Closed Bug 403961 Opened 17 years ago Closed 6 years ago

Add history/visit info to the main Larry dialog

Categories

(Firefox :: General, enhancement)

enhancement
Not set
normal

Tracking

()

RESOLVED WONTFIX

People

(Reporter: deb, Assigned: johnath)

Details

(Keywords: sec-want, Whiteboard: [sg:want][WIP Patch][needs new patch])

Attachments

(1 file, 2 obsolete files)

Currently the Larry dialog is a bit dry and cold, while the secondary information panel (that you get when you click "Tell me more about this web site...") has much friendlier and more approachable information.  I think it would be nice to have that friendlier info in the main dialog, so when you click Larry he tells you helpful things like:

* You have visited this web site 34 times before
* This web site is storing cookies on your computer (view cookies)
* You have 1 saved password for this web site (view password)

From the user's perspective I think this is much more useful information than "foobar.com has been validated by X-Ramp Security Services" since users probably won't have any idea who X-Ramp Security Services are.
Severity: normal → enhancement
OS: Mac OS X → All
Hardware: PC → All
Being post-string-freeze, I'm sort of sad to say that this probably won't make FF3, but I'm assigning it to myself anyhow, so that I am more likely to see and fix it in the future.
Assignee: nobody → johnath
Hmm, isn't the primary goal of this panel to help the user decide a
"level of trust" for the site?  If so, I think it needs to be as short as
possible and only contain information that serves that goal.
Adding various statistics here could be distracting or even misleading.

> "foobar.com has been validated by X-Ramp Security Services" since users
> probably won't have any idea who X-Ramp Security Services are.

Isn't that exactly what we intended to communicate?
I wonder if people will stop and think about that line if there is other
information that is easier to understand but less relevant.
(In reply to comment #2)
> Hmm, isn't the primary goal of this panel to help the user decide a
> "level of trust" for the site?  If so, I think it needs to be as short as
> possible and only contain information that serves that goal.
> Adding various statistics here could be distracting or even misleading.

I'm not sure I agree here, but I hear what you're saying.  It is definitely true that we don't want to mislead people, and that is a risk.  Showing visit count may be misleading on an http site, for example: if an attacker has altered or replaced the content then the idea that you've "been here 149 times before" could breed false confidence.  I imagine that is the type of thing you're concerned with?

But on an HTTPS site, that information is a supplementary cue as to whether you are where you think you are.  We want our information to be understandable absolutely, and overwhelming the user will hurt that goal, but beyond that observation I don't think "terse" is an end in itself.  If we only showed visit count on verified sites, for instance, I think we could mitigate some of the deception concerns while still making for richer identity feedback.

Anecdotally, I keep hearing from people who love having that count available in the page info dialog.  It's the kind of information that people, being the navel-gazers we are, tend to gravitate to.  If we can give that feeling of personal-ness and delight in the browser without undermining security messaging, I'm okay with the added line.  I agree with you though, that this should be case-by-case, with a bias against clutter.
Attached patch WIP (obsolete) — Splinter Review
This would be better if it had styling for platforms other than Mac.

Adds the "You have visited this site" language in the popup (with proper pluralization) as well as a menu item to "Forget all my visits to <hostname>", to help expose that functionality, and act as the thin edge of the "doorhanger" wedge - making the site button into a central place to manage your agency with the site in question, not just get information ABOUT that site.
Nom'ng this for blocking-3.1 and morphing it a bit (but, I think, maintaining the spirit!)  It may just be wanted-3.1 in the end, but it's on the 3.1 plan and I think an important piece of functionality to do a better job of exposing.  Strictly speaking, we could ship without it of course, but given 3.1's focus on privacy and private data management, I think we'd be unhappy shipping without this.
Flags: blocking-firefox3.1?
Summary: Add friendlier info to the main Larry dialog → Add history/visit info to the main Larry dialog
Whiteboard: [WIP Patch]
Page Info had similar information, but was using the "before today" query unnecessarily, since sdwilsh says sites shouldn't be able to poison the visit count.  This brings them into sync.  Miscellaneous tuning.
Attachment #341333 - Attachment is obsolete: true
mconnor is thinking of wiring this up to shawn's work in bug 460086, asked for an updated WIP patch.
Attachment #341347 - Attachment is obsolete: true
Not blocking release, though it'd be nice to have and looks like we could get it without any strings beyond what we're using in bug 460086.
Flags: blocking-firefox3.1? → blocking-firefox3.1-
Flags: wanted-firefox3.6?
Flags: wanted-firefox3.6?
Whiteboard: [WIP Patch] → [WIP Patch] [needs new patch]
Whiteboard: [WIP Patch] [needs new patch] → [sg:want][WIP Patch][needs new patch]
Larry's dead.  Not sure where this would fit in modern sec/priv design, and no action in a decade means "probably no plan here"  I'd file something new if there's a specific useful ask here.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: