From 553c395cff65f492b0c3c5483f875ca5d980ef9f Mon Sep 17 00:00:00 2001 From: Krzysztof kuhy Rudnicki Date: Mon, 10 Aug 2026 19:54:50 +0200 Subject: [PATCH] inFakt is SMS-only 2FA, so the wipe cannot strand the account This was the last blocker on the Device Owner decision. Checked in the web panel: "Aplikacja weryfikacyjna" is unconfigured, so no TOTP seed exists for a wipe to destroy, and only "Wrazliwe" actions are gated -- "Logowanie" is unchecked, so plain login needs the password alone. The registered SMS number lives on the SIM, which survives. The browser-login approval tap is a Firebase push prompt (FirebaseInstanceIdReceiver on the device). Push tokens are per-install, so a reinstall re-registers; and if that ever misbehaved, SMS is still the fallback. Corrects the wipe checklist, which assumed TOTP secrets were "likely" inside the KeePassDX database and treated the .kdbx as a seed backup. Neither holds: the canonical .kdbx is on the PC, and there are no seeds. Earlier advice in this session to fetch inFakt backup codes was likewise for the OTP-app variant this account does not use. What still does not survive is unchanged and unrelated to 2FA: the banking pairing ("Usun powiazanie z telefonem") and the local app PIN, re-paired via SMS like mBank. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01JxNrcMDcizNB3XrrYpZF23 --- docs/device-owner-wipe-checklist.md | 16 ++++-- .../infakt-2fa-wipe-safety-2026-08-09.json | 39 ++++++++++++++ .../docs/youtube-block-unrooted.md | 52 +++++++++++++------ 3 files changed, 89 insertions(+), 18 deletions(-) create mode 100644 docs/superpowers/evidence/infakt-2fa-wipe-safety-2026-08-09.json diff --git a/docs/device-owner-wipe-checklist.md b/docs/device-owner-wipe-checklist.md index 46039928..2a7313b8 100644 --- a/docs/device-owner-wipe-checklist.md +++ b/docs/device-owner-wipe-checklist.md @@ -46,9 +46,19 @@ Present and relevant: | mObywatel | `pl.nask.mobywatel` | No — full re-activation | **No dedicated TOTP app is installed**, so the usual "authenticator seeds are -destroyed by the wipe" trap does not apply — unless your TOTP secrets live -inside the KeePassDX database, which is likely. If so, the `.kdbx` file _is_ -your seed backup, and step 2 covers it. +destroyed by the wipe" trap does not apply. + +Checked 2026-08-09, and it does not apply via KeePassDX either: the `.kdbx` +lives in KeePassDX's private storage (not on `/sdcard`, so `phone_backup.sh` +cannot reach it), but the canonical copy is on the PC. And **inFakt — the one +account whose loss would have blocked this wipe — is SMS-only 2FA**: +"Aplikacja weryfikacyjna" is unconfigured, so no seed exists to lose, and +_Logowanie_ is not among the 2FA-gated actions. See +`phone_focus_mode/docs/youtube-block-unrooted.md`. + +`pl.infakt.infakt` belongs in the table above: the account is server-side and +survives, but its **banking pairing does not** — re-pair via SMS, same as +mBank. ## Phase A — break the circular dependency first diff --git a/docs/superpowers/evidence/infakt-2fa-wipe-safety-2026-08-09.json b/docs/superpowers/evidence/infakt-2fa-wipe-safety-2026-08-09.json new file mode 100644 index 00000000..e92c49c1 --- /dev/null +++ b/docs/superpowers/evidence/infakt-2fa-wipe-safety-2026-08-09.json @@ -0,0 +1,39 @@ +{ + "intent": "Settle whether a Device Owner factory reset would lock the user out of inFakt, which was the last blocker on that decision.", + "scope": [ + "phone_focus_mode/docs/youtube-block-unrooted.md", + "docs/device-owner-wipe-checklist.md", + "Documentation only -- no code, no device state changed" + ], + "changes": [ + "Recorded that inFakt 2FA is SMS-only and that no TOTP seed exists, so a wipe cannot destroy one.", + "Corrected the wipe checklist, which assumed TOTP secrets were 'likely' inside the KeePassDX database and treated the .kdbx as a seed backup. Neither holds: the user keeps the canonical .kdbx on the PC, and inFakt has no authenticator configured.", + "Added pl.infakt.infakt to the set of apps whose banking pairing does not survive the wipe." + ], + "verification": [ + { + "command": "inFakt web panel, Weryfikacja dwuetapowa (screenshot supplied by the user)", + "result": "pass", + "evidence": "2FA = Wlaczona with SMS to the registered number. 'Aplikacja weryfikacyjna' shows a 'Skonfiguruj' link, i.e. NOT configured -- no TOTP seed. Under 'Akcje objete weryfikacja dwuetapowa' only 'Wrazliwe' is checked; 'Logowanie' and 'Wystawianie faktur' are unchecked, so plain login needs the password alone." + }, + { + "command": "adb shell dumpsys package pl.infakt.infakt | grep -i c2dm/firebase", + "result": "pass", + "evidence": "FirebaseInstanceIdReceiver registered for com.google.android.c2dm.intent.RECEIVE, so the browser-login approval tap is a push prompt. Push tokens are per-install, so a reinstall re-registers rather than stranding the account." + }, + { + "command": "adb shell dumpsys account | grep -i infakt", + "result": "pass", + "evidence": "No device account entry -- nothing stored locally that a wipe would destroy beyond the pairing and app PIN." + } + ], + "risks": [ + "The push-reinstall behaviour is inferred from the Firebase receiver plus vendor docs, not from a stated 'reinstalling does not lock you out'. It is safe to act on because the second factor is SMS and the SIM survives -- if push re-registration misbehaved, SMS still works.", + "Earlier