denying it, and for creating custom and dynamic firewall rules for the future.

Normally, there’s not much Little Snitch can tell you about a particular process’s intent when attempting to access the network. There’s a lot it can tell you, but little information from the app or process itself. However, if an app is properly code-signed, and includes an Internet Access Policy file, the app can describe the various types of network requests it makes and why. That information is then made available in Little Snitch’s connection alert dialogs. An application can even include links, for instance to helpful documentation!

Here’s an alert from Little Snitch in response to Codebook’s Password Review feature:

If we click on the bifocals icon to reveal the Research Assistant, we see detailed information about what’s going on, from Codebook:

If the user clicks on the Deny button, they are presented with a quick heads-up on what will happen:

Here’s what happens when Little Snitch intercepts Codebook’s stats feature:

All in all, a simple and handy integration from Objective Development that should be quite useful to those of our customers who also use Little Snitch.

Having arrived at the end of a process begun a little while ago now, we’ve removed Codebook Lite and Codebook for iPad from the iTunes App Store. Now there’s only one version of Codebook for iOS available, a universal app for iPhone and iPad that offers a 14-day free trial.

These companion apps served us well over the years. It was more than a decade ago—2008—that we first released our password manager Codebook (then called STRIP) for iOS (then called iPhoneOS) in the App Store. At the time it was stand-alone, only supported iPhone, and required an upfront purchase to download and run (and would stay that way for a long time).

We wanted a way to allow people to try it for free, but In-App Purchases weren’t a thing yet and trials weren’t allowed in the App Store so we did what seemed the next best thing: we created the Lite version as a separate, free-to-download app limited to ten records and no Sync feature.

The Lite approach has its limitations! Offering a clear migration path to the paid version (we did this pretty well I think), difficulty if not outright inability to track conversions from free to paid, and the limitations themselves that prevented the customer from really trying out the app realistically and on more than one platform.

Then there’s the extra work to make sure this second application target is always as up to date as the full version, with every new version of iOS, any bug fixes, and any new features. To be sure, most of the code is shared, but this additional version needed to be maintained and tested and managed in the App Store.

When the iPad arrived on the scene, developers had a choice: build a separate app targeted at the iPad only, or adapt your existing iPhone app to handle both as a universal app. At the time, it seemed like the fastest and easiest way to get Codebook going on the iPad was to go the separate app route.

So now we had a third app, with all the attendant effort required as described before regarding the Lite version! Prior to the modern automation of code signing in Xcode this created some serious challenges to getting everything built and signed properly.

A few years back we began the work of whittling this down. We adapted the main iPhone version to be a universal app supporting iPhone and iPad, and began to let customers of the iPad-only version know that it would be eventually discontinued in favor of the universal version.

Fast-forward a couple years to recent changes in how Apple allows In-App Purchases to be used, and we were finally able to offer a free trial in the main, universal version of Codebook for iOS, and last year we jumped on it.

All this is a long way of saying it feels good to say goodbye to Codebook Lite and Codebook for iPad: we’ve come a long way with Codebook for iOS! And we’re in great shape for what’s to come. All of us here at Zetetic have been working hard on Codebook 4, now the primary focus of Codebook development. It’s a big upgrade to Codebook’s security and sync features, so we’ll be doing extensive testing, and looking for more beta testers. If you’d like to become a beta tester and help us make sure we’ve got Codebook 4 just right, please email us at support@zetetic.net and let us know!

SQLCipher 4.0.1 is now available. This update to SQLCipher 4 includes several very important changes:

• Based on upstream SQLite 3.26.0, which addresses the SQLite “Magellan” vulnerability
• Adds PRAGMA cipher_compatibility and PRAGMA cipher_default_compatibility which simplify configuration of appropriate compatibility settings for different major SQLCipher versions
• Filters out ATTACH statements which contain KEY parameters from readline history when using the command line shell
• Fixes a crash in the command line shell when it is provided empty input (e.g. ^D)
• Fixes various compiler warnings related to strict-prototypes

The Magellan Vulnerability

The SQLite Magellan issue is a remote code execution vulnerability. Discovered by Tencent Blade Team, this problem can potentially affect applications that use SQLite versions prior to 3.26.0. By extension, because SQLCipher is based on SQLite, this issue can also affect applications that use SQLCipher versions prior to this release of 4.0.1.

The scope of the vulnerability is such that it could be used to exploit applications that:

1. Allow a potential attacker to execute arbitrary SQL; or
2. Open untrusted databases (i.e. that could be specifically corrupted by an attacker)

Due to the potential severity of this issue, we strongly recommend that all applications upgrade to SQLCipher 4.0.1, especially if they meet the aforementioned criteria.

