1080969 - [PP] Add warnings to Privacy panel app to make sure users are aware of limitations of geolocation accuracy

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia, defect)

Description

[Paul Theriault [:pauljt] (no longer reading bugmail)]

We need to add warnings to the privacy panel app to educate users about the limitations of the geolocation accuracy feature. We need to make it clear that this feature gives users control over the location that you browser provides to websites, but that there are many other channels which disclose a user's location (IP, locale etc)

Comment 1

[marta]

Attachment: Flow chart and separate screens that communicate the threats to the users.

Our proposition to communication issue. Note Changes in screens ALA-2 and GT-3

Comment 2

[Paul Theriault [:pauljt] (no longer reading bugmail)]

ALA-2: That's OK, but it would be better if it was a bit stronger. (maybe with an ! icon similar to the warnings in firefox around privacy mode). If nothing else I would suggest something like:

"WARNING: Location Adjustment influences the GPS coordinates only. Apps can still determine your location via your network IP address or other information. " 

As for the guided tour, I don't think the minor sentence addition goes far enough. Actually GT-2 directly contradicts GT-3 on this. (one says hide your location completely, one says you can't hide you location completely). At a minimum i would move the new sentence to GT-2, and remove the "hide it completely" that is there currently. 

I also assume we will evolve the messages in the guided tour though as the feature evolves and we figure out how this merges with production. (if we have a privacy tour, it would make sense to me to cover ALL privacy features of FxOS, not just the ones being added at the moment). But making the tour more comprehensive doesn't need to block this app landing only in the /dev_apps folder I think.

So r+ with the changes above, for the purpose of landing this as an experimental app only.

Comment 3

[Martin Thomson [:mt:]]

(In reply to Paul Theriault [:pauljt] from comment #2)
> "WARNING: Location Adjustment influences the GPS coordinates only. Apps can
> still determine your location via your network IP address or other
> information. " 

Please don't fixate on GPS. Let's ensure that this is properly generic. gps is just one method we use to determine where you are. See my suggestion in the other bug... (bugzilla mobile fail, sorry)

Comment 4

[Wilfred Mathanaraj [:WDM]]

Current warning text is considered too harsh and should be modified to make the message softer and would propose we go with the following text:

How to set Location accuracy? 

Not each app needs your exact location to work properly. Instead of sharing your exact coordinates, you can choose to effectively blur your location to e.g. 50 miles around you. This way, your weather app will still work, but you are not disclosing your exact address. Remember: Location Accuracy will not completely hide you!


I am NI Martin Kurze so he can provide more feedback on why this message and provide confirmation of the message.

Comment 5

[Paul Theriault [:pauljt] (no longer reading bugmail)]

(In reply to Wilfred Mathanaraj [:WDM] from comment #4)
> Current warning text is considered too harsh and should be modified to make
> the message softer and would propose we go with the following text:
> 
> How to set Location accuracy? 
> 
> Not each app needs your exact location to work properly. Instead of sharing
> your exact coordinates, you can choose to effectively blur your location to
> e.g. 50 miles around you. This way, your weather app will still work, but
> you are not disclosing your exact address. Remember: Location Accuracy will
> not completely hide you!
> 
> 
> I am NI Martin Kurze so he can provide more feedback on why this message and
> provide confirmation of the message.

I think you are confusing the tour with the warning here. But I'm happy to hear suggestions. Honestly, I could live  with the warning that Marta proposed in the spec attached above, though Martin T suggested that we don't mention GPS since technically its not just GPS. 

The most important thing, is that we don't say things like:

"...your weather app will still work, but you are not disclosing your exact address."

That is incorrect since your location IS disclosed, via your IP address etc. Giving a user a false sense of security is worse than not having this feature at all.

Maybe UX has a suggestion here?

Comment 6

[Wilfred Mathanaraj [:WDM]]

So for ALA2 the text is acceptable and Martin T (Mozilla) suggested removing the word "GPS" - if we from Mozilla have a better phrase we want to provide to consider perhaps Mike Tsai or Martin T can provide it here. If we are  happy to accept the above spec message for the first release then we should probably look at fixing these messages at a later stage.

For GT2/GT3 can we first confirm if we have implemented as per attached spec above. I do not see any contradiction between GT2 and GT3 messages. If there is a need to change it please update spec and re-attach new spec. After which please set back for NI.

I have also NI Marta as she has more first hand experience as to whats in the code.

Comment 7

[Wilfred Mathanaraj [:WDM]]

As per UX spec attached above the text in:

ALA2 states:
Remember: Location Adjustment influences the GPS coordinates. It will not affect your IP-address or locale settings, so some services might still use your exact position.

