Evolution

Release Notes

Follow the updates, performance enhancements, and security fixes made to Sino.

Version 2.1.9

Upcoming Release Android 2.1.9 • Windows 1.0.1 • In testing

Local Vault, Smarter Folder Sync & Reliability Fixes

Version 2.1.9 adds the Local Vault, a private, encrypted home for files you move into Sino, lets renamed and moved folders follow you across devices, and fixes large Google Drive uploads.

New: Local Vault
  • Your own private vault: Add or move files into Sino. They are stored encrypted in Sino's private storage, hidden from your gallery, file manager and other apps, in folders and subfolders you create.
  • Back up only what you choose: Keep each folder on this device only, or back it up to the clouds you pick. Backing up uploads the same encrypted files, with nothing re-encrypted.
  • Works with your other apps: Share files to Sino from any Android app. Through the Android Files app or the Windows drive, apps can save, edit, rename, move and delete files and folders in Local Vault folders, and Sino encrypts them before storing.
  • Free up space, export, download: Remove backed-up files from a device and open them from the cloud, export a decrypted copy where you choose, or bring files back onto a new device.
Security
  • Vault key no longer in the device list: Each device's entry held a copy of the vault key that the device's own stored key could open, so someone able to run code as Sino on a locked device could open the vault without the master password. Entries now hold only each device's public keys.
  • Wrong-password alerts (optional): Switch them on for a device, and when wrong passwords are entered on it, even while locked, your other devices are told how many and when (never what was typed), encrypted so only they can read it.
  • Lost-device check never waits: A revoked device now checks for revocation regardless of Wi-Fi-only, charging-only or network settings. Android checks every hour and retries when it cannot reach your clouds, starting 15 minutes later; Windows checks every 15 minutes while Sino is running. Both also check right after a wrong password (at most once a minute), so a revoked device someone is trying to unlock wipes itself sooner.
  • Cleaner diagnostic logs: File names no longer appear in diagnostic logs.
  • Device names encrypted: Each device's name and type in your vault's device list are now encrypted, so your cloud sees only a random id.
  • Fixed: MEGA password shown (Windows): The MEGA sign-in box showed your password as you typed it. It is now hidden.
Sync & Cloud
  • Renames and moves follow you: Renamed or moved folders keep their cloud copies, and your other devices rename or move theirs. Empty folders and deleted folders reach your other devices too.
  • Fixed: large Google Drive uploads: Files over 5 MB failed to upload to Google Drive. Uploads now go in resumable 8 MiB parts that every provider accepts.
  • Faster backups and downloads: Up to three files back up at once, and each cloud takes a file at its own pace, so a slow cloud no longer holds back a fast one. MEGA and S3 receive several parts of a file at once (Google Drive takes them in order). Restores check a file in one pass, large downloads from MEGA and S3 fetch several pieces at once, and video streaming reads further ahead.
  • Full clouds and transfer limits: When a cloud is full, Sino keeps backing up to your other clouds, shows which one is out of space, and adds the missing copies once there is room. Files waiting for a full cloud no longer hold back the rest, and a restore that hits MEGA's transfer quota says how long to wait.
  • Fixed: duplicate Drive folders: Pressing Sync repeatedly could create extra SinoVault folders in Google Drive.
  • Faster first backup: The first backup after setting up or restoring a vault no longer waits for Wi-Fi or a charger.
Android & Windows
  • Google Drive sign-in (Android): Now uses Google Play services' account picker, fixing sign-ins that timed out on some Samsung phones.
  • Easier recovery phrase entry (Android): One box per word, with each word checked as you type.
  • Sync now (Windows): Scans your folders first, shows progress, and tells you what happened: files backed up, nothing to do, or why it is paused.
  • Accessibility: Every icon button now has a name that screen readers read, shown as a tooltip on hover (Windows) or a long press (Android). Switches and checkboxes are read with their labels, titles are headings, and errors are read out when they appear. Recovery-phrase words and 2FA seeds are treated as passwords. Windows works with NVDA and JAWS without setup when the screen reader is running before Sino starts. On Android 14 and later, only accessibility tools such as TalkBack can read Sino's screens.
  • Restore with a passkey (Windows): A new PC can now be restored with your recovery passkey, from Windows Hello, your phone or a security key, as well as with your 24 words. Recovery now connects your cloud first.
  • Updated Terms of Service and Privacy Policy: Covering the Local Vault, saving through the virtual drive, device revocation, exactly what is stored in your cloud, and pricing: free on Windows and a one-time purchase on Android for personal use, with subscriptions for businesses.