in this session the user was advised to download inFakt backup codes. That advice applies to the extended OTP-app variant, which this account does not use; with SMS-only 2FA the recovery path is the SIM. Corrected rather than left standing.", + "The 2FA settings page warns that saving changes logs out all current mobile sessions, so it should not be edited casually.", + "Still unresolved and unchanged: inFakt's banking side is device-paired and holds a live session with funds and an active card. Re-pairing after a wipe goes through SMS." + ], + "rollback": [ + "git revert -- documentation only, nothing on the device depends on it." + ] +} diff --git a/phone_focus_mode/docs/youtube-block-unrooted.md b/phone_focus_mode/docs/youtube-block-unrooted.md index af05192b..a8645ad8 100644 --- a/phone_focus_mode/docs/youtube-block-unrooted.md +++ b/phone_focus_mode/docs/youtube-block-unrooted.md @@ -8,12 +8,12 @@ No root, no Device Owner, no factory reset. Unregisters a package for one user while leaving the APK on the read-only system image. -| Mechanism | Survives reboot? | -| --- | --- | -| `pm suspend` | No — measured | -| `pm disable-user` | No — measured | -| `dpm setApplicationHidden` | Yes — but needs Device Owner, i.e. a wipe | -| **`pm uninstall --user 0`** | **Yes — measured, twice** | +| Mechanism | Survives reboot? | +| --------------------------- | ----------------------------------------- | +| `pm suspend` | No — measured | +| `pm disable-user` | No — measured | +| `dpm setApplicationHidden` | Yes — but needs Device Owner, i.e. a wipe | +| **`pm uninstall --user 0`** | **Yes — measured, twice** | Reversible with `pm install-existing --user 0 `: no download, no data loss, because the APK never left the device. @@ -44,9 +44,9 @@ silent no-op. Independent of the VPN, and that is the point: stopping RethinkDNS does **not** restore YouTube in Firefox. Verified by force-stopping -`com.celzero.bravedns` and loading youtube.com, which produced *"uBlock +`com.celzero.bravedns` and loading youtube.com, which produced _"uBlock Origin has prevented the following page from loading — `||youtube.com^` — -found in: My filters"*. +found in: My filters"_. The filters, in uBlock's dashboard → **My filters**: @@ -100,11 +100,11 @@ account-linked session — most of the pull. It does not stop typing Previously rejected approaches, from `focus_owner/docs/`: -- **Home-hosted DoT resolver.** Android's Private DNS fails *closed*, so PC +- **Home-hosted DoT resolver.** Android's Private DNS fails _closed_, so PC off = phone has no internet at all. Rejected: the phone must work with the PC off. - **Hosted DNS (NextDNS, AdGuard, ControlD).** No provider ingests the 185k - domain blocklist; free tiers fail *open* past ~300k queries/month. + domain blocklist; free tiers fail _open_ past ~300k queries/month. The remaining candidate is a **local-VPN content blocker** — an on-device `VpnService` that filters without any network dependency, so it works with the @@ -116,11 +116,11 @@ one active VPN at a time, so this would conflict with any real VPN. Measured, not assumed: -| Layer | Undo cost | -| --- | --- | -| App removal | **One tap.** Google Play shows a live **Install** button for YouTube (checked on device 2026-08-09; not installed). | -| RethinkDNS rules | A few taps — the VPN toggle in Settings or the quick-settings tile. | -| uBlock filters | **Proceed** on the block page, or disabling the extension. | +| Layer | Undo cost | +| ---------------- | ------------------------------------------------------------------------------------------------------------------- | +| App removal | **One tap.** Google Play shows a live **Install** button for YouTube (checked on device 2026-08-09; not installed). | +| RethinkDNS rules | A few taps — the VPN toggle in Settings or the quick-settings tile. | +| uBlock filters | **Proceed** on the block page, or disabling the extension. | Nothing here is tamper-resistant, and nothing here can be: on an unrooted device without Device Owner, no app can prevent the user @@ -138,6 +138,28 @@ Also note nothing re-asserts the purge automatically. `phone-auto-sync.timer` is inactive and its `ExecStart` points at a path that does not exist, so `distraction_purge.sh` is manual today. +## infakt, before any factory reset + +Checked 2026-08-09 in the web panel and on the device, because infakt was +the one app whose loss would have blocked the Device Owner wipe. + +- **2FA is SMS-only.** "Aplikacja weryfikacyjna" reads _Skonfiguruj_, i.e. + not configured, so **no TOTP seed exists** and a wipe cannot destroy + one. The registered number survives on the SIM. +- **"Logowanie" is unchecked** under _Akcje objęte weryfikacją_ — only + _Wrażliwe_ actions prompt. Plain login needs the password alone. +- The app uses Firebase push (`FirebaseInstanceIdReceiver`) for the + browser-login approval tap. Push tokens are per-install, so a reinstall + re-registers and prompts arrive at the new install. + +So login is safe: reinstall, sign in with the password. + +What does **not** survive: the banking pairing (_Usuń powiązanie z +telefonem_) and the local app PIN. Re-pair via SMS after the wipe. + +Do not save anything on that settings page casually — it warns that +changing it logs out all current mobile sessions. + ## Redoing this after a factory reset The purge is per-user state and does not survive a wipe. Re-run