T-Mobile Blocks Firefox in Private Mode | Hacker News Reader

T-Mobile Blocks Firefox in Private Mode

t-mobile.com

9 pointsinetknght10 comments

> Firefox is no longer supported in private mode

> The Firefox browser is no longer supported in private mode on our site. TO continue, please take Firefox out of private mode or choose another browser. We recommend Chrome, Safari or Edge.

This has been going on for several months now (since at least October 2022). I got nowhere via their telephone support. I opened a complaint to the FCC because I couldn't pay my bill online and they charge $10 to pay via phone. The FCC complaint went nowhere: T-Mobile's Executive Team got feedback from their engineers stating that it's a "technical limitation" with regards to how Firefox stores security tokens... whatever that means.

I'm flabbergasted that they claim such a thing without backing it up. What problem does Firefox have with security tokens in Private Mode?

You need to understand that the average programmer (at least the ones I run into) are of a sort they can't be bothered to trace beyond immediate dependencies to figure out what is actually going on in the grand scheme of things. Somebody runs into "Firefox token says no", tells a management type, management type runs with it, it becomes policy, boom done. Onto the next feature.

Or you don't and you do keep researching, and in doing so get noticed for having made little positive progress (as you're weeding out what isn't the issue) and dinged on that.

No one wants to read anyone else's code, and those of us that do are penalized for it.

It's honestly not a surprise at all to me.

There's a good chance this isn't malicious, and their website simply depends on something like localstorage that isn't available in firefox private windows.

IMO, if a website can detect a difference between private browsing mode and just being the first website visited on a new computer, that should be considered a security bug in the browser.

https://fingerprint.com/blog/incognito-mode-detection/

Fingerprintjs is a tracking company, so if you have adblockers, it might not allow you to visit the link. But this is the other side of the story.

That's just a list of ways to exploit said vulnerabilities, not an argument that they're not vulnerabilities.

Recent discussion: https://news.ycombinator.com/item?id=33269391

They likely rely on a localStorage which isn't available in private mode.

Why doesn't Firefox allow localStorage, and just delete it when you leave the site?

I’m curious to know the answer here as well. I’m not a Firefox user, but given how common it is for sites to use localstorage, this is a really surprising design decision.

Reply on news.ycombinator.com