"Change Your Password to Secure Your Account": the web challenge's
force-set-new-password form. Instagram answers a request with a web challenge
(flow_render_type: 4) whose type is IeForceSetNewPasswordForm, and the app
shows an in-app browser page telling the person to change the password. The
screen keeps the page the person opens — url, the challenge's own page —
because the actual password change is the account's own change-password
effect, not a challenge step.
Reached only as an interruption of a request (OpenChallenge(error)); the
challenge's own classification read the page and the web challenge state
before this screen opened, so its enter sends nothing. It has no back and
is no step of a trail.
Its one action, close(), is navigation only: it closes the
interruption and answers the screen underneath (ChallengeClosed) or, when
the challenge interrupted the launch itself, the session snapshot
(ChallengeClosedBeforeLaunch). No request goes out; the interrupted action
is never retried, and the caller changes the password through the account's
own change-password effect.
Ships with two frames of the old class,
web-set-new-password-step2.jpg and
web-set-new-password-compromised.jpg, taken on a test
account.
Unverified against the app. The Android 451 app's behavior on this step
is not known. Seeing the Android app on this web form would settle the page
and what closing it sends.
"Change Your Password to Secure Your Account": the web challenge's force-set-new-password form. Instagram answers a request with a web challenge (
flow_render_type: 4) whose type isIeForceSetNewPasswordForm, and the app shows an in-app browser page telling the person to change the password. The screen keeps the page the person opens —url, the challenge's own page — because the actual password change is the account's own change-password effect, not a challenge step.Reached only as an interruption of a request (
OpenChallenge(error)); the challenge's own classification read the page and the web challenge state before this screen opened, so itsentersends nothing. It has nobackand is no step of a trail.Its one action,
close(), is navigation only: it closes the interruption and answers the screen underneath (ChallengeClosed) or, when the challenge interrupted the launch itself, the session snapshot (ChallengeClosedBeforeLaunch). No request goes out; the interrupted action is never retried, and the caller changes the password through the account's own change-password effect.Ships with two frames of the old class,
web-set-new-password-step2.jpgandweb-set-new-password-compromised.jpg, taken on a test account.Unverified against the app. The Android 451 app's behavior on this step is not known. Seeing the Android app on this web form would settle the page and what closing it sends.
Guide: Challenges