Version 2.1.6

Latest Stable Release October 2026

Post-Quantum Hardening, Multi-Platform Workstation & Sovereign Deniability

Version 2.1.6 introduces quantum-resilient lattice cryptography across all platforms, strict physical separation for duress safes, native Windows workstation drive mounting with Windows Hello, device revocation via signed manifests, and Open SDK 4.0.0.

QuantumShield Lattice Suite
  • NIST Post-Quantum Cryptography: Integrated ML-KEM-768 (FIPS 203) key encapsulation and ML-DSA-65 (FIPS 204) digital signatures.
  • Hybrid Legacy Wrapper: Dual-layer ML-KEM-768 + RSA-OAEP sealed inheritance envelopes with configurable platform inactivity thresholds.
  • Signed Device Revocation: Device list signed with ML-DSA-65; a revoked device wipes its local data the next time it checks the list.
Windows Desktop & Virtual Drive
  • Dokany Virtual Drive: Read-only virtual drive assigned to the first free drive letter starting from S:; unmounts immediately when vault locks.
  • Windows Hello Unlock: Biometric authentication bound to hardware TPM 2.0 with DPAPI machine entropy fallback.
  • Encrypted Settings Sync: Cross-platform synchronization of user configuration options via isolated cloud metadata batches.
Strict Duress Separation & Storage
  • Strict Vault Split: PhantomVault decoy safe partitioned into a completely separate, device-bound local database with isolated keys.
  • Reclaim Cloud Space: Comprehensive cloud garbage collection to identify and permanently remove unreferenced ciphertext blobs.
  • Obscura Tree Normalization: 32-character HMAC folder/blob hex names and 16-character vault namespace/.batch batching.
Sino Open SDK 4.0.0
  • Standalone CLI Tool: Standalone Java CLI recovery and audit utility published under the MIT license on GitHub.
  • Deterministic Verification: Offline container inspection and vault decryption via recover, list, and verify-manifest commands.

Version 2.0.0

Universal KMP Core & AegisStream August 3, 2026

Universal Privacy Engine & AegisStream Streaming Milestone

This release marks the single most significant architectural milestone in Sino's history. 100% of zero-knowledge cryptography, chunked GCM streaming, and sync orchestration have been extracted from the host OS into a platform-agnostic KMP Core (:sino-core), establishing AegisStream chunked streaming and Version 2 sealed containers across all platforms.

KMP Shared Architecture & FLE
  • Platform-Agnostic Core: Sync, recovery, panic, and streaming migrated to shared :sino-core.
  • Unified Field-Level Encryption: Column-level encryption (Database_Encryption_V1 AES-256-GCM) + BlindSight Indexing (Database_BlindIndex_V1) on SQLite/SQLCipher.
  • Version 2 Sealed Containers: [SINO][0x02] magic binary headers with trailing whole-stream SHA-256 integrity validation.
AegisStream Cloud Streaming
  • 1MB Chunk Boundaries: Sequential counter nonces (BaseIV[0..7] || ChunkIdx) with 16B tags (1,048,592 B packets).
  • VolatileStream Playback: Instant 4K video range-requests directly from encrypted cloud blobs via decryptRange() in volatile RAM sandbox.
  • OmniMirror S3 Cloud RAID: 5-packet aligned multipart sync (5,242,960 B) with automated mirror failover across Google Drive, MEGA, and S3.
Hardened Cryptography & Panic
  • IronCore Dual-Key Protocol: Cryptographic separation of IronCore Silicon (TEE/StrongBox/TPM 2.0) and Passphrase (Argon2id) wrappers.
  • HKDF Domain Expansion: Deterministic sub-key derivation for database, FLE, blind index, and chunk streaming keys.
  • Terminus Protocol Panic Wipe: 1x1 widget triggering 5-step emergency local destruction sequence (RAM zero-wipe -> DB -> Keystore -> Reset -> Exit).
  • Hardened Legacy Bridge: Asymmetric PGP/RSA inheritance wrappers with inactivity thresholds.
Discovery & Intelligence
  • Universal Scanner Engine: Agnostic path normalization and incremental chunk hashing.
  • HEVC Smart Skip: Automatic detection of H.265 optimized video payloads during local discovery.
  • S3 Provider Profile Aliasing: Integrated profiles for AWS S3, Cloudflare R2, MinIO, Wasabi, Backblaze B2, and Akamai.

