1983681 - UA String fingerprinting: [Snap] Firefox 141.0.3 Ubuntu 24.04 iCloud fails password entry

Status: RESOLVED WORKSFORME

(Core :: Widget: Gtk, defect, P3)

Description

[Bruce MacAlister]

Attachment: Screenshot from 2025-08-16 15-53-03.png

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:141.0) Gecko/20100101 Firefox/141.0

Steps to reproduce:

Started Firefox, invoked icloud.com, got login screen, entered username and password.

Actual results:

Got window with "failed to identify your identity," see the image attached.

Expected results:

Successful log on.
It works on Folkan on Ubuntu and Firefox on Windows 10, same computer.

Comment 1

[Bruce MacAlister]

Got window with "failed to verify your identity," see the image attached.

Comment 2

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Widget: Gtk' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[Martin Stránský [:stransky] (ni? me)]

Please try plain Mozilla binaries:
https://fedoraproject.org/wiki/How_to_debug_Firefox_problems#Testing_Mozilla_binaries
Thanks.

Comment 4

[Bruce MacAlister]

So far I cannot get the Firefox download to actually download. It claims to download but it is not stored on my computer. I'll look for a workaround may with the terminal.

Comment 5

[centers.rotunda0n]

Did you manage to test it through the binaries?

I'm encountering the same problem for versions 142.0-1 (stable), 143.0b-1 (beta) and 144.0a1 (edge) from the Ubuntu Snap Store. I checked upon login, the apple server returns "503 Service Temporarily Unavailable" error. The issue persists in Safe/Troubleshoot mode (with extensions, etc. disabled).

Comment 6

[Bruce MacAlister]

I used https://fedoraproject.org/wiki/How_to_debug_Firefox_problems#Testing_Mozilla_binaries as Martin suggested. iCloud login worked where it did not on the originally installed copy of Firefox. The irony is that both are the same versions. Both are 142.0 (64bit). Using HELP>ABOUT I took screen shots. They are not quite identical. There does not seem to be a way to attach screen shots to show you. The copy that does not work with iCloud shows "Snap for Ubuntu." The version that will allow a login to iCloud does not.

Is Snap the problem? I depend on Ubuntu updates to Firefox that gets lots of security updates so I would need another way to install and keep it up to date.

Comment 7

[centers.rotunda0n]

Thanks for the update. I also managed to get it working by running firefox from the compressed firefox-142.0.tar.xz format (downloaded from https://www.firefox.com/en-US/thanks/), iCloud login worked there as well (similarly version 142.0 64-bit).

So that leaves us I guess with only the Snap version being the problematic one.. I also would like to keep using that, now I wonder if there's a way to contact the maintainers of the Snap package specifically?!

Comment 8

[Bruce MacAlister]

Let us see what Maretin [e-mail] has to say about it. In the process of dealing with this I found another very impressive browser I'd not known about, Falkon, https://falkon.org. I will use it more and, if it performs as well as Firefox, I might switch to it.

Comment 9

[Bruce MacAlister]

Is any further action anticipated? I think this is not good for Firefox. We would need to find an alternative browser.

Comment 10

[Martin Stránský [:stransky] (ni? me)]

So it's Snap issue and not Firefox itself. You can try to install Firefox from PPA as deb package, AFAIK Mozilla provides debian Firefox package too.
But there is a problem with profile transfer, Snap one is located at different location:
https://askubuntu.com/questions/1399383/how-to-install-firefox-as-a-traditional-deb-package-without-snap-in-ubuntu-22
Adding to Snap tracker.

Comment 11

[Martin Stránský [:stransky] (ni? me)]

NI Alexandre who works on snap.

Comment 12

[:gerard-majax]

(In reply to centers.rotunda0n from comment #5)

Did you manage to test it through the binaries?

I'm encountering the same problem for versions 142.0-1 (stable), 143.0b-1 (beta) and 144.0a1 (edge) from the Ubuntu Snap Store. I checked upon login, the apple server returns "503 Service Temporarily Unavailable" error. The issue persists in Safe/Troubleshoot mode (with extensions, etc. disabled).

If the server returns 503 could this be an instance of fingerprinting going bad because of snap packaging? So we may not be a known good enough browser for any appliance protecting iCloud auth and rejects us?

Do you confirm you see HTTP/503 rejection in the devtools console?

Comment 13

[:gerard-majax]

(In reply to Martin Stránský [:stransky] (ni? me) from comment #11)

NI Alexandre who works on snap.

not anymore, hence forwarding to Thinker and Nathan

Comment 14

[Nathan Teodosio :nteodosio]

Taking the error message 503 at its face value, this is first and foremost a bug for Apple.

Please send a report to https://support.apple.com/contact with a link to this page.

