Aug 26 - Enhance security

extension/popup/popup.js

@@ -321,10 +321,9 @@ async function handleLogin() {
     }
 
     if (data.mfa_required) {
+      // enc_key_salt is withheld by the server until the second factor is
+      // verified — it now arrives with the /mfa/verify response instead.
       _mfaToken = data.mfa_token;
-      await chrome.storage.session.set({
-        _pending_enc_key_salt: data.enc_key_salt,
-      });
       handleMfaStage(password);
       // Reset MFA view to TOTP mode each time it's shown
       $("mfa-totp-section").classList.remove("hidden");
@@ -385,13 +384,7 @@ function handleMfaStage(password) {
         return;
       }
       _mfaToken = null;
-      const { _pending_enc_key_salt } = await chrome.storage.session.get(
-        "_pending_enc_key_salt",
-      );
-      await completeLogin(
-        { ...data, enc_key_salt: _pending_enc_key_salt },
-        password,
-      );
+      await completeLogin(data, password);
     } catch (err) {
       showError("mfa-error", "Error: " + err.message);
     } finally {