Release Notes

Release assets

Every file is a release asset in octetproof/octet-browser, under the latest release. All versions and their changelogs are on the releases page. Each release has these assets:

Use the collector and the edge from the same release. To check your downloads, see Deploy the Edge.

Collector support

Octet accepts collections from a collector release for 12 months after the release that replaces it. When a new release comes out, its entry below gives the date the previous collector stops being accepted. After that date, the old collector's sessions get 400 with unknown_seal_key.

Browser support

The collector is built for ECMAScript 2020, which every current version of Chrome, Edge, Firefox and Safari supports, on desktop and mobile. It needs fetch and a secure (HTTPS) page. In browsers that lack WebRTC or WebSockets, or where they are turned off, the collector still works and the verdict is weaker.

v1.4.0

Action needed: when you update the edge, give it a signing key and register the key in the Octet portal. Octet is turning on required edge signatures. From then on, an edge without a registered key gets 401 with edge_signature_required or edge_key_unknown.

• The edge signs each session it forwards to Octet with its own key, set in EDGE_SIGNING_KEY. The signature covers the collection and what the edge adds about the connection. See Deploy the Edge.
• You register the signing key's kid and public key in your license's Edge configuration tab in the Octet portal, under Signing keys. A license can hold up to 3 signing keys, for a rotation overlap, and you can revoke one there. See Credentials.
• The signing key is separate from the edge's client certificate. The edge needs both.
• Octet refuses a session whose edge signature fails its check, with 401. New reason codes: edge_signature_required, edge_key_unknown, edge_signature_invalid, edge_signature_mismatch and edge_signature_stale. See Errors.
• The edge no longer sends a User-Agent of its own when the browser sent none.
• The collector works as in v1.3.0, with no change to its options, hosts or Content Security Policy.
• A malformed collection now gets 400 with missing_fields instead of a server error.
• Fewer wrong countries for some users behind a VPN.

v1.3.0

Breaking: update the collector and the edge together. From this release, Octet accepts only sealed collections and only edges with a client certificate. A v1.2.0 collector gets 400 with unsealed_bundle, and a v1.2.0 edge without a client certificate gets 401 with client_cert_required. The v1.2.0 collector is not covered by the 12-month support window, because it doesn't seal its collections.

• The collector encrypts each collection to Octet before it leaves the browser. Your edge forwards it without being able to read it, and Octet can tell if it was changed on the way. See Integrity and Audit.
• Octet refuses a copy of a collection it accepted recently, through any edge, with 409 and replayed_bundle.
• The collector keeps a device key in the browser's IndexedDB, in a database named octet on your origin. See Privacy and Data.
• The collector needs a secure (HTTPS) page. On a plain http:// page it fails at once with a clear error.
• The published collector files are scrambled, which makes them harder to read. It doesn't make the collector's data trustworthy. The script is about 100 KB, or about 36 KB gzipped, and still needs no unsafe-eval.
• The edge connects to Octet only over mutual TLS, with a client certificate for your license. It refuses to start without one. You issue the certificate yourself in your license's Edge configuration tab in the Octet portal, under Certificates, and can revoke a single certificate there. See Deploy the Edge.
• New reason codes: client_cert_required, client_cert_licence_mismatch, client_cert_revoked, unsealed_bundle, unknown_seal_key, bad_seal and replayed_bundle. See Errors.
• Verdicts are harder to influence from the browser.
• Sessions through iCloud Private Relay keep the user's own country, and aren't treated as masked.
• On some connections, ready() can take up to about 4.5 s in full mode, and up to about 3 s in lite mode.
• New pages: Integrity and Audit and Keep Verdicts for Audit.

v1.2.0

The first public release of Octet Browser.

• The collector's start() and ready() split collection from the moment of action: start at page load, and wait at the moment of action.
• Three collection modes, full, lite and passive. Every host the collector contacts is run by you or by Octet.
• Each verdict carries a signed token, verifiable against Octet's published key set.
• Per-license read tokens for fetching verdicts, created and revoked by you in the Octet portal.
• The edge terminates TLS itself, and returns Octet's status and reason code when Octet refuses a session.
• Static edge binaries for Linux on amd64 and arm64.
• The collector starts a Web Worker from a blob: URL. Allow worker-src blob: in your Content Security Policy for the best results. See Network and CSP.