NI Martin Thompson/Harly Hsu : Do we have an alternative proposal without the word "GPS" in it that we would like to suggest to DT? If so can you please share the alternate text that we would like to suggest in here? If not can we use the current text and we can think of better text for future releases?

GT2:
What is Location Accuracy good for?
Many apps access your geolocation, like the addressbook or the camera. If you don't want to disclose your exact position, you can adjust the accuracy of your current location that is used by apps, set a custom location or hide it completely.

NI Paul/Martin Kurze: I can see the contradiction between GT2 and GT3. As such I would like to suggest we change GT2 to say the following (please feel free to provide any alternate text you would like us to consider):

What is Location Accuracy good for?
Many apps access your geolocation, like the addressbook or the camera. If you don't want to disclose your exact position, you can adjust the accuracy of your current location that is used by apps, set a custom location or hide your geolocation coordinates.


GT3:
How to set Location Accuracy?
Not each app needs your exact location to work properly.  Instead of sharing your exact coordinates, you can choose to effectively blur your location to e.g. 50 miles around you. This way, your weather app will still work, but you are not disclosing your exact address. Remember: Location Accuracy will not completely hide you!

NI Paul/Martin Kurze/Martin Thompson: are we all in agreement this is the text we want to use for GT3? If not can each one of you please provide a full statement we would like to use in GT3.

Comment 8

[Martin Thomson [:mt:]]

(In reply to Wilfred Mathanaraj [:WDM] from comment #7)

Meta: why are we calling this "Location Accuracy" that's a complete misnomer.  If anything, it's the opposite.  I'm not set on anything here, but maybe "Location Controls" is better.  If anything, it's more accurate (pun intended). 


> ALA2 states:
> Remember: Location Adjustment influences the GPS coordinates. It will not
> affect your IP-address or locale settings, so some services might still use
> your exact position.
> 
> NI Martin Thompson/Harly Hsu : Do we have an alternative proposal without
> the word "GPS" in it that we would like to suggest to DT? If so can you
> please share the alternate text that we would like to suggest in here? If
> not can we use the current text and we can think of better text for future
> releases?

s/GPS coordinates/location/

s/some services might still use your exact position/...might still be able to locate you/

> What is Location Accuracy good for?
> Many apps access your geolocation, like the addressbook or the camera. If
> you don't want to disclose your exact position, you can adjust the accuracy
> of your current location that is used by apps, set a custom location or hide
> your geolocation coordinates.

I don't like using the word "coordinates".  "geolocation" is enough.

> GT3:
> How to set Location Accuracy?
> Not each app needs your exact location to work properly.  Instead of sharing
> your exact coordinates, you can choose to effectively blur your location to
> e.g. 50 miles around you. This way, your weather app will still work, but
> you are not disclosing your exact address. Remember: Location Accuracy will
> not completely hide you!
> 
> NI Paul/Martin Kurze/Martin Thompson: are we all in agreement this is the
> text we want to use for GT3? If not can each one of you please provide a
> full statement we would like to use in GT3.

"Not each app" is just odd grammatically.

"Applications do not all need a highly accurate geolocation to operate."

s/address/location/ -- it's more generic.

Comment 9

[Martin Kurze]

Trying to clarify a bit on the background of this:
1. The Guided Tour was created as mature version of the demo version from MWC 2014.
Here we learned a few things about the "average user's" understanding/perception of the feature. E.g. to keep the wording simple and positive. Thus we came up with the wording in our 10 GT screens. At least one "native English speaker" confirmed that our key terms are correct and easy to understand by other natives ;-)
A few details inline:

(In reply to Martin Thomson [:mt] from comment #8)
> (In reply to Wilfred Mathanaraj [:WDM] from comment #7)
> 
> Meta: why are we calling this "Location Accuracy" that's a complete
> misnomer.  If anything, it's the opposite.  I'm not set on anything here,
> but maybe "Location Controls" is better.  If anything, it's more accurate
> (pun intended). 
> 
We are calling it "ADJUSTABLE Location Accuracy" which (to my understanding) describes a feature. "Location Controls" sounds more like a function or toolset. These terms are not too far away from each other, right? I propose to stick with ALA for reasons of simplicity. However, I like your thoughtful proposal (here). Let's discuss future namings of other features earlier in the process.


