Closed Bug 469260 Opened 16 years ago Closed 9 years ago

Remove "ask me every time" as an option for cookies

Categories

(Firefox :: Settings UI, defect)

Product:
Firefox
Component:
Settings UI
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 606655

People

(Reporter: faaborg, Unassigned)

References

(Blocks 1 open bug,
URL
)

Details

If you set the preference for third party cookies to "ask me every time" Firefox displays a modal dialog box for every cookie it encounters.  This is bad for a number of reasons:

-It exposes far too much detail about the underlying implementation of the Web

-It forces the user to make a ridiculous number of decisions before visiting a Web site.  For instance, amazon.com produces 8 dialog boxes, and ebay.com 15.

-Even informed users will not always have enough information to make an informed choice.

With the inclusion of private browsing mode in Firefox 3.1, users will now be able to have sessions where no information is collected about them, or they can opt to have private browsing mode enabled all of the time.  Both of these options are easy to use and understand, and a lot better than trying to micromanage a sequence of 15 modal dialog boxes.

I believe we should move this feature to an extension, and remove it from the core product.

I know we can't really remove features without an outcry from the small percentage of users who rely on them.  This is of course why extensions exist, and the importance of providing an efficient and understandable UI to mainstream users.
Wouldn't it not be enough to rename the current pref to be sure that current users who enabled this "feature" aren't stuck with an enabled pref and after that remove the UI option for it ?
Just to clarify, the option to not accept cookies (without "ask me every time")
would still be there?
Personally I would agree, but wouldn't this make a lot of users angry? I have seen really advanced users having enabled this feature.
Maybe the first step would be to remove it from the options window?
Those same people are also angry because they have to answer lots of different dialog boxes before they can access the website. They seem to assume that there should be only 1 prompt per website, not per cookie (or all prompts merged together somehow).
(In reply to comment #4)
> They seem to assume that there should be only 1 prompt per website, not
> per cookie

I'll admit I haven't checked, but as I understand it, in Firefox 2 it could be one request host (because the first prompt for each host could be used to answer all the later ones). Having a prompt for each cookie request only started happening in Firefox 3 (as in bug 434971).
comment #3
>wouldn't this make a lot of users angry?

Yes, which is how we ended up with such a good extension infrastructure in Firefox.  It seems unwise to block a change purely on the existence of more than 0 angry users.  This would effectively freeze our ability to alter the product in ways that are logical when looking at the user population as a whole.

comment #4
>all prompts merged together somehow

comment #5
>Having a prompt for each cookie request only
>started happening in Firefox 3 (as in bug 434971)

Redesigning the UI and fixing the underlying bugs would of course both address the issue that this the UI currently really unusable.  However, any time spent on that would probably be more effectively spent on features that are perhaps hundreds of thousands of times more likely to be used.
Johnath: this fits into the privacy part of security, what is your opinion on allowing modal dialog cookie micromanagement?
(In reply to comment #6)
> comment #3
> >wouldn't this make a lot of users angry?
> 
> Yes, which is how we ended up with such a good extension infrastructure in
> Firefox.

I wished it were true but it isn't. For some of the browser features taken out or altered in the last 3 years I found replacements, some even better, some not as good. For some of the lost features I never found replacements even in spite of all the time I spent to hunt for extensions. They were just degradations and they still are in some cases.
Mass moving of all Firefox::General private browsing bugs to Firefox::Private Browsing.
Component: General → Private Browsing
QA Contact: general → private.browsing
Err, don't think this belongs in Private Browsing, moving it to Preferences.
Component: Private Browsing → Preferences
QA Contact: private.browsing → preferences
(In reply to comment #6)
> >wouldn't this make a lot of users angry?
> 
> Yes, which is how we ended up with such a good extension infrastructure in
> Firefox.  It seems unwise to block a change purely on the existence of more
> than 0 angry users.  This would effectively freeze our ability to alter the
> product in ways that are logical when looking at the user population as a
> whole.

(In reply to comment #7)
> Johnath: this fits into the privacy part of security, what is your opinion on
> allowing modal dialog cookie micromanagement?

Tell me how you really feel!

