iOS app authentication needs to be fixed
I've previously noticed that signing out on iOS or changing the password for an account doesn't always actually log you out.
It's easily reproducible.
Unfortunately I forgot about this when changing the password for my main account that my probable future ex-wife had access to. In hindsight I should have deleted the whole account and made a new one. I had changed the password while she was still living with me, and she complained to me that she did not have access to the security cameras anymore. At some point she opened the app up again and regained access, not knowing the new password.
This access is now going to complicate a probable divorce.
Please work to fix this issue so someone doesn't have to deal with something like this again.
It's easily reproducible.
Unfortunately I forgot about this when changing the password for my main account that my probable future ex-wife had access to. In hindsight I should have deleted the whole account and made a new one. I had changed the password while she was still living with me, and she complained to me that she did not have access to the security cameras anymore. At some point she opened the app up again and regained access, not knowing the new password.
This access is now going to complicate a probable divorce.
Please work to fix this issue so someone doesn't have to deal with something like this again.
Comments
-
The authentication in the iOS app has been tested thoroughly, and as far as we can tell there are no problems with it.
If you change the password on the server (i.e. under Preferences > Web in SecuritySpy) this stops the app from being able to access the server, and requires you to enter the new password in the app.
If however you don't change the password on the server, but you simply remove the server instance in the iOS app, if you add the server again to the iOS app, the password will be remembered. This is because the password is stored on the keychain of the iOS device. This is expected behaviour that is in line with Apple's guidance.
If you are able to reproduce any problem that contradicts the above, please provide exact steps to reproduce. However, as far as I can tell, there are no such problems in the current implementation.
