Just Let Me Write Digits

Digital identities and what they mean for the web have become a hot topic of discussion in the last few years. They have also brought many controversies: age verification laws and what they mean for online anonymity, Wikipedia potentially having to verify the identify of its users in the UK, the reliance on official iOS and Android operating systems as mandatory form factors for digital identity wallets, not to mention what these inter-dependencies mean when your US digital accounts are cancelled for being a judge at the International Criminal Court.

数字身份及其对互联网的意义在过去几年中已成为热门话题。它们也引发了许多争议：年龄验证法律及其对在线匿名性的影响、维基百科可能需要在英国验证其用户身份、依赖官方 iOS 和 Android 操作系统作为数字身份钱包的强制性载体，更不用说当你的美国数字账户因为你是国际刑事法院法官而被注销时，这些相互依赖关系意味着什么。

My story is about the Swiss governmental login system AGOV. Deployed since 2024, it now counts 1.6 million accounts and it is increasingly becoming the login mechanism to benefit from unemployment insurance, file taxes (a mandatory activity!), and many other interactions. In the canton of Zurich, this is the only entry point to apply for citizenship. So I eventually had to create an AGOV account. Unfortunately, registering an account proved to be a real challenge, until I got the bottom of a weird accessibility bug. Inspired by Just Let Me Select Text, it’s my turn to present you Just Let Me Write Digits.

我的故事是关于瑞士政府的登录系统 AGOV。该系统自 2024 年部署以来，目前已拥有 160 万个账户，并正日益成为享受失业保险、报税（一项强制性活动！）以及进行许多其他交互的登录机制。在苏黎世州，这是申请公民身份的唯一入口。因此，我最终不得不创建一个 AGOV 账户。不幸的是，注册账户成了一个真正的挑战，直到我查明了一个奇怪的无障碍访问漏洞。受《Just Let Me Select Text》一文的启发，现在轮到我向大家展示《Just Let Me Write Digits》了。

AGOV registration

AGOV 注册

The first step of the AGOV registration process is to provide your email address and enter a verification code to validate the address. My problem was that I couldn’t even enter this code! To set the context, the form to enter the verification code is split into 6 boxes (one per digit). The first weird thing was that every time I typed a digit, the focus wouldn’t automatically jump to the next box. Instead, the current box would accumulate more digits and highlight them in red, indicating an error.

AGOV 注册过程的第一步是提供电子邮件地址并输入验证码以验证该地址。我的问题是，我甚至无法输入这个验证码！简单说明一下，输入验证码的表单被分成了 6 个框（每个框填一位数字）。第一个奇怪的地方是，每当我输入一个数字时，焦点不会自动跳转到下一个框。相反，当前的框会累积更多的数字，并以红色高亮显示，提示错误。

At first, I thought that this was just a minor UI bug, and that I could manually jump to the next box after each digit. However, this didn’t work and the page would always display a “field required” error at the end, even when I carefully filled one digit per box. Strange. I tried looking at the DOM in the developer tools to see if there was a form value I could manually adjust, but nothing obvious stood out. No error message was logged either in the web console.

起初，我以为这只是一个小 UI 错误，我可以手动在每个数字后跳转到下一个框。然而，这并不奏效，即使我小心翼翼地在每个框中填入一个数字，页面最后总是显示“必填字段”错误。真奇怪。我尝试查看开发者工具中的 DOM，看看是否有我可以手动调整的表单值，但没有发现任何明显的问题。网页控制台中也没有记录任何错误信息。

Using a different email address, or even a fake one like test@example.com didn’t make any difference. Given that I was browsing the web with Firefox on Linux, I thought that maybe this combination was unsupported or failing a CAPTCHA. This would be unlikely – I barely encounter any website broken specifically on Firefox or Linux these days – but not impossible. Indeed, the registration page connects to eu-api.friendlycaptcha.eu just before the verification code form appears. And the official AGOV documentation only mentions Windows and macOS as supported operating systems, even though a different page about security keys states that Linux and Firefox are supported.

使用不同的电子邮件地址，甚至是像 test@example.com 这样的虚假地址，都没有任何区别。考虑到我是在 Linux 上使用 Firefox 浏览网页，我以为可能是这种组合不受支持，或者验证码（CAPTCHA）出了问题。这不太可能——如今我几乎没遇到过专门在 Firefox 或 Linux 上无法使用的网站——但并非不可能。事实上，注册页面在验证码表单出现之前确实连接到了 eu-api.friendlycaptcha.eu。而且，尽管关于安全密钥的另一个页面声明支持 Linux 和 Firefox，但 AGOV 的官方文档仅提到 Windows 和 macOS 为受支持的操作系统。

To rule this out, I ended up trying 6 combinations of browsers and operating systems: Firefox, Chromium and Chrome on Linux; Firefox, Safari and Chrome on macOS. All of them showed the same error!

