3 months ago
- Author faced a bug in Swiss government login system AGOV where they couldn't enter verification code due to keyboard layout issue.
- The problem was due to the code intercepting key presses and blocking Shift key, which is necessary for typing digits on French AZERTY keyboards.
- Switching to a QWERTY layout allowed registration; the bug affected only AZERTY users but hadn't been noticed despite many French residents in Switzerland.
- AGOV system only validated email and second factor (security key or app), not identity, raising questions about its threat model.
- Post-mortem highlights poor UI design, lack of support channels, and issues with code publication timing as key failures.