v2.4.15
- Demo Mode now has its own separate card below Set Up Identity, so it is no longer confused with importing your real .tip.json identity.
- Expanded coverage for additional news and messaging publishing platforms.
- Fixed two interface messages and hardened the content-type picker icons against host-page styling.

v2.4.8 - Firefox biometric setup degradation + cross-browser polish

What's fixed
- Firefox: Identity setup no longer fails with "The operation is insecure" when you try Face ID. Firefox does not yet support biometric setup inside browser extensions (this is a Mozilla platform constraint, not something the extension can work around). The Settings page now recognises Firefox, dims the Face ID option, relabels it "Not available in Firefox", and routes you to the Password option, with a clear note that the encryption strength is identical (AES-256-GCM + PBKDF2 200,000 rounds).
- Settings page now opens in its own tab so the biometric setup flow has the focused context it needs.
- The secure verification window during signing now feels like a continuation of the same flow, with a clear "Continuing your registration from the previous tab" anchor line and an auto-focused, pulsing Verify button.

What's new (rolled forward from earlier 2.4.x)
- Built-in Demo Mode on the Setup screen. One-click load of a complete demo identity, no account or external file needed.
- "How do I find my post URL?" guide tailored to each platform, right under the URL input. Auto-expands when you paste a URL that looks like a homepage.
- Better per-field "Required" / "(optional)" badges that match what the form actually accepts.

Reliability and data safety (rolled forward from 2.4.1)
- Register button shows clear errors instead of silently failing.
- Status messages stay visible at the top of the panel after scrolling.
- Title, byline, thread, and wire-source fields enforced consistently across the in-page panel and Settings > Label Content.
- Fixed an edge case where switching the content type after attaching media could carry the previous file's hash into the next registration.

Internals
- 168 new regression tests across the v2.4.0 to v2.4.8 cycle covering form validation, stale-state cleanup, per-platform URL guidance, Demo Mode, WebAuthn iframe fallback, options-page origin handling, cross-target Relying Party ID resolution, and Firefox-specific degradation.
- No new permissions. No new host permissions. No protocol changes. CTIDs minted with 2.4.0 verify identically against 2.4.8.

v2.4.7 — Reliability + Demo Mode + per-platform URL guidance

What's fixed
- Biometric (Face ID / Touch ID / Windows Hello) setup on the Settings page now works correctly. The previous version mis-resolved the WebAuthn Relying Party ID for the extension's own origin, which the browser silently rejected with a misleading "Public-key credentials are only available to HTTPS origins" error. The extension now derives the right Relying Party ID from the page's own origin, which satisfies the rules in every supported browser.
- The Settings page now opens in its own tab so the biometric prompt has the focused context it needs to appear.
- The secure verification window that opens during signing now feels like a continuation of the same flow, with a "Continuing your registration from the previous tab" label and a pulsing Verify button that auto-focuses (so keyboard and screen-reader users can complete verification without reaching for the mouse).
What's new (rolled forward from 2.4.4)
- Built-in Demo Mode. The Setup screen has a "Try Demo Mode" button that loads a complete demo identity with one click. No account, no download, no external file.
- A persistent "DEMO MODE" banner appears at the top of the Settings page while the demo identity is active.
What's improved (rolled forward from 2.4.2 and 2.4.3)
- Every URL input carries a "How do I find my post URL?" guide tailored to the platform you are on. For YouTube, blogs, news sites, X, Reddit, Mastodon, Bluesky, Truth Social, Substack, Medium, and most other surfaces, you copy the URL directly from the browser address bar when the post is open on its own page. For platforms where the address bar shows the feed or profile instead of the post (Instagram, Facebook, LinkedIn, TikTok, Threads), the guide walks you through the three-dots menu or Share button. Chat platforms (Discord, Slack, Telegram, WhatsApp, Element) get right-click Copy permalink instructions.
- The guide auto-expands when you paste a URL that looks like a homepage.
- Per-field "Required" and "(optional)" badges now match exactly what the form will accept.
Reliability + data safety (rolled forward from 2.4.1)
- The Register button now shows a clear error message when it cannot proceed. Silent failures are gone.
- Status messages stay visible at the top of the panel even after you scroll.
- Title, byline, thread, and wire-source fields are enforced consistently across the in-page panel and Settings > Label Content.
- Fixed an edge case where switching the content type after attaching media could carry the previous file's hash into the next registration.
Internals
- 158 new regression tests across the v2.4.0 -> v2.4.7 cycle covering form validation, stale-state cleanup, per-platform URL guidance, Demo Mode, WebAuthn-blocked fallback, options-page origin handling, and cross-target Relying Party ID resolution.
- No new permissions. No new host permissions. No protocol changes.

v2.4.4 - Demo Mode + per-platform URL guidance

What's new
• Built-in Demo Mode. The Setup screen now has a "Try Demo Mode" button that loads a complete demo identity with one click. No account, no download, no external file. Great for evaluating the extension before importing your real TIP-ID.
• A persistent "DEMO MODE" banner appears at the top of the Settings page while the demo identity is active, so the demo can never be confused for a production identity.

