Password reset by Spotify, and logged out of devices, after suspicious activity

[bryce-carson]

I used this Flatpak today and was unable to log in, depsite using the correct username and password.

Hours later I was logged out of a browser session of the official Spotify web client and Spotify forced me to reset my password.

There could be a chain of custody issue and the Flatpak or this repository could be compromised.

[ondras12345]

I think the Spotify detector for "suspicious activity" is just too sensitive.
I no longer actively use Spot, but I had the same issue with mopidy-spotify: see e.g. mopidy/mopidy-spotify#394 (comment)
I cannot say for sure, but I'd be surprised if the flatpak build was actually compromised.

[xou816]

Id be surprised too, but Ill have a look at the sources for the latest release, I havent participated in its release

I guess Spotify is trying to phase out password login for its products, and projects such as spot/librespot/etc are affected (password login has been working hit or miss for the last few weeks/months). they probably have stoppedusing password auth on official products, and what remains is flagged as suspcious -- even before that, spot users would often mention receiving a warning email from spotify

anyway, the good news is that thanks to @stevenleadbeater 's last MR we will use oauth for auth so there shouldnt be any more issues! next release should be good

[bryce-carson]

Id be surprised too, but Ill have a look at the sources for the latest release, I havent participated in its release

I guess Spotify is trying to phase out password login for its products, and projects such as spot/librespot/etc are affected (password login has been working hit or miss for the last few weeks/months). they probably have stoppedusing password auth on official products, and what remains is flagged as suspcious -- even before that, spot users would often mention receiving a warning email from spotify

anyway, the good news is that thanks to @stevenleadbeater 's last MR we will use oauth for auth so there shouldnt be any more issues! next release should be good

Great, sounds good! I've enjoyed using Spot in the past so I was concerned. Spot is a lovely alternative to the bloat of the official application or the Flatpakked form thereof.