为了排除这些可能性，我最终尝试了 6 种浏览器和操作系统的组合：Linux 上的 Firefox、Chromium 和 Chrome；macOS 上的 Firefox、Safari 和 Chrome。它们全都显示相同的错误！

Contacting support?

联系客服？

At this point I thought it’d make sense to contact the official support. The AGOV website has many help sections, but unfortunately, this didn’t lead me very far because the only way to contact support is via a web form… that starts by sending a verification code to your email! The exact same form I couldn’t pass. And yes, the FAQ explicitly mentions that this form is the only way to contact support (emphasis mine).

此时，我认为联系官方客服是有意义的。AGOV 网站有很多帮助板块，但不幸的是，这并没有让我走多远，因为联系客服的唯一方式是通过一个网页表单……而该表单的第一步就是向你的邮箱发送验证码！这正是那个我无法通过的表单。是的，常见问题解答（FAQ）明确提到该表单是联系客服的唯一途径（重点是我加的）。

Support for participating authorities is provided by second-level support during office hours exclusively through the creation of tickets online. The impressum also lists the physical postal address of the Swiss Federal Chancellery, who are likely not the ones directly developing the website anyway. There are no other contact details: no email, no phone number. Alternatively, one can in principle write a comment to “share feedback on AGOV: praise, criticism, requests”, but that again requires an AGOV or equivalent account to log in. A true chicken and egg problem!

参与机构的支持由二级支持部门在办公时间内专门通过在线创建工单的方式提供。网站的版权页（Impressum）还列出了瑞士联邦办公厅的实体邮寄地址，他们很可能并不是直接开发该网站的人。没有其他联系方式：没有电子邮件，没有电话号码。或者，原则上可以写评论来“分享对 AGOV 的反馈：表扬、批评、请求”，但这同样需要登录 AGOV 或同等账户。这真是一个典型的“先有鸡还是先有蛋”的问题！

I also looked at the online reviews of the AGOV Access Android app, which is currently rated 1.4 stars – by far the worst of any app I’m using. Unfortunately, nobody mentioned an issue similar to mine on these Google Play store comments. Interestingly, there were many comments about support for GrapheneOS (a private and secure mobile OS derived from Android) and the official FAQ now even has an entry about it (emphasis mine)!

我还查看了 AGOV Access Android 应用程序的在线评论，它目前的评分为 1.4 星——是我使用过的所有应用程序中最差的一个。不幸的是，在这些 Google Play 商店的评论中，没有人提到过类似我的问题。有趣的是，有很多关于支持 GrapheneOS（一种源自 Android 的私密且安全的移动操作系统）的评论，官方 FAQ 现在甚至有关于它的条目（重点是我加的）！

The AGOV access App does not work on GrapheneOS because the hardening framework, which protects the AGOV access App against unauthorized manipulation, is not compatible with GrapheneOS. The Federal Chancellery has tasked the supplier with ensuring compatibility. It sounds promising, but for now you can only register/login with a second-factor device that’s either a smartphone with vanilla iOS or Android, or a security key (good that it’s an option!). Of course, after you pass email verification.

AGOV Access App 在 GrapheneOS 上无法运行，因为保护 AGOV Access App 免受未经授权篡改的加固框架与 GrapheneOS 不兼容。联邦办公厅已委托供应商确保兼容性。这听起来很有希望，但目前你只能使用第二因素设备进行注册/登录，该设备必须是搭载原生 iOS 或 Android 的智能手机，或者是一个安全密钥（好在这是一个选项！）。当然，前提是你得先通过电子邮件验证。

Asking around

四处打听

I wasn’t in a rush to create my AGOV account yet, so I casually mentioned this issue to some friends, but nobody seemed to have encountered this problem. I also thought to ask some colleagues and tried the registration page on my work laptop to make a screenshot to show them evidence. Surprisingly, the form worked this time! The autofill automatically jumped to the next box, and it actually detected that I entered an incorrect code rather than no code at all! This time the error was “Code entered is incorrect”.

我当时并不急于创建 AGOV 账户，所以随口向一些朋友提到了这个问题，但似乎没人遇到过。我还想问问同事，并在我的工作笔记本电脑上尝试了注册页面，以便截图作为证据展示给他们。令人惊讶的是，这次表单竟然正常工作了！自动填充功能自动跳转到了下一个框，并且它确实检测到我输入了错误的代码，而不是没有输入代码！这次的错误提示是“输入的代码不正确”。

But I obviously don’t want to rely on an employer-issued computer for long-term interactions with the government. Even if I managed to register via my work laptop, there was always a risk that I wouldn’t be able to login with my personal laptop. Unfortunately, none of my colleagues had encountered my error… I also tried on a friend’s computer, with the same three browsers on macOS, and all…

但我显然不想在与政府的长期交互中依赖雇主发放的电脑。即使我通过工作笔记本电脑成功注册，也始终存在无法用个人笔记本电脑登录的风险。不幸的是，我的同事中没有人遇到过我的错误……我还尝试在朋友的电脑上使用 macOS 上的相同三种浏览器进行测试，结果所有……