search

xou816 / spot

Native Spotify client for the GNOME desktop
MIT License
2.31k stars 126 forks source link

Password reset by Spotify, and logged out of devices, after suspicious activity #732

Open bryce-carson opened 4 days ago

bryce-carson commented 4 days ago

I used this Flatpak today and was unable to log in, depsite using the correct username and password.

Hours later I was logged out of a browser session of the official Spotify web client and Spotify forced me to reset my password.

There could be a chain of custody issue and the Flatpak or this repository could be compromised.

ondras12345 commented 4 days ago

I think the Spotify detector for "suspicious activity" is just too sensitive. I no longer actively use Spot, but I had the same issue with mopidy-spotify: see e.g. https://github.com/mopidy/mopidy-spotify/issues/394#issuecomment-2363648572 I cannot say for sure, but I'd be surprised if the flatpak build was actually compromised.

xou816 commented 3 days ago

Id be surprised too, but Ill have a look at the sources for the latest release, I havent participated in its release

I guess Spotify is trying to phase out password login for its products, and projects such as spot/librespot/etc are affected (password login has been working hit or miss for the last few weeks/months). they probably have stoppedusing password auth on official products, and what remains is flagged as suspcious -- even before that, spot users would often mention receiving a warning email from spotify

anyway, the good news is that thanks to @stevenleadbeater 's last MR we will use oauth for auth so there shouldnt be any more issues! next release should be good

bryce-carson commented 3 days ago

Id be surprised too, but Ill have a look at the sources for the latest release, I havent participated in its release

I guess Spotify is trying to phase out password login for its products, and projects such as spot/librespot/etc are affected (password login has been working hit or miss for the last few weeks/months). they probably have stoppedusing password auth on official products, and what remains is flagged as suspcious -- even before that, spot users would often mention receiving a warning email from spotify

anyway, the good news is that thanks to @stevenleadbeater 's last MR we will use oauth for auth so there shouldnt be any more issues! next release should be good

Great, sounds good! I've enjoyed using Spot in the past so I was concerned. Spot is a lovely alternative to the bloat of the official application or the Flatpakked form thereof.