Steller: Plan and Book Trips app for iOS: Exiting Out of Twitter Authorization Login Freezes App

iOS 17.3.1

Steller: Plan and Book Trips app for iOS (version 11.2.1)

Date: 02/27/2024

Description:

There is an unusual problem with the Steller app and the option to create an account using the Twitter authorization login. 

If the user exits out of the Twitter authorization, the Steller app freezes.

.@StellerStories - there’s an unusual bug with your current (11.2.1) version of the iOS app.

Exiting out of the Twitter auth login seems to freeze the app pic.twitter.com/DFjA9jAnUZ

— Robby Delaware (@RobbyDelaware) February 27, 2024

 

Steps to Reproduce:

1. Download the Steller: Plan and Book Trips app for iOS (for the first time)

2. Launch the app 

3. Scroll through the 3 splash screens and select "Continue"

4. From the Create your account screen, choose the "X" option

5. Advance to the Twitter authorization login (via a Twitter iOS app installed on phone)

6. Cancel out of the "Authorize Steller App to access your account?" Twitter login 

Result: User is returned to an unresponsive Steller app - app appears (?) to be permanently frozen until the user deletes or manually restarts the app 

Expected: The Steller app should not become unresponsive if the user cancels out of the Twitter authorization login page - I do this exact same thing with every app that I find that has a Twitter/X login for account creation and I have never encountered an app that does this

This is easier to show than to describe, so please see the attached screenshots:

Advance through this screen...

Advance through this screen...

Select the "Continue" option...

Select the "X" Twitter login...

Cancel out of the login...

App is unresponsive. 

Lemon8 app - Twitter auth login page's Privacy Policy link opens app to user content

iOS 16.3.1

Lemon8 app for iOS (version 3.9.1)

Date: 03/29/2023

Description:

Here it is: without a doubt, the funniest bug you will ever see involving a Twitter Auth page accessed by an iOS app during account creation. 

In essence, a "privacy policy" link does not take a user to Lemon8's written privacy policy. Instead, the app is somehow redirecting from this link: 

https://www.lemon8-app.com/legal/privacy

To user content inside of the app located at this link:

https://www.lemon8-app.com/sxxte___cxxc/privacy?language=en&mid=7215984217704203269&open_url=c25zc2RrMjY1NzovL2FydGljbGVfZGV0YWlsX3BhZ2U%2FZ3JvdXBfaWQ9NzE3NTIwOTQwNTM3NjM2NTA2MiZhcHBfbGF1bmNoX2J5PVNoYXJlK1BhZ2UrTGluayZtZWRpYV9pZD03MTc0NDIxMDM0NzIwMDM1ODQ1JnBpZD1zaGFyZV9hbCZjYW1wYWluX2lkPWFydGljbGU%3D&region=us&ui_language=en

This literally made me laugh at loud. As someone who has assiduously looked at privacy policy links, I knew had to save this one for posterity. 

Take a look:

On an iPhone that has the Lemon8 app installed, open a mobile browser (to: https://api.twitter.com/oauth/authorize?force_login=false&oauth_token=ytWG6AAAAAABB_8DAAABhy4_QgY) and click on the "privacy policy" link

The app opens up to user content?

Here's a video of what it looks like:

Whacky! I don’t think I’ve ever seen a big this odd with a Twitter auth page link.

Easy way to reproduce:
1. w/Lemon8 app installed open https://t.co/y1FiADKWk0 using mobile browser

2. Select “Privacy Policy” link pic.twitter.com/I14MOdhUSX

— Robby Delaware (@RobbyDelaware) March 29, 2023

Two easy ways to get this to reproduce. The longer way first, the shorter way second:

Steps to Reproduce:

1. (on an iPhone with the Twitter iOS app installed) download and launch Lemon8

2. Enter in an age-appropriate birthday

3. Advance to the Create Account screen 

4. Select the “Continue with Twitter” option 

5. From the “Lemon8” wants to open Twitter” prompt, select “Open”

6. From the “Authorize Lemon8 to access your account?” in-app prompt, select “cancel”

7. User is returned to the Lemon8 app, where an api.twitter.com auto page appears 

8. From the api.twitter.com prompt, select the “Privacy Policy” link

9. Select “Done”

Result: Lemon8 app displays a video labeled “PRIVACY” instead of taking the user to Lemon8’s written privacy policy link after the “privacy policy” link is selected an an api.twitter.com auth login page

Expected: User should always, under all conditions, be taken to a written privacy policy after selecting a “privacy policy” link associated with Lemon8

Shorter Method to Reproduce:

1. Download the Lemon8 app onto an iPHone

2. On that iPhone, open a mobile browser and head to Lemon8’s twitter authorization page (https://api.twitter.com/oauth/authorize?force_login=false&oauth_token=ytWG6AAAAAABB_8DAAABhy4_QgY) 

3. From Lemon8’s twitter auth page, select the “privacy policy” link 

4. Note user is taken back into the Lemon8 app to a video labeled “Privacy”

Result: the “privacy policy” link on Lemon8’s twitter authorization page opens the Lemon8 to a video labeled “PRIVACY” instead of to the written privacy policy 

Expected: the “privacy policy” link on Lemon8’s twitter authorization page should always open to the written privacy policy

Triller: Social Video Platform app for iOS: Privacy Policy and Terms and Conditions links connect to a 404 page

 iOS 13.7

Triller: Social Video Platform app for iOS (version 14.3)

Date: 09/16/20

Description:

Minor issue with the Triller app and their Twitter authorization page. On this page, Triller's Privacy Policy and Terms and Conditions links lead to 404 error messages. 

These both should be working on the Twitter Oauth page.

Steps to Reproduce:

1. Download and launch the Triller app for iOS

2. Select the profile icon in the bottom right

3. Select the red "Sign Up/log in" button

4. Choose the Twitter option 

5. From the Twitter Oauth page, scroll down and click on either "Privacy Policy" and "Terms and Conditions" 

Result: The "Privacy Policy" and "Terms and Conditions" links lead to 404 error messages 

Expected: The "Privacy Policy" and "Terms and Conditions" links on Triller's auth form

Scroll down on this page...

Click on either the "Privacy Policy" or "Terms and Conditions" links...

Error page...