yesbutnobutyesbutno

cross-posted here from https://sh.itjust.works/post/1658215 to get some additional feedback on this.

Hi,

As my regular instance was experiencing downtime, I decided it might be a good idea to have a backup account on a different instance. So I created a new account on feddit.uk, configured 2FA and all was well. Although…

When I later tried to log on using Voyager, it kept returning a connection error. I tried logging on to the instance directly using the browser: no error, but just lands back on the login page.

Seems like the issue was caused because of the password length (originally 65 characters). Resetting my password and bringing it down to 45 characters resolved the issue. However, directly after the password reset, I was logged in, and my 2FA code wasn't asked?!

For a minute I thought it might be due to cached credentials, but retrying the same scenario in a private window confirmed it. This means that if your e-mail account is compromised, 2FA will no longer protect you.

Another possible issue (just to be clear, in this scenario, your e-mail account is not compromised): if someone is able to access your account (maybe you forgot to log out), they can modify your e-mail address without you being notified, nor do they need to know your password. A verification e-mail will be sent to the new address, and they can reset your password using the approach described above. The new e-mail address does not need to be verified to do so (a verification e-mail is sent, but resetting the password works even if you don't verify), and the old e-mail address is not given a heads up of the change (I know, the old address might no longer work, but still).

Not only can your password be reset this way, after gaining entry, 2FA can be disabled without issue.

Am I wrong in thinking the scenarios described above are security issues? Thanks for your feedback!

As you can see, for accounts with long usernames, the username is not truncated when looking at the posts or comments overview, causing it to overflow into the title area.

One more thing: if you create a new post, add a photo, then type the post text, you’ll get a message saying “please add a photo” when tapping “Post” (see second screenshot).

This is a very weird bug, and I’ve only encountered it once before on my iPad, but it just happened on my iPhone too.

Basically, when tapping a text field, the keyboard will no longer show up. You’ll notice at the bottom there’s a small toolbar that appears (which seems to be the top of the keyboard), but nothing more.

In the screen recording you’ll first see the issue being reproduced in Voyager (standalone), then with Voyager in Safari (where it works correctly).

I’ve tried reinstalling Voyager, but no joy. Strange thing is that the issue only presents itself in the (standalone) app, not while using it in Safari (as you can see from the screen recording).

FYI: I’m running iOS 16.6 (but it also happened before on iPadOS 16.5).

Hi,

As my regular instance was experiencing downtime, I decided it might be a good idea to have a backup account on a different instance. So I created a new account on feddit.uk, configured 2FA and all was well. Although…

When I later tried to log on using Voyager, it kept returning a connection error. I tried logging on to the instance directly using the browser: no error, but just lands back on the login page.

Seems like the issue was caused because of the password length (originally 65 characters). Resetting my password and bringing it down to 45 characters resolved the issue. However, directly after the password reset, I was logged in, and my 2FA code wasn't asked?!

For a minute I thought it might be due to cached credentials, but retrying the same scenario in a private window confirmed it. This means that if your e-mail account is compromised, 2FA will no longer protect you.

Another possible issue (just to be clear, in this scenario, your e-mail account is not compromised): if someone is able to access your account (maybe you forgot to log out), they can modify your e-mail address without you being notified, nor do they need to know your password. A verification e-mail will be sent to the new address, and they can reset your password using the approach described above. The new e-mail address does not need to be verified to do so (a verification e-mail is sent, but resetting the password works even if you don't verify), and the old e-mail address is not given a heads up of the change (I know, the old address might no longer work, but still).

Not only can your password be reset this way, after gaining entry, 2FA can be disabled without issue.

Am I wrong in thinking the scenarios described above are security issues? Thanks for your feedback!