Compatibility

As with the recent SQLCipher 4.0.0 release, 4.0.1 contains changes that are not directly compatible with SQLCipher 3.x (or lower). These provide a much higher level of security than previous versions of SQLCipher, however, SQLCipher 4.x will not open older databases by default (i.e. those created by SQLCipher 3.x or lower). To enable backwards-compatibility, applications can easily adjust settings at runtime or migrate older databases:

• To migrate and upgrade an existing database in place (preserving data and schema) to use the new default settings, use PRAGMA cipher_migrate.
• To open an older database use the compatibility PRAGMAs to adjust settings back to their previous values. For example, to open a SQLCipher 3 database using SQLCipher 4, use the following statement after opening and keying the database: PRAGMA cipher_compatibility = 3;.
• To attach and export data to a new database with fine-grained control, use the sqlcipher_export() convenience function.

Please review this additional guidance for detailed upgrade and migration scenarios. We have also published a migration guide for Commercial and Enterprise customers upgrading to SQLCipher 4.x using the SQLite-net API.

Availability

Commercial Edition - On-demand access to new releases of SQLCipher Commercial Edition are available to licensees with an active CipherCare subscriber subscription, along with private, prioritized support directly from Zetetic. CipherCare subscribers will receive a separate email notification regarding the update and can contact us to request the latest SQLCipher distribution and applicable software license codes.

SQLCipher Enterprise Program - Enterprise Program Subscription customers will receive a separate email notification about the release, and the latest SQLCipher packages and license codes will be provided directly via your organization’s private online software delivery share.

Community Edition - SQLCipher 4.0.1 in source format is directly available on GitHub. The Community Edition of SQLCipher for Android is available via AAR packaging. The Community Edition of SQLCipher for iOS can be compiled from source or using CocoaPods.

We are incredibly excited to announce the much anticipated release of SQLCipher 4. This is a major update that includes new features, improvements, and fixes. Here are some of the most important highlights:

• PBKDF2-HMAC-SHA512 is the new KDF algorithm
• HMAC-SHA512 is now used for per-page HMACs
• The default database page size has been increased to 4096 bytes
• KDF iteration count has been increased to 256,000
• Improved memory sanitization features
• Significant performance improvements for common use cases on platforms including iOS, Android, and Windows
• New baseline on upstream 3.25.2 enabling many new SQLite features
• Completely revamped client API support for .NET based platforms including sqlite-net, Entity Framework, and Microsoft ADO.NET

The full list of changes in the release can be found below. Note that changes indicated by a * are high impact and will impact compatibility with prior version of SQLCipher!

SQLCipher Core

• Default page size for databases increased to 4096 bytes (up from 1024) *
• Default PBKDF2 iterations increased to 256,000 (up from 64,000) *
• Default KDF algorithm is now PBKDF2-HMAC-SHA512 (from PBKDF2-HMAC-SHA1) *
• Default HMAC algorithm is now HMAC-SHA512 (from HMAC-SHA1) *
• PRAGMA cipher is now disabled and no longer supported (after multi-year deprecation) *
• PRAGMA rekey_cipher is now disabled and no longer supported *
• PRAGMA rekey_kdf_iter is now disabled and no longer supported *
• By default all memory allocated internally by SQLite before the memory is wiped before it is freed
• PRAGMA cipher_memory_security: allows full memory wiping to be disabled for performance when the feature is not required
• PRAGMA cipher_kdf_algorithm, cipher_default_kdf_algorithm to control KDF algorithm selection between PBKDF2-HMAC-SHA1, PBKDF2-HMAC-SHA256 and PBKDF2-HMAC-SHA512
• PRAGMA cipher_hmac_algorithm, cipher_default_hmac_algorithm to control HMAC algorithm selection between HMAC-SHA1, HMAC-SHA256 and PBKDF2-HMAC-SHA512
• Based on upstream SQLite 3.25.2
• When compiled with readline support, PRAGMA key and rekey lines will no longer be saved to history
• Adds second optional parameter to sqlcipher_export to specify source database to support bidirectional exports
• Fixes compatibility with LibreSSL 2.7.0+
• Fixes compatibility with OpenSSL 1.1.x
• Simplified and improved performance for PRAGMA cipher_migrate when migrating older database versions
• Refactoring of SQLCipher tests into separate files by test type
• PRAGMA cipher_plaintext_header_size and cipher_default_plaintext_header_size: allocates a portion of the database header which will not be encrypted to allow identification as a SQLite database
• PRAGMA cipher_salt: retrieve or set the salt value for the database
• Adds Podspec for using tagged versions of SQLCipher
• Define SQLCIPHER_PROFILE_USE_FOPEN for WinXP support
• Improved error handling for cryptographic providers
• Improved memory handling for PRAGMA commands that return values
• Improved version reporting to assist with identification of distribution
• Major rewrite and simplification of internal codec and pager extension
• Fixes compilation with –disable-amalgamation
• Removes sqlcipher.xcodeproj build support

