rskildum wrote: Wed Dec 06, 2023 6:45 pm
I do not even think it gets to a point of connecting to the church servers unless the app checks the username before asking for a password.
Unintuitively, it actually does connect after typing the username – not to check if the username exists (for security reasons, it won't tell you that), but to check if the account has a different multi-factor authentication flow other than a password. This is a common pattern (albeit sometimes annoying as a user) on modern sites that have single sign-on or multi-factor authentication – the username and password fields are on different pages, because depending on what you type on the first screen, the next screen isn't necessarily a password screen. Google, for example, does the same.
You can test this by putting your device in airplane mode before pressing Next on the Gospel Library username screen – it will give you an error that there's no internet connection, and it won't let you advance to the password screen.