Yes, it's great that we have a strong extension infrastructure (whether it could be stronger or not), and yes cookies are a notoriously annoying one to deal with since people have some curious ideas about them, but I also really don't like screwing with something that a number of users value, that aligns with our values of user choice and privacy, without a good reason.

It seems like the good reason here is preference complexity, which is a thing that I understand, and I might even add code complexity to the pile as well. That gets to be weighed against the disenfranchising of users who don't discover the addon, or who find that the addon stops being maintained after a few versions, or who browse for a while on the new version before realizing that the feature's missing (a habitual user with a good whitelist isn't seeing prompts every time for trusted sites). Those users, as a result, are going to feel that we've hurt their ability to control their personal information online.

In either case, I don't think it's appropriate for this question to be settled in bug comments with comparatively little visibility, nor do I think we should do it without some good, early beta exposure.  My advice would be to post to d.a.f with the rationale and get broader community input.
i agree with faaborg here that something should be done about the archaic UI we have for this feature, though removing it entirely is something i'd be reluctant to do. i've written up some ideas on how to improve the situation, more fitting with the concept of sandboxing that private browsing uses, here - https://wiki.mozilla.org/Cookies:prompting_ui. (i posted this to m.d.a.f in august, but there wasn't any discussion.)

of course, it remains to be seen whether something like that can be implemented without technical problems, and with reasonable developer time, given the probably small number of users that actually care about it. i agree with johnath that a post to m.d.a.f (with a suitably provocative title) to gauge user and developer interest in this feature is a good idea. i'm also happy to talk about ways to improve it.
>I don't think it's appropriate for this question to be settled
>in bug comments with comparatively little visibility, nor do I think we should
>do it without some good, early beta exposure.  My advice would be to post to
>d.a.f with the rationale and get broader community input.

yep, I agree.  I mostly wanted to get the bug on record so that we would remember that this remains a pretty messy UI issue at the moment.
Blocks: 467536
For the record, private browsing mode is 
not a suitable substitute for cookie-ask.

I want to remember/search/share my history, 
but I don't want half the sites out there to 
relay-track me/swap lists/build a profile/de-anon/
sell my whole uninteresting history/spam me even more
and I don't know who did what.

To the question of how many use "ask", 
I ask how many would use it if it never resulted in 
dataloss/restarts/40 questions/call friend for help/miss lunch? 
Maybe many would switch to Firefox just for the privacy.

The fact that some of us use it in spite of the misery it causes
suggests an undefeatable demand for _selective_ privacy.

I would prefer a small infobar I can  usually just ignore ( based on
 https://wiki.mozilla.org/Cookies:prompting_ui
from comment #12)
especially the default to NO cookies - UNLESS and UNTIL I click OK.
We need prefs to default an OK to all-this-site-only, session-only.

It needs radio buttons for all-session, all-permanent, all-phantom, or ask,
and check boxes for  all-3rd-party and all-subdomains

Picking the ask radio button would open the list of all cookies, giving:
https://wiki.mozilla.org/images/e/ed/UI_mockup.png

(Session-only per-cookie checkboxes and 
Delete boxes for cookies I have would be icing on the cake/add-on.)

I like their No pause, no delay -
 if I DO ever click anything, reload the page.

Without an addon, please block this bug on 
bug 427184 replace pop-up cookie prompt dialog with use of information bar
> It seems like the good reason here is preference complexity

A more important reason here is implementation complexity. Over in 748620 comment 3, Matti and bz describe this feature as "unsupported by Gecko".
I have no problem making it harder to find "ask me every time", but would object strenuously to removing the functionality altogether.  

Before this was available (Netscape Navigator days) one could download many different cookie managers (I used CookiePal) that provided exactly this capability.  The first time a site tries to store a cookie I want the opportunity to decide whether I will accept persistent cookies or force them to be temporary.
What needs to go is the stacking-synchronous dialog that blocks most of the page until you decide whether to even allow the cookie for the session.

If someone wants to re-implement downgrade-to-session as a dialog, I wouldn't fight that.  (I'd recommend simply setting "downgrade" as your default, though, especially if you frequently visit new sites.)
Depends on: 427184
No longer depends on: 427184
Does the "third party cookies" preference mentioned in comment #0 still exist? I can't find it in my preferences, particularly not with the other cookie settings on the Privacy Tab (Firefox 20, Linux).