SQLCipher for Android

• Substantial improvements to cursor access performance due to new loading heuristics
• Define custom cursor allocation sizes for paging query results, including initial, growth size, and maximum memory allocations
• Option to disable loading heuristic via setFillWindowForwardOnly on SQLiteCursor instance
• JNI CursorWindow caching of chunk pointer offsets to minimize linked list traversal
• Query total data size, and largest individual row in bytes based on provided query
• WAL mode API to enable, disable, and check if enabled
• Add API to get list of attached databases
• Add API to perform integrity check of the database
• Add API to enable, or disable foreign key constraints
• Improvements to begin transactions to allow for immediate and exclusive modes
• SQLiteOpenHelper supports onConfigure and onDowngrade callbacks
• SQLiteOpenHelper exposes the database name, and current WAL mode
• Improve exceptions thrown within JNI layer
• SQLCipher for Android target SDK set to 26
• Add support for AboutLibraries

SQLCipher for iOS

• To allow the use of WAL mode databases in shared containers use PRAGMA cipher_plaintext_header_size and cipher_default_plaintext_header_size to allocate a portion of the database header which will not be encrypted to allow identification as a SQLite database.
• Major (2x or more) performance improvements with hardware acceleration on 4K page size databases
• Removes support for sqlcipher.xcodeproj integration method for Community Edition*

SQLCipher for .NET, Xamarin, and Windows

• Client APIs now support a new sqlite-net compatible package based on the official praeclarum/sqlite-net library (was previously based on SQLite.Net-PCL) *
• Adds support for Microsoft Entity Framework via Microsoft.EntityFrameworkCore.Sqlite.Core 2.x
• Adds support for Microsoft’s ADO.NET implementation via Microsoft.Data.Sqlite.Core 2.x
• Substantial performance enhancements for Windows UAP and Runtime packages (up to 50%+ improvement under certain tests)
• Updates to all cryptographic support libraries including OpenSSL 1.1.1, OpenSSL 1.0.2p, OpenSSL FIPS 2.0.16, and LibTomCrypt 1.18.2
• Windows Phone is no longer supported due to the product end of life

Note: .NET, Windows and Xamarin packages are available exclusively via Commercial Edition packages and under the SQLCipher Enterprise Program.

Compatibility

Many of these changes provide a much higher level of security than previous versions of SQLCipher. However, the new page size of 4096, 256,000 KDF iterations, use of PBKDF2-HMAC-SHA512 and HMAC-SHA512 all modify important database settings. Thus, SQLCipher 4 will not open older databases by default. As always, we have updated our migration feature to streamline the upgrade process. To enable backwards-compatibility, it is possible to adjust settings at runtime or migrate older databases:

• To migrate and upgrade an existing database in place (preserving data and schema), use the new default settings, use PRAGMA cipher_migrate.
• To open an older database used pragmas to adjust settings back to their previous values. For example, to open a SQLCipher 3 database using SQLCipher 4, you could use the following statements after opening and keying the database: PRAGMA cipher_page_size = 1024; PRAGMA kdf_iter = 64000; PRAGMA cipher_hmac_algorithm = HMAC_SHA1; PRAGMA cipher_kdf_algorithm = PBKDF2_HMAC_SHA1;
• To attach and export data to a new database, use the sqlcipher_export() convenience function. This would let you control migration using very specific or custom settings.

Availability

Commercial Edition - On-demand access to new releases of SQLCipher Commercial Edition are available to licensees with an active CipherCare subscriber subscription, along with private, prioritized support directly from Zetetic. CipherCare subscribers will receive a separate email notification regarding the update and can contact us to request the latest SQLCipher distribution and applicable software license codes.

SQLCipher Enterprise Program - Enterprise Program Subscription customers will receive a separate email notification about the release, and the latest SQLCipher packages and license codes will be provided directly via your organization’s private online software delivery share.

Community Edition - SQLCipher 4.0.0 in source format is directly available on GitHub. The Community Edition of SQLCipher for Android is available via AAR packaging. The Community Edition of SQLCipher for iOS can be compiled from source or using CocoaPods.

Additional Details

Over the coming weeks we will be posting more detailed blog posts that elaborate on specific features and improvements that have been made with the latest SQLCipher release.