diff options
Diffstat (limited to 'docs/SETTINGS_SPIKE.md')
| -rw-r--r-- | docs/SETTINGS_SPIKE.md | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/docs/SETTINGS_SPIKE.md b/docs/SETTINGS_SPIKE.md index a3e2328..a6eb736 100644 --- a/docs/SETTINGS_SPIKE.md +++ b/docs/SETTINGS_SPIKE.md @@ -69,7 +69,7 @@ Run on 2026-10-21 by the project owner with the Store beta of Settings Spike on | A. Longest single field that arrives complete | 8000 characters, the longest string tested | | A. What happens above that (refused / error / cut to N) | Not tested: no string longer than 8000 was tried | | B. Largest total across the eight fields | 64,000 characters (8 fields of 8000) saved and arrived complete | -| C. Characters that didn't arrive or blocked saving | The phone **refused to save** the `special` string. An `otpauth://` URI with `&`, `?`, `=`, `:` and `@` saved and arrived. Which of `< > \ " { } %`, the accented letters, `€` or the emoji blocks saving is not known yet: see the follow-up below | +| C. Characters that didn't arrive or blocked saving | The phone **refused to save** the `special` string. An `otpauth://` URI with `&`, `?`, `=`, `:` and `@` saved and arrived. The follow-up below split it: only the backslash `\` is refused; every other group and an Aegis export without backslashes save | | D. Status written by the watch visible on the phone (yes/no) | Yes: the phone shows the "seen ... change #N" line and its number goes up | | D. Password field empty after the watch cleared it (yes/no) | Yes | | E. Changes arrive while the app is open (yes/no) | Yes | @@ -83,6 +83,24 @@ Run on 2026-10-21 by the project owner with the Store beta of Settings Spike on The `special` string mixes many characters, so its failure doesn't say which one the phone rejects. The test-string page now has eight short strings, one per character group (`C1` percent, `C2` angle brackets, `C3` backslash, `C4` double quote, `C5` braces, `C6` accented letters and `€`, `C7` emoji, `C8` a JSON fragment), and `aegis-json`, a complete fake unencrypted Aegis export with one entry. Paste each into Text 2 and save; note which ones the phone refuses. Regenerate the page with `python3 spike/settings/test-strings/make_test_strings.py`. +Results (2026-10-27, Android, the same phone and watch as above): + +| String | Characters | Saved and arrived | +| --- | --- | --- | +| C1 | `%` | Yes | +| C2 | `< >` | Yes | +| C3 | `\` | **No: the phone refused to save it** | +| C4 | `"` | Yes | +| C5 | `{ }` | Yes | +| C6 | `ä ö ü ß €` | Yes | +| C7 | emoji | Yes | +| C8 | a JSON fragment | Yes | +| aegis-json | a complete fake unencrypted Aegis export | Yes | + +The backslash alone blocks saving, which explains the `special` string. Aegis JSON can be pasted as long as it contains no `\`, so the import design (README 11) stays as it is: `otpauth://` links and unencrypted Aegis exports. The owner also imported a real Aegis export on the Forerunner 70 the same day. + +Aegis on Android writes JSON with Android's `org.json`, which escapes `/` as `\/`. A `/` appears in entry icons (base64 data and `"image\/png"`) and sometimes in a name or issuer; a `"` in a name is written as `\"`. Such an export is refused by the phone. Workarounds, in the user guide: replace every `\/` with `/` in a text editor (the JSON stays valid), remove the entry icons in Aegis before exporting, or paste `otpauth://` links instead. Test C3 is accepted as a known limitation; no fix is planned. + This decides whether Aegis JSON can be pasted into the import fields at all (it needs `"`, `{`, `}` and sometimes `\`). If the phone refuses those characters, Aegis import goes back to the design table: the fallback is pasting `otpauth://` URIs, which are confirmed to work. ### What the results change |