►Try spoofing the useragent and see what you get
Good catch. Never occurred to me to try that - assumed they would perform at least some in depth SSL and Cipher Suite sniffing, not just a user-agent check, and UA spoofing has stopped working much the last few years (websites doing JavaScript based browser capability and US sniffing instead)
Passed in Firefox 31 spoofed as FF59
Failed in Firefox 3.6.24 spoofed as FF59
Failed in Firefox 2.0.20 spoofed as FF59
I now suspect they are checking user agent, but also maybe TLS capabilities (that part makes snse because this whole exercise would be about using browsers with TLS 1.1 min or TLS 1.2 min)
Firefox 31 does TLS up to 1.2. Firefox 3.6.24 and 2.0.20 only do TLS 1.0 which is consistent with my results.
Not sure what it means though. Won't know if spoofing works until after 4/30 because unknown whether they are targeting a shift to TLS 1.1 (as Lithium and many other sites have done in the last 6 months) or going whole hog and jumping to TLS 1.2 (which would be bold)
The reason that's potentially a problem is that although the spoofed browser passed this simple test based on user-agent and TLS capability level, that doesn't mean that it will be able to provide the correct ciphers in TLS negotiations when push comes to shove in May. I don't think that is going to be the case, but so far I'm not impressed by their code fu, and have no idea what they are planning. The fact that lesser version browsers pass with spoofed user-agents tells me they are sloppy.
If all this meant that they are making a simple shift from allowing TLS 1.0 fallback (really old browsers like FF2 and 3 and IEs less than 11 etc), to not allowing it and requiring a minimum TLS 1.1 capable SSL browser, they sure screwed it up by listing only latest TLS 1.2 (and in some cases TLS 1.3) capable browsers, instead of just saying that FF30 (first FF that did TLS 1.2) etc.
Actually, I have on more card to play. FF 22-29 were first to do 1.1 but not 1.2, and I have a couple of them installed. If they fail, then that's an indicator that USPS is aiming for TLS1.2 minimum.....
Firefox 25 PASSED when spoofed as FF59. and it is a TLS1.1 only browser.
So it looks like they are making a reasonable shift to TLS 1.1 minimum required, but totally screwed it up, setting the test up to reject anything but the newest couple of each brand of browser by user-agent, listing only the newest couple as acceptable, and shutting out dozens and dozens of other potentially usable TLS 1.1 capable browsers (FF23-27 if turned on. FF28-57, Chrome 22-62, Chrome 64, IE 7-10 if TLS is turned on, and possible others)*
*Depending on how they configure things, some of the above candidates could be off the table because they might not have (all) the ciphers USPS chooses.
Sounds like they tested maybe the 8 newest browsers, locked all the others out via user-agent, and called it a day.
Still doesn't fully explain why Windows 10 Edge browser failed on my phone (and there is no way to fix/spoof out of that one) or why justforposting's Edge on Win 10 Home failed, unless they set that user-agent requirement to only the single newest version of desktop and mobile (for no obvious reason other than laziness)
This is a mess, and I guess it is just going to be a trial and error thing when finally implemented in May. I'll be trying to user-agent spoof FF31 and FF52 into working, and testing every possible browser available on my phone to try to find something that works.
I predict howls of despair here in the forums (not just from me) May 1 unless it turns out that the test is totally screwed up, and the actual rollout will only obsolete a few of the oldest TLS1.0 browsers like Firefox 2, Firefox3, and IE7.
