When the user tested the Lock feature and then toggled it off, the phone was left with a blank unlock password that could be passed by pressing the "continue" key (no longer works with "preyrocks". When the user wants to change his lock method to his previous one, the system asks for his password, which won't wotk with "preyrocks" and neither accept just pressing "next" and leaving the blank space.
Extra notes that may/may not be of use:
Phone is encrypted (probably doesn't mean anything)
Phone had an 8-digit PIN password prior to using Prey's lock feature
Phone password seems to be set to '' after unlocking with 'preyrocks' or other specified password.
Cannot use '' in security settings password prompt, as it's not seen as a 'valid' password
This same unpassable security prompt is a barrier to factory resetting the phone, so I can neither change my password OR factory reset my phone.
Toggling off the 'lock' feature in-browser does "work", as it sets the password back to "". However, that still ends up running into the issue where the security settings password prompt does not accept an empty string, making the page unpassable and not allowing him to change (or factory reset) the phone.
Problem
When the user tested the Lock feature and then toggled it off, the phone was left with a blank unlock password that could be passed by pressing the "continue" key (no longer works with "preyrocks". When the user wants to change his lock method to his previous one, the system asks for his password, which won't wotk with "preyrocks" and neither accept just pressing "next" and leaving the blank space.
Extra notes that may/may not be of use:
How it was detected.
User feedback.
References
https://secure.helpscout.net/conversation/106154084/25626/
VIDEO SHOWING THE BUG: https://www.youtube.com/watch?v=b9XH9LbGsms&feature=youtu.be