Comment 15

[:gerard-majax]

(In reply to Nathan Teodosio :nteodosio from comment #14)

Taking the error message 503 at its face value, this is first and foremost a bug for Apple.

Please send a report to https://support.apple.com/contact with a link to this page.

If it reproduces constantly on Snap and not on Non-snap, it's unclear but we may be facing a fingerprinting issue. I dont have an iCloud account so I cannot test.

Comment 16

[Nathan Teodosio :nteodosio]

Also, if the issue is fingerprinting maybe using private mode or a clean profile could help you there. As far as I understand, such sessions would be different enough (cookies, canvas etc.) to be possible to be identified as a "valid" client, whatever the server may think that is.

Comment 17

[Nathan Teodosio :nteodosio]

If it reproduces constantly on Snap and not on Non-snap, it's unclear but we may be facing a fingerprinting issue.

Which is why he should contact Apple.

Comment 18

[centers.rotunda0n]

I tried in private windows, troubleshoot mode as well, and the issue persists. The website first asks for an email address, after entering it and pressing on the next arrow button the password is requested. However, the Error 503 comes first right after entering the email address, regardless if it's an existing one or not. So testing the bug is possible without a valid iCloud account.

I don't think I can post screenshots in here, but I tried for existing/dummy addresses in both the Snap version and the 64-bit binaries of Firefox 142. Upon entering the email address, in the Snap version I received 503 as response from the server, meanwhile in the binaries it was 200 and everything was OK & functioning.

(The returned error can also be seen in the Dev Console as Uncaught (in promise) Object { jqXHR: {…}, textStatus: "error", errorThrown: "Service Temporarily Unavailable", isRequestError: true })

Comment 19

[:gerard-majax]

Behavior reproduces for me as well with those details ... One think interesting is that even though my system is french locale, and my snap is as well, icloud page shows in english in the snap instance while it shows in french on my nightly (french and tarball)

Comment 20

[:gerard-majax]

Can you try switching user agent? The Snap one is customized a bit with the Ubuntu string in it, and switching to a standard linux firefox 140 agent works for me

Comment 21

[:gerard-majax]

Even Mozilla/5.0 (X11; Linux x86_64; rv:144.0a1) Gecko/20100101 Firefox/144.0a1 it works. Default from the snap is Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0

Comment 22

[centers.rotunda0n]

(In reply to :gerard-majax from comment #21)

Even Mozilla/5.0 (X11; Linux x86_64; rv:144.0a1) Gecko/20100101 Firefox/144.0a1 it works. Default from the snap is Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0

It works for me as well with Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0. Thank you very much!

Comment 23

[Jan Brasna [:janbrasna]]

Attachment: Ubuntu-spoofed-UAstring (Screenshot 2025-09-03 at 14.44.22.png)

Comment 24

[Jan Brasna [:janbrasna]]

I just used the Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0 user agent in Safari and Chromium and the error reproduces right away in these browsers too. So it's really triggered just by the "Ubuntu" bit presence.

Comment 25

[Daniel Holbert [:dholbert]]

Hi karlcow - would you mind forwarding this to folks at Apple who work on the icloud authentication page? Apparently it rejects logins (due to a rejected 503-error-code network request) if your UA string contains the word "Ubuntu;" in the parenthesized section, as the Firefox snap on Ubuntu happens to do. (This happens in all browsers if you spoof that UA string, per comment 24.)

Comment 26

[Karl Dubost💡 :karlcow]

Hi Daniel,
Thanks a lot. And sorry for this bad UA sniffing.
Let's hope we can get it resolved by the iCloud team.
This is now tracked at Apple by rdar://159814682

Comment 27

[Daniel Holbert [:dholbert]]

Thank you, Karl!

Comment 28

[Karl Dubost💡 :karlcow]

Btw this seems to be a duplicate of https://bugzilla.mozilla.org/show_bug.cgi?id=1984386
https://github.com/webcompat/web-bugs/issues/168971

Comment 31

[Bruce MacAlister]

As a reminder, early in this report I found iCloud login works flawlessly with the Falkon browser:
Application version 25.08.0 (c439270ea)
QtWebEngine version 6.9.1
© 2010-2018 David Rosca
https://falkon.org
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) QtWebEngine/6.9.1 Chrome/130.0.0.0 Safari/537.36

It works also with the version of Firefox downloaded with https://bugzilla.mozilla.org/show_bug.cgi.

Comment 32

[Jan Brasna [:janbrasna]]

According to this bug’s webcompat report it appears as fixed on Apple side.

Will wait for QA to confirm before closing — or if reporter no longer reproduces, happy to resolve. (I can not reproduce any longer spoofing using the STR outlined above.)