[BUG] App not connecting on Android 4.x devices

[chirag-jn]

Describe the issue
The app isn't signing in when tested on Android 4.x devices. The app supports minimum SDK version Android 4.2 and it failed to work for a 4.x device.

Screenshots

Smartphone (please complete as much of the following information as possible):

• Device: Nexus 4 on Android Emulator
• OS: Android 4.2
• Version 17

Stacktrace

07-28 19:28:25.322 2814-2846/org.amahi.anywhere D/OkHttp: --> POST https://api.amahi.org/api2/oauth/token?grant_type=password http/1.1
07-28 19:28:25.322 2814-2846/org.amahi.anywhere D/OkHttp: Content-Type: application/x-www-form-urlencoded
07-28 19:28:25.322 2814-2846/org.amahi.anywhere D/OkHttp: Content-Length: 193
07-28 19:28:25.322 2814-2846/org.amahi.anywhere D/OkHttp: Accept: application/json
07-28 19:28:25.322 2814-2846/org.amahi.anywhere D/OkHttp: User-Agent: AmahiAnywhere/3.0.0 (Android 4.2.2; Android SDK built for x86) Size/4.7 Resolution/1280x768
07-28 19:28:25.322 2814-2846/org.amahi.anywhere D/OkHttp: client_id=something&client_secret=something&username=something&password=something
07-28 19:28:25.322 2814-2846/org.amahi.anywhere D/OkHttp: --> END POST (193-byte body)
07-28 19:28:25.882 2814-2846/org.amahi.anywhere D/OkHttp: <-- HTTP FAILED: javax.net.ssl.SSLException: Connection closed by peer

Please note that client_id, client_secret, username and password are removed from the above stacktrace for security purposes.

[chirag-jn]

Turns out this issue is a common issue visible on Android 4.x devices and the server is responsible for the same. If TLSv1 is disabled on the server, the app will raise SSLException
https://stackoverflow.com/questions/37006416/sslexception-connection-closed-by-peer-on-android-4-x-versions

[chirag-jn]

The credentials work completely fine on Android 8 though.
Related stacktrace

2020-07-29 01:10:13.749 23076-23552/org.amahi.anywhere D/OkHttp: --> POST https://api.amahi.org/api2/oauth/token?grant_type=password http/1.1
2020-07-29 01:10:13.750 23076-23552/org.amahi.anywhere D/OkHttp: Content-Type: application/x-www-form-urlencoded
2020-07-29 01:10:13.751 23076-23552/org.amahi.anywhere D/OkHttp: Content-Length: 193
2020-07-29 01:10:13.751 23076-23552/org.amahi.anywhere D/OkHttp: Accept: application/json
2020-07-29 01:10:13.751 23076-23552/org.amahi.anywhere D/OkHttp: User-Agent: AmahiAnywhere/3.0.0 (Android 8.1.0; vivo 1807) Size/6.2 Resolution/1520x720
2020-07-29 01:10:13.753 23076-23552/org.amahi.anywhere D/OkHttp: client_id=something&client_secret=something&username=something&password=something
2020-07-29 01:10:13.754 23076-23552/org.amahi.anywhere D/OkHttp: --> END POST (193-byte body)
2020-07-29 01:10:14.479 23076-23090/org.amahi.anywhere I/zygote64: Do partial code cache collection, code=122KB, data=81KB
2020-07-29 01:10:14.480 23076-23090/org.amahi.anywhere I/zygote64: After code cache collection, code=122KB, data=81KB
2020-07-29 01:10:14.480 23076-23090/org.amahi.anywhere I/zygote64: Increasing code cache capacity to 512KB
2020-07-29 01:10:15.633 23076-23552/org.amahi.anywhere D/OkHttp: <-- 200 OK https://api.amahi.org/api2/oauth/token?grant_type=password (1879ms)

[chirag-jn]

Since SSL Handshake isn't reading anything, I guess TLS1 isn't enabled on api.amahi.org

[admin@localhost ~]$ openssl s_client -connect api.amahi.org:443 -tls1
CONNECTED(00000003)
write:errno=0
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 126 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1596013938
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---

[cpg]

Probably -- we use some strengthening tools to tune our TLS settings. However, we have not changed that in a while. We would miss out on about 5% of devices, from a cursory look. Other things like design and such may also be broken in these devices, so perhaps it's not worth the effort to support them in this case?

[chirag-jn]

I wanted to ensure that very fact of broken design in old devices but couldn't go past the login screen. However Android 4.4 counts for 1.8% of the world android usage. We can expect an even lesser number for versions below that. So I guess we can eliminate those versions in favour of security.

Ref: https://gs.statcounter.com/android-version-market-share/mobile-tablet/worldwide

[chirag-jn]

App works fine on Android 5.0 though