Open mortie opened 12 months ago
Thanks for this submission. You're right, of course, and we're already working on improving the ToS. It's a time-consuming process because of all the legal issues, and we know we're a bit late. But once we release the updated ToS, your feedback will be included!
Oh, I wasn't aware that you're already working on an updated ToS, that's awesome! I totally understand that these things take time.
This isn't app-specific, but I'm reporting here since there's no repo for the website and the iOS app is where I was asked to accept the ToS (or at least linked to the ToS... there was no requirement to accept it?). This is about the ToS at https://2fas.com/terms-of-service/ as of 2023-09-11.
Clause 11.2 reads:
Where the phrase "2FAS Services" is defined to mean "all products and services that 2FAS currently provides or may provide in the future", including the apps and the browser extension (but apparently not the server side? But I digress).
2FAS is an open source project, the apps are open source and licensed under the GPL. Is it really the intention of 2FAS to prohibit people from modifying the source code? Is it the intention of 2FAS to prohibit people from forking the repos (i.e to "prepare derivative works" of them)?
What does 2FAS consider "reverse engineering"? Everything is in the open. Is reading the source code "reverse engineering"? How about adding debug logs to trace API calls? Prohibiting "reverse engineering" in an open source project which encourages community contributions seems inappropriate, but if you do want to prohibit it, it needs a lot of clarification.
Clause 25.1 reads:
This seems impossible to interpret. I have tried to add parentheses around the various comma-separated lists in the sentence, but I'm unable to find a way to parenthesize it which results in a sentence which makes sense. I also find it weird that it requires me to defend and indemnify all the customers of any future affiliates of 2FAS.
Clause 11.1 reads, in part:
I take tremendous moral issue with this. Illegal does not mean immoral or harmful. Worse, the ToS does not specify which jurisdiction it talks about; is it the one the user is registered in? The one the user currently resides in? The one 2FAS is registered in (Delaware)?
To illustrate the moral issue with this clause: Assuming the applicable jurisdiction is that in which the user lives: Should a user from a US state which has outlawed abortion be considered in breach of the ToS and risk 2FAS closing their account they use 2FAS to authenticate with a service which lets them have an abortion?