1789789 - Firefox not supported on t-mobile.com in Private mode

Status: NEW

(Firefox :: Private Browsing, defect, P3)

Description

[Calin Tanase]

Attachment: FF private not supp.png

Environment:
Operating system: Windows 10
Firefox version: Nightly 106.0a1 (2022-09-07)

Preconditions:
• Private window opened

Steps to reproduce:

1. Go to https://www.t-mobile.com/signin
2. Observe the behaviour.

Expected Behaviour:
The page is supported in private mode.

Actual Behaviour:
The page is not supported in private mode.

Notes:

1. Screenshot provided
2. Reproducible regardless of the ETP status
3. Reproducible on Firefox Release
4. Not reproducible on Chrome incognito mode

Comment 1

[Tim Huang[:timhuang]]

This is not a tracking protection issue. It looks to me that the t-mobile page runs a feature detection script to figure out if it's in a private window to show the unsupported page.

Comment 2

[Walter K.]

People say that using Hide Private Mode extension fixes t-mobile site. That extension fakes existence of IndexDB APIs in Private Browsing Mode.

Comment 3

[Thomas Wisniewski [:twisniewski]]

This seems to be the check:

  function Og(a) {
    try {
      window.localStorage ? (window.localStorage.setItem('qmtest', '1'), window.localStorage.removeItem('qmtest')) : Mg(a)
    } catch (c) {
      Mg(a)
    }
    try {
      var b = a.pe.bind(a);
      if (window.webkitRequestFileSystem) webkitRequestFileSystem(0, 0, function () {
      }, b);
       else if ('MozAppearance' in document.documentElement.style) window.indexedDB.open('test').onerror = function (c) {
        a.pe();
        c.preventDefault()
      };
       else if (/constructor/i.test(window.HTMLElement) || window.safari) try {
        0 < window.localStorage.length && (window.localStorage.setItem('qmtest', '1'), window.localStorage.removeItem('qmtest')),
        window.openDatabase('', '', '', 0)
      } catch (c) {
        a.pe()
      } else window.indexedDB || !window.PointerEvent && !window.MSPointerEvent || a.pe()
    } catch (c) {
    }
  }

If they don't actually need indexedDB and are just blocking private browsing mode intentionally then they're likely to update this code if we shim it. So It may be best to reach out and confirm why they're blocking private browsing modes.