> > ALA2 states:
> > Remember: Location Adjustment influences the GPS coordinates. It will not
> > affect your IP-address or locale settings, so some services might still use
> > your exact position.
> > 
> > NI Martin Thompson/Harly Hsu : Do we have an alternative proposal without
> > the word "GPS" in it that we would like to suggest to DT? If so can you
> > please share the alternate text that we would like to suggest in here? If
> > not can we use the current text and we can think of better text for future
> > releases?
> 
> s/GPS coordinates/location/
> 
> s/some services might still use your exact position/...might still be able
> to locate you/
sounds ok to me

> 
> > What is Location Accuracy good for?
> > Many apps access your geolocation, like the addressbook or the camera. If
> > you don't want to disclose your exact position, you can adjust the accuracy
> > of your current location that is used by apps, set a custom location or hide
> > your geolocation coordinates.
> 
> I don't like using the word "coordinates".  "geolocation" is enough.
I could live with the "coordinates" here. No big deal.

> 
> > GT3:
> > How to set Location Accuracy?
> > Not each app needs your exact location to work properly.  Instead of sharing
> > your exact coordinates, you can choose to effectively blur your location to
> > e.g. 50 miles around you. This way, your weather app will still work, but
> > you are not disclosing your exact address. Remember: Location Accuracy will
> > not completely hide you!
> > 
> > NI Paul/Martin Kurze/Martin Thompson: are we all in agreement this is the
> > text we want to use for GT3? If not can each one of you please provide a
> > full statement we would like to use in GT3.
> 
> "Not each app" is just odd grammatically.
point taken. Coming  from a German native. 
> 
> "Applications do not all need a highly accurate geolocation to operate."
> 
> s/address/location/ -- it's more generic.
Accepted (from my point of view). We have to doublecheck the string length here to not exceed the available screeen estate.

Comment 10

[Paul Theriault [:pauljt] (no longer reading bugmail)]

MT: With your change, the first sentence reads:

"Location Adjustment influences the location."

That sounds incomplete to me? How about:

"Location Adjustment influences the location Firefox OS provides to apps."

MK: So currently in the explanations we have both "Location Adjustment" (ALA2) and "Location Accuracy" (GT2&3). I've changed them all to "Location Adjustment" based on your comment above, for consistency. (and I think Location Adjustment is more concise than Adjustable Location Accuracy).

With both of these changes, the final wording (including all the suggestions from the previous two comments I hope) reads:


ALA2:
Remember: Location Adjustment influences the location Firefox OS provides to apps. It will not affect your IP-address or locale settings, so some services might still be able to locate you.

GT2:
What is Location Adjustment good for?
Many apps access your geolocation, like the addressbook or the camera. If you don't want to disclose your exact position, you can adjust the accuracy of your current location that is used by apps, set a custom location or hide your geolocation.

GT3:
How to set Location Adjustment?
Not every app needs your exact location to work properly.  Instead of sharing
your exact coordinates, you can choose to effectively blur your location to
e.g. 50 miles around you. This way, your weather app will still work, but
you are not disclosing your exact location. Remember: Location Adjustment will
not completely hide you!

Comment 11

[Martin Thomson [:mt:]]

(In reply to Paul Theriault [:pauljt] from comment #10)
> MT: With your change, the first sentence reads:
> 
> "Location Adjustment influences the location."
> 
> That sounds incomplete to me? How about:
> 
> "Location Adjustment influences the location Firefox OS provides to apps."

Sure, that is better.

> MK: So currently in the explanations we have both "Location Adjustment"
> (ALA2) and "Location Accuracy" (GT2&3). I've changed them all to "Location
> Adjustment" based on your comment above, for consistency. (and I think
> Location Adjustment is more concise than Adjustable Location Accuracy).

WFM

> GT3:
> How to set Location Adjustment?
> Not every app needs your exact location to work properly.  Instead of sharing
> your exact coordinates, you can choose to effectively blur your location to
> e.g. 50 miles around you. This way, your weather app will still work, but
> you are not disclosing your exact location. Remember: Location Adjustment
> will
> not completely hide you!

The first sentence is an improvement, but I'm still a little leery of using the word "exact" in this context (which is a personal bias, I'll admit).

Comment 12

[marta]

The current pull request includes changes according to Paul's suggestions: https://github.com/mozilla-b2g/gaia/pull/25368 .
Martin, do you accept the changes or do we still need to add something?
If you do - can we close the bug?

Comment 13

[marta]

Attachment: wording.patch

here are the changes

Comment 14

[Martin Thomson [:mt:]]

Marta, please be more careful who you ask for info.

I thought that my reply to Paul was clear enough.  I can live with what was suggested.

(I haven't reviewed the PR, I don't have that sort of time.)

Comment 15

[marta]

Sure, Martin, Sorry. I just wanted to make sure that you are fine with it - we are having far too many miscommunication problems in other bugs, so I rather ask 3 times then do something wrong:) Sorry for bothering you.

Closing the bug as the warnings got changes as suggested by Paul.