Mobile app v1.6.6

We’ve just released v1.6.6 of the Tokenized mobile app, which brings internal improvements and security upgrades that enable exciting new features coming soon to the desktop app. Right now you’ll notice we’ve made some improvements to private key cloud backups (don’t worry your current backup is still fully supported):

  • Cloud backups are now only loaded when needed, and your explicit security approval is required each time. For iCloud you’ll need to do Face/Touch ID, and for Google Drive you’ll need to confirm your account login in the browser. The app will remember the latest status of your backup, but the encryption secret is removed from memory as soon as it’s been used.
  • Backups in iCloud are now stored in your iCloud Keychain, taking advantage of end-to-end encryption. Note that iCloud Keychain must be enabled in iCloud settings on your device (the app will prompt you to check).
  • You can upgrade an existing backup in iCloud to use iCloud Keychain at any time in the account settings page. You can also verify, delete, or recreate any existing backup by tapping on it in account settings (authentication required). We recommend taking the time to verify your existing backups after installing the update.
  • Internally, every backup you create now uses a unique encryption key, meaning they can be individually revoked if necessary.

An update to v1.6.6 should already be available through your device’s store app, or via automatic updating if enabled. Here are the direct links:

2 Likes

I forgot to mention above that v1.6.6 of the mobile app also includes an important fix that I’d like to document here in case anybody runs into it:

The issue occurs if you’re setting up a new phone and restore from a system backup, or transfer your data from your old phone. In this situation you must re-pair with the desktop app (a security precaution that’s always been in place to prevent any opportunity for your root key to be stolen via your backup), but the app was not correctly identifying it, instead showing a grayed-out account like this:

In v1.6.6 this has been fixed – the incomplete from-system-backup state is recongnized correctly now, and you’ll be prompted clearly to scan a new pairing code and get back to signing transfers again ASAP:

2 Likes