Two-Step Verification - Push for Authorization not working on browser client.

[AncientGeek]

I was testing my login today after seeing some posts about unrecognized login credentials.  I could not replicate their problem, but while I was in there, I decide to turn on Two-Step Verification.  I use two different accounts so I can watch cameras on my iPhone and iPad at the same time without being kicked out (such lovely feature of the Arlo system...one device monitoring at a time).  Anyway...the setup for each of my devices worked fine and I named my primary device for each account and then logged out and cross-logged-in to the accounts on opposite devices.  Each time a push notification went to my primary device and I was able to authorize the addition of the second device and name it. 

I then logged out of both devices and logged back unto them with the normal credentials without a problem.

While I was at it I tried logging in on my MacBook Pro using the web client.  There I entered my credentials as normal and a screen popped up indicating it was trying to send a push notification to my primary device for that account, but the screen displayed tags rather than resolved variables and did not initiate a push notification to my primary device.  I tried both Safari and Firefox browsers with the same results.

(As a side note to this, I also realized I had made a minor mistake in my name for my primary device.  I went back into the app to edit the name I had given to my primary device and discovered that I cannot alter the name I entered when originally prompted to name my primary device.  This seems like needed functionality that is missing.  For now, be careful if you turn on Two-Step Verification.  The name you enter for your device is not easy to alter.  It appears I'd need to delete the device and add it back again.)

[AncientGeek · Accepted solution]

OK.  I appear to have solved my problem.

When I named my primary device I used the obvious (and pretty much always allowed) possessive form of my name followed by my device name.  For my iPad, I also used the screen size to differentiate between my 10.5" iPad Pro and my 11" iPad Pro.

It occurred to me that even though the Arlo software team was happy to allow me to enter those special characters as part of the name when naming the device, they may lack the development rigor to actually document, communicate, enforce and test the legal character values one might enter into those fields and how that range of legal values behaves throughout the entire Arlo system of products.  In short, I deleted my primary device (since Arlo doesn't allow us to EDIT the names of our devices) and  assigned my second device as the primary device ... then I added my original device back WITHOUT the obvious and "extremely likely to be used in the real world" characters of single and double quotes...in the name.  After removing those special characters from my primary device name, I tried again to log in using the web client and it worked just as it should.

Note that I had NO PROBLEM on the iOS mobile app due to the use of the single and double quotes in the primary device name.  I only had this problem on the web client.

So BEWARE!  If you decide to use Two-Step Verification:

1.  Be careful to name your device correctly with no typos the very first time you enter the name.  Fixing errors is a royal pain.

2.  DO NOT USE special characters.  Either a single or double quote (or both, I didn't test both individually) will screw up your ability to add the web client as an authorized device for your account.

ARLO:  I highly recommend you ask the web developers to alter the push notification code to deal with single and double quotes in the name of the primary device.  It is an extremely common and appropriate real world business case for this variable.  People's devices are possessive by nature.  "Fred's iPhone 8". "Sally's 11" iPad Pro" are totally logical and appropriate names which should be anticipated and properly accommodated in the design and implementation of the system.  These should have been the first lines in your test case data flows for the QA teams!  What was tested?  Xyzzy? (Let's see how many people understand my prehistoric reference)