[pt.sibs.android.mbway] SMS-OTP onboarding broken due to microG's `versionName`
- Dominant language
- Java
- Stars
- 14.6k
- Forks
- 3.2k
- PR merge metrics
- PR metrics pending
Description
**Affected app**
Name: MB WAY
Package id: pt.sibs.android.mbway
**Describe the bug**
Some apps read the **`versionName`** of the installed `com.google.android.gms` package, send it to their backend as a device attribute, and the backend then changes behavior based on it. Because microG reports a `versionName` like `0.3.15.250932` (obviously not a Google Play services version), these backends treat the device as "not real Google Play" and silently degrade.
Such is the case of the app in question, which refused to deliver an SMS OTP while still returning an HTTP `200 OK`.
**To Reproduce**
On a freshly-installed MB WAY app (or after clearing its data):
1. Go through the onboarding steps by entering the phone number associated with the MB WAY account — ensuring the SIM card of said number is inserted (_obviously_).
2. Selecting the option for "I am in the device with " to go through the OTP SMS screen.
3. Get stuck waiting for an SMS that will **never** arrive.
**Expected behavior**
SMS arrives, the app automatically fills the slot (it can't be manually typed in), app finalizes device registration.
**Screenshots**
Not necessary.
**System**
Android Version: 16
Custom ROM: crDroid 12.11
**microG**
microG Core version: 0.3.15.250932
microG Self-Check results: All ticked
**Additional context**
* Hooking the app's networking layer and rewriting only the reported version string in the outgoing request (`0.3.15.250932` → `26.24.34`), leaving everything else identical, caused the backend to immediately send the OTP SMS to the microG device, after which activation completed end-to-end (including subsequent provisioning calls, all `Status: OK`). Reverting the string reproduces the failure.
* I wrote a quick and stupid LSPosed module to get through this, but I'm pretty sure this can be avoided with the right feature/addition in microG. That or I am missing something obvious.
Contributor guide
No contributing guide indexed for this repository
Research direction
No source files or tests are named. Start by tracing how microG reports the installed com.google.android.gms package's versionName and how that value reaches outgoing app requests; compare the normal and rewritten values described in the report. Done means MB WAY receives its SMS OTP and completes registration without request rewriting.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, java, kotlin
- Domain
- authentication, mobile-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100