Risa Wolf reported that after doing a fresh install of 1.9.0 #13-15 she was signed in automatically with FirstBook ID AQUQC4YNG0 which she does not recognize.

On the client, we think that this ID came from the phone and was used some time in the distant past to authenticate in OE (before 1.9). OE saves login credentials in the keychain, but our format of keychain item keys has changed when we started using the new SimplyE code base. Therefore, to preserve the user's login state and to clean up the keychain, a migration is run when the 1.9 app is launched for the first time: it reads values from the old keychain keys and writes them in the new keychain keys, and then deletes (or tries to) the old entries.

However, after installing and removing the app several times we observed in Firebase that the old items are still found in the keychain, which means that deletion is somehow failing without reporting an error.

To do:

• We should verify who owns it and if it's just a test account. Help from server engs will be needed here.
• write a unit test or verify that items are indeed removed and why there's no failure being reported
• if we fail there, one workaround would be to just not run the migration. This would be disruptive for users, however.