Every window now says Attest.

The options page, the window that asks whether a site may use your key, and the window where you type your PIN or passphrase were still titled "nos2x-fox", after the extension Attest was forked from. With both installed, the title bar could not tell you which of the two was asking — and the PIN window is where that matters most. Only type your PIN or passphrase into a window titled Attest.

Nothing about signing, permissions or your keys changes.

Fixed: the settings page could describe one profile while another was signing.

With more than one key stored, the settings page always opened on whichever profile was stored first, and the profile dropdown there changed only what that page displayed — it did not change which key websites were signed with. The popup was the only control that switched anything.

The settings page now opens on the profile that signs, and choosing a profile there switches the signer, exactly as the popup does. That choice is kept when you restart the browser.

With PIN or passphrase protection on, switching to a profile that has no key of its own now clears the key slot instead of leaving the previous profile's key in place.

Better handling of your keys in the options page, and a switch for other extensions.

• The Keys section now shows what is actually there. With your keys protected by a PIN or passphrase there is no longer an empty field suggesting you could paste a key into it; you get a Copy button that asks for your PIN or passphrase instead. Without protection, the eye button really reveals your key.
• Adding another key is now done from the Keys section itself, with the cursor ready in the field.
• Other extensions can now only use Attest if you allow it in the options, and this is off unless you turn it on. If you use another add-on that signs through Attest, switch it on there once.
• When two requests need your PIN or passphrase at the same time, both are handled after you enter it once. Before, the second was refused even though you had entered it.
• Closing the PIN window now always gives the page that was waiting a clear answer.

Smarter remembered decisions, and a round of fixes.

Each site now keeps one remembered decision per kind of permission. Refusing a site something for a few minutes no longer erases a permanent permission it already had, and allowing a small request no longer erases a refusal of a bigger one. The permissions table shows each decision on its own row, so you can revoke them one at a time. Your existing permissions keep working.
The approval window now always shows which profile will sign, also when your keys are protected, and only mentions an event kind for requests that contain one.
Asking for your public key no longer requires your PIN or passphrase: it is not a secret.
Requests waiting for your approval are kept in memory only and no longer written to disk.
Only the approval window can answer a request, and unknown request types are refused straight away.
Link handler templates must be ordinary web addresses (http or https), and links containing a % no longer open a blank tab.
Deleting a new profile that was never saved now simply discards it.
The "Attest" name next to the logo is readable again, and links inside help texts are no longer smaller than the text around them.

Stronger key protection, and permissions tied to a site's full address.

You can now protect your keys with a passphrase instead of a PIN. A PIN of 4 to 6 digits stops someone using your browser, but anyone who copies your Firefox profile can try every PIN within minutes; a passphrase of a few random words holds up against that. The setup window explains the difference, and your existing PIN keeps working.
Newly encrypted keys use a six times stronger key derivation.
A site you allowed over https is no longer also allowed over plain http. Before, anyone able to serve you the plain-http version of a site — on a public network, for example — got its permissions. Your existing permissions are moved across automatically; a site you only used over plain http may ask you once more.
Sandboxed pages, which have no address of their own, can still make requests, but your answer applies to one request only and is never remembered. Before, such a page could use the permissions of the site serving it, and its requests never got an answer.
The permissions table shows each site's full address, and the options page updates by itself when protection is turned on or off.
Elements that should be hidden now are, such as the PIN field after copying a key.

Security and reliability fixes.

• Answers to a website's requests are now accepted only from that page itself. Before, another window able to post messages to the page — an embedded frame, or a site that opened it — could slip in a fake answer, such as a wrong public key or a fake decrypted message. Your private key was never exposed.
• Requests made at the same moment no longer receive each other's answers. Pages that make many calls at once, such as decrypting a whole inbox, could get the wrong result or wait forever.
• Error messages sent to websites no longer include internal details that identified your installation.
• A site you revoked in the options page no longer gets its permission back when you rename the profile or save a new key, and sites you allow while the options page is open keep their permission.
• The permissions table updates by itself as sites are allowed or revoked.
• Saving a key that already has a profile now asks before replacing it.
• The approval window no longer goes blank after you answer the last of several waiting requests.
• Button icons are visible again in both the light and the dark theme, and dialogs follow the chosen theme.

Dark mode: the buttons no longer glare. They sit on a neutral surface with a visible border, and only Authorize, Reject and Delete keep a colour of their own — so the destructive button is the one that stands out, which it was not before.

Hovering a button used to make its label almost unreadable. That was worst on the authorization window, where Authorize and Reject are the only two controls and reading them is the whole point. Fixed in both themes.

Icons on buttons were a one-pixel line in near-black. They are slightly larger now, and drawn with a heavier stroke.

When another extension asks Attest to sign something, the authorization window now names it by its add-on id. It used to show an identifier that Firefox generates per installation, which told you nothing about who was asking. Any permission you granted to such a caller will be asked again, once.

Dark mode fixes.

The "Attest" wordmark in the header was drawn in near-black on the dark background — 1.04:1 against it, which is to say invisible. It follows the theme now.

Labels on disabled buttons sat at 2.4:1 on their own grey. Disabled buttons have their own text colour now, in both themes.

The copy icon rendered as a solid block instead of an outline.

Fixed: with PIN protection enabled, the copy button next to your private key did nothing when clicked — no message, no explanation why. It works now.

New: a PIN-protected private key can be copied out. Copying opens the PIN window, which puts the key on your clipboard and tells you which account it belongs to. Until now, turning PIN protection on meant your key could never leave Attest.

Also fixed: Save key could be clicked with an empty field and reported success without having saved anything.

New logo and bug fixes