What's improved (rolled forward from 2.4.2 and 2.4.3)
• Every URL input now carries a "How do I find my post URL?" guide tailored to the platform you are on. For YouTube, blogs, news sites, X, Reddit, Mastodon, Bluesky, Truth Social, Substack, Medium, and most other surfaces, you just copy the URL from the browser address bar when the post is open on its own page.
• For platforms where the address bar shows the feed or profile instead of the post (Instagram, Facebook, LinkedIn, TikTok, Threads), the guide walks you through the three-dots menu or Share button that produces the correct permalink.
• Chat platforms (Discord, Slack, Telegram, WhatsApp, Element) get instructions for the right-click Copy permalink workflow.
• The guide auto-expands when you paste a URL that looks like a homepage, so you see the steps without having to discover the disclosure.

Reliability and data safety (rolled forward from 2.4.1)
• The Register button now shows a clear error message when it cannot proceed. Silent failures are gone.
• Status messages stay visible at the top of the panel even after you scroll, and the panel auto-scrolls back to the top when a new error appears.
• Title, byline, thread, and wire-source fields are enforced consistently across the in-page panel and Settings > Label Content.
• Fixed an edge case where switching the content type after attaching media could carry the previous file's hash into the next registration. Every registration now starts from a clean state.

Internals
• 113 new regression tests across form validation, stale-state cleanup, per-platform URL guidance, and Demo Mode, so these classes of bug cannot recur.
• No new permissions. No new host permissions. No protocol changes. CTIDs minted with 2.4.0 verify identically against 2.4.4.

v2.4.1: Reliability & UX fixes

What's fixed
• Media-first posts (image, video, audio, document) can now be registered without forcing you to type a caption first. Caption stays optional when the post itself is the artifact.
• The Register button now shows a clear error message when it can't proceed. The previous silent "click does nothing" behaviour is gone.
• Status messages stay visible at the top of the panel even after you scroll, and the panel auto-scrolls back to the top when a new error appears.
• The toolbar popup now mirrors the in-page panel: clear errors for missing origin selection, URL format validation, and silent-failure protection.

What's improved
• Per-field "Required" vs "(optional)" badges now match exactly what the form will accept. No more "Required" labels on fields that turn out to be optional.
• Title, byline, thread, and wire-source fields are now enforced consistently across the in-page panel and Settings > Label Content.
• Wire adaptations correctly restrict the available origin codes (AA / Mixed only) at the moment you click the origin button, not after submission.

Data safety
• Fixed an edge case where switching the content type after attaching media could carry the previous file's hash into the next registration. Every registration now starts from a clean state.

Internals
• 98 new regression tests covering form validation and stale-state cleanup, so these classes of bug can't recur.
• No new permissions. No new host permissions. No protocol changes, CTIDs from 2.4.0 verify identically.

This release brings TIP Protocol to Firefox with full feature parity with the Chrome extension, plus Firefox-specific improvements required for Manifest V3 on Gecko.

What's new
A new network interceptor runs at document start on Instagram, Facebook, and X. It patches the page's native fetch and XMLHttpRequest to detect TIP Content IDs (CTIDs) embedded in API responses, enabling badge rendering on those platforms even when posts load dynamically through GraphQL rather than standard HTML.

Platform coverage
This release supports badge display and content registration across 300-plus sites, including YouTube, Instagram, TikTok, X, Facebook, LinkedIn, Threads, Reddit, Bluesky, Mastodon, Truth Social, WeChat (Official Accounts and Channels), Weibo, major global newsrooms, academic publishers, and blogging platforms.

Content types
Creators can register text posts, photos, carousels, videos, articles, podcasts, and mixed-media content, with origin declarations of Original Human, AI-Assisted, AI-Generated, or Mixed.

Security
Signing keys never leave your device. Post-quantum cryptography is provided by the audited @noble libraries (ML-KEM, SHAKE-256). All cryptographic operations run locally.