1044308 - [UX] Design: consolidate all privacy-impacting preferences in one place

Status: RESOLVED WONTFIX

(Firefox :: Settings UI, defect)

Description

[[:mmc] Monica Chew (no longer reading bugmail)]

Some users want to turn off all Firefox integration with external services. It's possible to do that now, but not that intuitive. E.g., the Safe Browsing prefs under Preferences > Security, the geolocation pref (only exposed in about:config under geo.enabled), search suggestions (click dropdown in search bar, checkbox for "Show Search Suggestions"), FHR/Telemetry/Crash Reporting (under Advanced > Data Choices).

Compare that the Chrome, where all service integrations (geolocation, Safe Browsing, suggestions, spelling corrections, etc.) are grouped under Advanced > Privacy.

We should make it easy for users to opt-out.

Comment 1

[Jennifer Morrow [:Boriss] (UX)]

This would be great to do, perhaps in about:preferences privacy, where there's enough available screen space.

Comment 2

[Javaun Moradi [:javaun]]

This is a really good idea. Boriss,  is this something we could do as part of in content preferences?

Comment 3

[Dão Gottwald [:dao]]

(In reply to [:mmc] Monica Chew (please use needinfo) from comment #0)
> It's possible to do that now, but not that intuitive. E.g., the Safe
> Browsing prefs under Preferences > Security,

Yet this is a security feature. Should it be duplicated under Privacy?

> the geolocation pref (only exposed in about:config under geo.enabled),

This has no privacy impact, because each geolocation request needs to be approved by the user. I'm not even sure why this hidden pref still exists.

Comment 4

[Justin Dolske [:Dolske]]

(In reply to Dão Gottwald [:dao] from comment #3)
 
> This has no privacy impact, because each geolocation request needs to be
> approved by the user. I'm not even sure why this hidden pref still exists.

It's a grey area -- arguably having a pref is valuable for an audience that never ever wants to share their physical location due to privacy concerns. I think the same argument could be made for audio/video sharing. Historically we've considered these audiences small enough that we didn't expose visible UI (and even discouraged hidden prefs), with the newly renewed emphasis on Privacy and Firefox, that thinking may shift a bit for cases like this.

Comment 5

[[:mmc] Monica Chew (no longer reading bugmail)]

(In reply to Dão Gottwald [:dao] from comment #3)
> (In reply to [:mmc] Monica Chew (please use needinfo) from comment #0)
> > It's possible to do that now, but not that intuitive. E.g., the Safe
> > Browsing prefs under Preferences > Security,
> 
> Yet this is a security feature. Should it be duplicated under Privacy?

Duplications are bad for the user, I think.

> > the geolocation pref (only exposed in about:config under geo.enabled),
> 
> This has no privacy impact, because each geolocation request needs to be
> approved by the user. I'm not even sure why this hidden pref still exists.

Dialog boxes are not a panacea. They can be attack on the user. Software like http://www.ptfbpro.com/ wouldn't exist otherwise.

Comment 6

[Benjamin Smedberg]

As part of this redesign, I need us to integrate the healthreport and telemetry prefs which are currently checkboxes, so that it's something like a radio set:

* No reporting
* Send Firefox Health Report support data
* Send additional Telemetry

Comment 7

[(Currently slow to respond) Philipp Sackl [:phlsa] (Firefox UX) please use needinfo]

We need to rethink the premise of this bug.
I spent some time exploring various options to consolidate all privacy impacting preferences in one place and I'm now pretty convinced that this wouldn't be the best way forward.

The problems with consolidating preferences:
- A very very large privacy section
- The redundancy problem that Dão already mentioned.
- Some options (like data choices) really shouldn't be at the top level

We should think about the use cases here. I can see a couple of them:
- Someone wants to go completely incognito and not send anything to anyone. This has negative impact on both convenience and security, so it shouldn't be too trivial to do – possibly to the point of this being distributed through an add-on and not an option.
- We as Mozilla want to educate users about options that have privacy impact.

Also, there's really two different kinds of options here:
- Options that have impact on your privacy while actually being about something else. These are also the ones that are hard to categorize.
- Options that are privacy-specific (e.g. Tracking Protection)

So there are a couple of paths forward here that range from not doing anything to reconsidering the entire IA of the Firefox preferences.
Monica, you and I should chat today to figure out the way forward here.

Comment 8

[(Currently slow to respond) Philipp Sackl [:phlsa] (Firefox UX) please use needinfo]

We pivoted on this. The follow up work is tracked in bug 1073995.