1453427 - Pandora security changes mess up playback.

Status: RESOLVED WORKSFORME

(Core :: General, defect)

Description

[Sami Mikhail]

Attachment: pandoraSecurityIssue.log

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0
Build ID: 20180404171943

Steps to reproduce:

Sign in to Pandora.

(Tried this with and without uBlock Origin 1.15.24 turned on)




Actual results:

First song plays fine. Next Song takes about 10 seconds to load. Next song after that doesn't load. 




Expected results:

playback is normally continuous.

Suspect this is the issue:
Error code: <a id="errorCode" title="MOZILLA_PKIX_ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED">MOZILLA_PKIX_ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED</a>

Comment 1

[Sami Mikhail]

Now getting error popup:
We're having trouble playing audio on this device.
We can't load media right now. This is commonly caused by overzealous ad blockers or privacy extensions. Please check that your browser extensions are not blocking our audio and refresh the page. If you continue to see this error you should contact support.

Haven't found anything helpful in support.

Comment 2

[Sami Mikhail]

Adding a security exception for tuner.pandora.com fixes the issue.

Going to https://tuner.pandora.com I get MOZILLA_PKIX_ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED
Can't view the certificate from there. (Clicking on the "View Certificate" button does nothing.)

Clicking on MOZILLA_PKIX_ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED, I get the contents of tunerPandoraComCerts.txt

Clicking on "Add Exception" in that page I get the fingerprints:
SHA-256 fingerprint: 33:EC:CB:45:42:28:65:99:F3:19:7C:AD:DC:6D:A5:3B:A0:B4:05:3A:4D:DC:65:B4:2D:49:F7:97:5E:FF:74:B3
SHA1 fingerprint: FC:2E:6A:F4:9F:C6:3A:ED:AD:10:78:DC:22:D1:18:5B:80:9E:75:34

Clicking on "View Certificate Status" I can then export -pandoracom.crt.txt

Since this appears to be a Pandora certificate issue, and I found a workaround, probably should ought to close this ticket.

Comment 3

[Sami Mikhail]

Attachment: tunerPandoraComCerts.txt

tuner.pandora.com certificates from security exception page.

Comment 4

[Sami Mikhail]

Attachment: -pandoracom.crt.txt

Pandora certificate exported from "Add Exception" dialog.

Comment 5

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

This is an issue with Symantec-issued certificates. 

See https://blog.mozilla.org/security/2018/03/12/distrust-symantec-tls-certificates/

Ultimately it's for Pandora to fix.