Gerv
"Ask me every time" is one of the options in the "Keep until" dropdown.  I don't think it was ever limited to third-party cookies.
Ah, right. You first have to select "Use custom settings for history" in order to see it.  

"Clear History when nightly closes" is a checkbox, disassociated from the other "Remember my history" checkbox. "Clear cookies when Nightly closes" is one option in a dropdown, grouped below the "Accept cookies" checkbox. That should be fixed too.

Gerv
Depends on: 1119183
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
No longer depends on: 1119183
(In reply to Alex Faaborg [:faaborg] (Firefox UX) from comment #0)

> -It exposes far too much detail about the underlying implementation of the
> Web

I need to know about the "underlying implementation of the Web."

> 
> -It forces the user to make a ridiculous number of decisions before visiting
> a Web site.  For instance, amazon.com produces 8 dialog boxes, and ebay.com
> 15.

It's my decision whether the number of decisions are ridiculous. I'm the one visiting the site, not you. You're not my mother.

> 
> -Even informed users will not always have enough information to make an
> informed choice.

That's why why we have Google.

> 
> With the inclusion of private browsing mode in Firefox 3.1, users will now
> be able to have sessions where no information is collected about them, or
> they can opt to have private browsing mode enabled all of the time.  Both of
> these options are easy to use and understand, and a lot better than trying
> to micromanage a sequence of 15 modal dialog boxes.

I want to control which sites put cookies on my computer. The sites that I need to log into obviously need to put cookies on my computer. Other sites don't need to put cookies on my computer and I want to block them. I don't want to block all cookies or permit all cookies.

> I believe we should move this feature to an extension, and remove it from the core product.

Which extension is that? There is no extension. So, I guess I need to downgrade to an older version of Firefox, or possibly use a different browser.

Every day, your browser gets worse. Every day, you screw something up in your never-ending quest to be more like Google Chrome. If I wanted to use Google Chrome, I would have just downloaded Chrome instead of a poor knock off like Firefox 48.
(In reply to Gervase Markham [:gerv] from comment #20)
> Ah, right. You first have to select "Use custom settings for history" in
> order to see it.  
> 
> "Clear History when nightly closes" is a checkbox, disassociated from the
> other "Remember my history" checkbox. "Clear cookies when Nightly closes" is
> one option in a dropdown, grouped below the "Accept cookies" checkbox. That
> should be fixed too.
> 
> Gerv

It's gone completely, now.
What turbo_benar said, to the letter.

"Ask me every time" was optional - those who found it annoying never had to use it.

My only complaint about was that the occasional time the prompts from a page where overwhelming, there was no way to simply close the page and its prompts with it - you had to answer every one before continuing. While that was annoying, I still prefer it to not having the function at all. In the worst cases, I simply force-closed Firefox and unchecked that page from the restore session window.

Removing this control because it wasn't perfect is very much throwing the baby out with the bathwater, and for me it's a dealbreaker. I want to accept (first and third party) cookies that are necessary to my use of a site, and deny all others. I want to do this easily, with a prompt that appears each time a cookie permission is requested. No available add-on replaces this functionality.

I discovered its removal when updating to the latest ESR, and immediately went back to 38. I have since installed Pale Moon, and will continue to use FF38(ESR) while I test Pale Moon and bring it up to speed with preferences, add-ons, site settings, etc. If by then there is an add-on that will allow me to update to the latest Firefox ESR, I may continue with both. Otherwise, I will be saying good-bye to Firefox forever. 

I would say that I will miss Firefox, but from what I've seen so far, switching to Pale Moon will be like having the old Firefox back - the one that I dumped IE for a long time ago because of the customization and user control it offered, but has been steadily deprecating for some time now.

One size does not fit all. There will always be alternatives that understand this. Too bad Mozilla is no longer among them.
Ditto on turbo_benar and Legacy2000 comments and tone.  I find this:

> -It exposes far too much detail about the underlying implementation of the Web

To be exceptionally egregious.  As if it wasn't obvious enough when the default for 3rd party cookies default to always instead of never.  Once again the savvy user is betrayed.

I'm done with y'all.  This has wasted half of my day.
You need to log in before you can comment on or make changes to this bug.