2005066 - Firefox iOS getting "Untrusted app" scary warning on Amazon

Status: NEW

(Web Compatibility :: Site Reports, defect, P2)

Description

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Warning

Trying to log into Amazon(.ca) on my iPhone in Firefox gets me this scary warning.

Comment 1

[Matthew Gaudet (he/him) [:mgaudet]]

Interesting to note: I -do not- get the warning in private browsing mode.

Comment 2

[Jan Brasna [:janbrasna]]

Also randomly reported from DDG or Orion:

• https://discuss.privacyguides.net/t/strange-amazon-alert-using-duckduckgo-ios-app/19601
• https://www.amazonforum.com/s/question/0D5Kf00003WD4fwKAD/untrusted-app
• https://orionfeedback.org/d/12508-orion-ios-an-untrusted-app-is-trying-to-access-your-amazon-account

Comment 3

[Jan Brasna [:janbrasna]]

I'm not sure bugbot got the platform:android right for this iOS report.

FWIW, this has also been seen on .com and .co.uk from other reports online apparently.

Comment 4

[Jeff Muizelaar [:jrmuizel]]

Jan, could we add a debug option for spoofing Safari in iOS? That would help to test if this is UA sniffing.

Comment 5

[Jan Brasna [:janbrasna]]

I'm not sure if this is (just?) uasniffing as it's happy in PBM at the same time — they seemingly add some previous session/device knowledge to the mix here, so it could be interesting to do the opposite — use desktop browser in multitouch media simulation with FxiOS uastring and introspect the site storage, and/or keep changing the uastrings between logins to see what triggers the dialog, if anything.

(I wanted to try e.g. iOS 18 vs. 26 et al. to see any difference, but Amazon served me quite different templates across OSes, so there was not much in common to base this on.)

Reporter can also turn on "desktop site" mode in FxiOS menu to see how things fare with a non-Firefox user agent (albeit desktop one, though).

---

Given FxiOS can currently only target eTLD+1 with uastring tweaks and not supporting any patterns, URLs, path substrings etc. shipping a patch in tree changing the user agent here would mean targeting all amazon.* domains around the globe, enumerating them one by one, and targeting each and every page and single request for every user for this… could mean breaking more than fixing.

(If there are more granular targeting needs expected in the future, and it's not already scoped in the remote-settings—based approach, it might be prudent liaising with mobile PMs about putting such enablement and refactor scope in their backlog to prioritize at some point.)

For the debug menu, I've raised https://github.com/mozilla-mobile/firefox-ios/issues/31315 — I certainly see the utility and would use it myself a lot, maybe I'll start looking into adding it in some spare time…

Comment 6

[Jeff Muizelaar [:jrmuizel]]

Amazon let us know that they're working on this.