Just Let Me Write Digits | Blog | Guillaume Endignoux

Digital identities and what they mean for the web have become a hot topic of discussion in the last few years.<br>They have also brought many controversies: age verification laws and what they mean for online anonymity, Wikipedia potentially having to verify the identify of its users in the UK, the reliance on official iOS and Android operating systems as mandatory form factors for digital identity wallets, not to mention what these inter-dependencies mean when your US digital accounts are cancelled for being a judge at the International Criminal Court.

My story is about the Swiss governmental login system AGOV.<br>Deployed since 2024, it now counts 1.6 million accounts and it is increasingly becoming the login mechanism to benefit from unemployment insurance, file taxes (a mandatory activity!), and many other interactions.<br>In the canton of Zurich, this is the only entry point to apply for citizenship.

So I eventually had to create an AGOV account.<br>Unfortunately, registering an account proved to be a real challenge, until I got the bottom of a weird accessibility bug.<br>Inspired by Just Let Me Select Text, it’s my turn to present you Just Let Me Write Digits.

AGOV registration

Contacting support?

Asking around

Investigating the web page

Conclusion

Post-mortem

AGOV registration

The first step of the AGOV registration process is to provide your email address and enter a verification code to validate the address.<br>My problem was that I couldn’t even enter this code!

To set the context, the form to enter the verification code is split into 6 boxes (one per digit).<br>The first weird thing was that every time I typed a digit, the focus wouldn’t automatically jump to the next box.<br>Instead, the current box would accumulate more digits and highlight them in red, indicating an error.

At first, I thought that this was just a minor UI bug, and that I could manually jump to the next box after each digit.<br>However, this didn’t work and the page would always display a “field required” error at the end, even when I carefully filled one digit per box.<br>Strange.

I tried looking at the DOM in the developer tools to see if there was a form value I could manually adjust, but nothing obvious stood out.<br>No error message was logged either in the web console.<br>Using a different email address, or even a fake one1 like test@example.com didn’t make any difference.

Given that I was browsing the web with Firefox on Linux, I thought that maybe this combination was unsupported or failing a CAPTCHA.<br>This would be unlikely – I barely encounter any website broken specifically on Firefox or Linux these days – but not impossible.<br>Indeed, the registration page connects to eu-api.friendlycaptcha.eu just before the verification code form appears.<br>And the official AGOV documentation only mentions Windows and macOS as supported operating systems, even though a different page about security keys states that Linux and Firefox are supported.

To rule this out, I ended up trying 6 combinations of browsers and operating systems: Firefox, Chromium and Chrome on Linux; Firefox, Safari and Chrome on macOS.<br>All of them showed the same error!

Contacting support?

At this point I thought it’d make sense to contact the official support.<br>The AGOV website has many help sections, but unfortunately, this didn’t lead me very far because the only way to contact support is via a web form… that starts by sending a verification code to your email!<br>The exact same form I couldn’t pass.

And yes, the FAQ explicitly mentions that this form is the only way to contact support (emphasis mine).

Support for participating authorities is provided by second-level support during office hours exclusively through the creation of tickets online .

The impressum also lists the physical postal address of the Swiss Federal Chancellery, who are likely not the ones directly developing the website anyway.<br>There are no other contact details: no email, no phone number.<br>Alternatively, one can in principle write a comment to “share feedback on AGOV: praise, criticism, requests”, but that again requires an AGOV or equivalent account to log in.<br>A true chicken and egg problem!

I also looked at the online reviews of the AGOV Access Android app, which is currently rated 1.4 stars – by far the worst of any app I’m using.<br>Unfortunately, nobody mentioned an issue similar to mine on these Google Play store comments.<br>Interestingly, there were many comments about support for GrapheneOS (a private and secure mobile OS derived from Android) and the official FAQ now even has an entry about it (emphasis mine)!

The AGOV access App does not work on GrapheneOS because the hardening framework, which protects the AGOV access App against unauthorized manipulation, is not compatible with GrapheneOS. The Federal Chancellery has tasked the supplier with ensuring compatibility.

It sounds promising, but for now you can only register/login with a second-factor...