Blockstack Mobile Browser Camera Bug

[0xpbj]

When recovering an existing ID, if the user chooses to use the QR code flow, the following error comes up:

[markmhendrickson]

I believe we built this QR code feature only to decide to no longer support it. So we may be able to simply remove it. @jeffdomke Is that indeed the case?

I'm adding this to our current epic for ensuring that Blockstack works across systems and browsers, so we'll get to this ASAP.

[0xpbj]

thanks @markmhx, that would help us a ton to get the new app released to fix the gaia bug.

[markmhendrickson]

@prabhaav We certainly want to unblock you here ASAP. @hstove Is there a quick fix we can get in place for Stealthy (perhaps by detecting user agents for web views like this?) that can resolve their app store need even if we need more time deciding on whether to keep QR codes in general?

[markmhendrickson]

Also @shreyasthiagaraj any ideas from your end on how we or they might resolve this with iOS code as a hotfix at least?

[0xpbj]

This isn't in our iOS code, this is the Blockstack Auth that comes up before the user is even able to use the app.

[markmhendrickson]

@prabhaav Yea understood, just pinging him in case he has a creative solution given the web view context. But I imagine this will be something we resolve in the browser code.

[hstove]

When I go to reproduce this, it asks me for permission to use the camera, and I click 'Accept'. Then it works as normal. If you click 'Deny', it shows this error message. Is that not your behavior?

[0xpbj]

That question never comes up for me on mobile Safari

[hstove]

You may have denied it previously. Go to Settings -> Safari -> Allow Camera & Microphone to see if it's denied

[0xpbj]

This is a bug report filed by Apple app review team

[hstove]

Yeah, I get that. So, it sounds like the only thing we could improve here is the error message? Unless there really is a bug here, but I wasn't able to reproduce it.

[0xpbj]

I have those settings enabled and I still see the same error

[shreyasthiagaraj]

Yea, once the browser is open I don’t think we have any control from iOS code. Sounds like it would be a web fix...

…

On Mon, Jan 14, 2019 at 7:21 PM Hank Stoever ***@***.***> wrote: When I go to reproduce this, it asks me for permission to use the camera, and I click 'Accept'. Then it works as normal. If you click 'Deny', it shows this error message. Is that not your behavior? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1790 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AIfsVzAqxCKyoZE46jlk4XSP1hGAA2jnks5vDNjOgaJpZM4Z_Vnd> .

[stackatron]

Yeah, it never worked in Safari far as I recall. It's been like that for several releases, I assume the Apple team just happened to flag it this time? Or was there some change in behavior? @prabhaav can you share the exact wording of the Apple issue, just to make we actually solve it?

[0xpbj]

That was the issue they identified with the No video input devices found

[stackatron]

Seems like we should hide the button and entire feature in Safari. @hstove assigning to you.

[hstove]

@prabhaav has this ever worked in stealthy? I’m wondering if you have to update your plist file to support the permission dialogue

[0xpbj]

@hstove never tried it. This is outside of Stealthy in the Blockstack browser.

[yknl]

This feature never worked on native iOS apps. The browser window that pops up for auth in native apps is Apple’s SFAuthenticationSession. It’s not a normal safari window and does not have access to any video input devices. So it’s really an iOS limitation. The Blockstack iOS SDK passes a URL parameter to the browser to indicate that it’s authenticating via SFAuthenticationSession. But the browser is not currently handling that correctly to hide the QR code button.

Relevant issue: #1620 (comment)

[shreyasthiagaraj]

Ah, right. We pass in `client: ios_secure` to indicate the special browser window. I think for the latest version of iOS we may be able to avoid using `SFAuthenticationSession`, so perhaps I could do something on SDK side to avoid this. But for certain versions of iOS (I think iOS 11?) this cannot be avoided. It'll need to be fixed on the browser side then to hide the button.

…

On Tue, Jan 15, 2019 at 8:02 AM yknl ***@***.***> wrote: This feature never worked on native iOS apps. The browser window that pops up for auth in native apps is Apple’s SFAuthenticationSession. It’s not a normal safari window and does not have access to any video input devices. So it’s really an iOS limitation. The Blockstack iOS SDK passes a URL parameter to the browser to indicate that it’s authenticating via SFAuthenticationSession. But the browser is not currently handling that correctly to hide the QR code button. Relevant issue: #1620 (comment) <#1620 (comment)> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1790 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AIfsV4BvM6B_6xn_3YVP6l5m1TyKJHplks5vDYsogaJpZM4Z_Vnd> .

[0xpbj]

FYI @hstove , I found an issue with the fix. It didn't block us from getting into the app store, but this issue might come up again. See attached video:
scannerBug.mov.zip

[hstove]

Good catch. @shreyasthiagaraj is there anything we can do to permanently mark that this is from a native app? Like a cookie or injected JS. That way we won't have to pass around this parameter all the time, which is fickle.