Version 1.1.0

Samsung Hardening & Open SDK July 6, 2026

Platform Hardening & Security Verification

  • Samsung StrongBox Remediation: Resolved hardware KeyMint attestation hangs on Android 16 / One UI 8.5.
  • Android 15 Edge-to-Edge: Full support for SDK 35+ system windowing and transparent bars.
  • Sino Open SDK: Published standalone, open-source cryptographic module (sino-open-sdk).
  • Non-Blocking Auth: Background dispatcher routing for Credential Manager biometrics with 20s timeout protection.
  • Duplicate Folder Protection: Enforced database and UI constraints preventing redundant path sync target selections.
  • Global Localization: Centralized 150+ UI string resources for multi-language readiness.

Version 1.0.0

Official First Production Release June 28, 2026

Key Features & Capabilities

Sino launched with a comprehensive, zero-trust cloud orchestration architecture, providing client-side encryption and high-performance media capabilities.

Core Cryptography
  • AES-256-GCM: Standardized local-first file encryption with unique data encryption keys.
  • IronCore Key Derivation: Root master key wrapped in device IronCore silicon secure enclaves (Android TEE / StrongBox).
  • SQLCipher Database: Complete vault database baseline encrypted via AES-256.
  • IronSeed (24-Word BIP-39): Fully offline vault recovery keystone seeds derived via PBKDF2 (HMAC-SHA512).
OmniMirror Multi-Cloud Sync
  • Parallel Multi-Provider Sync: Synchronize directories to Google Drive REST, MEGA, and multiple S3 compatible targets simultaneously.
  • S3 Compatible Profiles: Dedicated Registry UI to alias and manage Cloudflare R2, AWS S3, and Backblaze B2.
  • Elite Idempotency: Resumable multi-part upload protocols for S3 transfers.
  • Obscura Tree Path Obfuscation: Path and metadata obfuscation using per-user salted hashing.
Optimization & System
  • Adaptive Compression: Folder payload compression utilizing Gzip rules.
  • IronCore Biometric Bridge: Bypass derivation delays for biometric unlocks.
  • ProgressStyle Chips: Native Android notification widgets for real-time parallel sync speeds.
  • Attribution: Flattened integration of the local kmp-mega module by Anders Carlsen.
High-Performance Media
  • VolatileStream 4K Playback: Range-request playback for encrypted videos directly in RAM from GDrive, MEGA, or S3.
  • Encrypted Virtual Drive: Exposed secure vault root directly to the Android OS via Storage Access Framework (SAF) using volatile RAM pipes.
  • Smart Transcoding: Hardware-accelerated H.264 to HEVC re-encoding with smart skip parameters.
  • Secure Snapshots: TEE hardware-locked metadata UI cache for near-instant boot response.
Advanced Security UX
  • Stealth Disguise Mode: Re-layout app UI and launcher icon to disguise as a Scientific Calculator.
  • Terminus Protocol Panic Widget: 1x1 home screen widget to trigger emergency local vault destruction sequence.
  • PhantomVault Duress Safe: Secondary passcode input that loads a separate decoy vault with distinct cloud paths.
  • Dead Man's Switch: Peer-encrypted legacy key handover system.
Data Hygiene
  • Memory Scrubbing: Strict fillZero() sanitization for cryptographic buffers.
  • Forensic Cloud Trash: Moves deleted S3 nodes to a hidden .trash/ prefix for recovery relinking.
  • Sanitized Diagnostics: Scrubbed log exports excluding keys, tokens, and filenames.

v0.9.x Series (Dev Testing)

March – June 2026

Testing Milestones

  • Completed initial Hardware Security Module (Android TEE/StrongBox, Windows DPAPI/TPM 2.0) integration and tested hardware key-wrapping performance.
  • Implemented WorkManager background scheduler configurations.
  • Performed MEGA API login tests with multi-factor authentication.
  • Conducted scalability testing under mock loads (1000+ files) to optimize memory consumption.
  • Removed experimental database migration scripts and finalized database baseline schema.