Security Settings
Version Notice
This document corresponds to the v3 "Settings → General → Security" page. Settings may change with versions; please refer to the actual interface.
Protect your configuration
Through flexible security configuration, protect your system from unauthorized access. All settings are saved in real-time and take effect automatically.
Security settings protect sensitive operations (settings modification, drawing, window control, etc.). They support three verification methods — password, TOTP and USB drive binding — which can be combined.
Security Switch
Enable Security Protection: When enabled, selected operations require verification before execution
- On: All selected security operations require verification
- Off: Security operations do not require verification
Tips
Security verification always runs through the unified security service and cannot be bypassed.
Verification Methods
Enable Password Verification
Description: Protect sensitive operations with a local password
How to use:
- Enable "Password Verification"
- Click "Set Password", enter a password (at least 6 characters)
- Takes effect after saving
Notes:
- Minimum 6 characters; no additional character class restrictions
- Can "Change Password" or "Remove Password" anytime
Enable TOTP Verification
Description: Protect sensitive operations with one-time codes (i.e., 2FA)
How to use:
- Enable "TOTP Verification"
- Click "Set TOTP", scan the QR code or enter the key with an authenticator app (e.g., Google Authenticator, Microsoft Authenticator)
- Enter the 6-digit code generated by the authenticator to complete binding
Notes:
- Can "Reset TOTP" anytime
- The code is a 6-digit dynamic passcode
Bind USB Drive
Description: Only allow verification when the bound device is present
How to use:
- Enable "USB Binding"
- Insert the USB drive to bind
- Click "Bind USB Drive" to complete
Notes:
- A dedicated security token (
.SecRandom.safety.key) is stored on the bound drive - Multiple devices can be bound; view them in the "Bound Devices" list (drive letter, disk name, device identifier, connection status)
- Can "Unbind" or "Unbind Selected" devices
- Binding records only keep stable device IDs and token hashes, not volatile info like drive letters
Protection Scope
Verify Before Sensitive Operations
Description: Require verification before modifying key settings (security, linkage, lists, etc.)
Verify Before Linkage Operations
Description: Require verification before external linkage triggers drawing or page switching
Window & App Operations
Protect the following (optional):
- Open Settings: Verification required when opening the settings window
- Allow Read-only Settings Preview: When entering settings verification, allow previewing settings content (read-only before verification, modifiable after)
- Show/Hide Main Window: Verification required to show/hide the main window
- Show/Hide Floating Window: Verification required to show/hide the floating window
- Restart App: Verification required to restart the software
- Exit App: Verification required to exit the software
Draw Operations
Protect the start and reset of each draw type separately:
- Roll Call Start / Roll Call Reset
- Quick Draw Start / Quick Draw Clear
- Lottery Start / Lottery Reset
Verification Method Combination
Verification Methods
Choose the combination of methods to use (password, TOTP, USB drive)
All Selected Methods Required
- On: Must complete all selected methods to pass
- Off: Passing any selected method is enough to continue
Tips
The password always protects the credentials themselves; other methods must be configured before they can be selected.
Tamper Protection
Settings File Tamper Check
Description: Records a fingerprint of the whole settings file and verifies at startup that it was not changed outside the app
Tamper Response (the action taken when the check finds the file changed outside the app):
| Option | Description |
|---|---|
| Require the security password before continuing | Enter the security password to accept the current settings file, otherwise the app exits |
| Automatically restore the latest backup | Restores the settings file from a backup; the replaced file is saved aside and the app restarts afterwards |
Restore Source (backup sources tried in order during automatic restore):
- Local backups only
- Local first, cloud when missing
- Cloud first, local when that fails
Notes:
- Cloud backups need a signed-in account and only this device's own uploads are used, never another device's backup
Sudo Mode
Enable Sudo Mode
Description: Verify once and skip repeated verification for a while; operations and the settings window keep independent timers
- On: protected actions no longer ask for verification while the window is valid
- Off: every protected action asks for verification again
Sudo Duration
Description: How long verification is skipped after a successful one
Range: 10–600 seconds (default 20 seconds, step 10)
Operations: draws, resets, window toggles, exiting the app, shortcuts and IPC commands
Settings window: after opening settings with verification, changes in this window are covered too, but closing the window ends it immediately; changes that loosen protection — turning security off, clearing a factor, disabling the settings-integrity check or lengthening this duration — always ask for the security password again
Never affected: setting up TOTP, changing or removing the password and binding a USB device always ask again
Notes:
- "Exit Sudo Mode" in the tray menu ends the verification-free period immediately (it is shown only while Sudo mode is active)
Security Recommendations
- Enable the security switch to strengthen system security
- Set a strong password and change it regularly
- Enable USB/TOTP verification as a second factor when needed
- Enable verification for important operations (exit, open settings, draws)
Related Pages
- Verifiable drawing (proof & notarization): see Verifiable Drawing
- Backup & restore: see Backup Settings
- Privacy options: see Privacy Settings
Contributors
陈晋瑭Changelog
c13ca-on
Copyright
Copyright Ownership:SECTL
License under:CC BY-NC-SA 4.0