1182397 - Warn user about wiping corresponding server data when they uncheck a sync engine in preference

Status: NEW

(Firefox :: Sync, enhancement, P3)

Description

[Hector Zhao [:hectorz]]

Beijing office got many user complaints about data loss after experiencing "sync not working, try tweaking random things to fix it".

We've implemented a warning in our extension (bundled within the Fx China repack), when user unchecks an engine, he/she will see this:

> Uncheck "%1$S" will delete all records stored on sync server, and other
> devices will stop syncing %1$S. This action is NOT reversible, please
> proceed with caution to prevent any data loss.
> 
> Continue with deleting %1$S stored on sync server?
> 
> Yes | No

With "No" being the default, and "Yes" enabled after a delay.

We'd like to request a similar change in vanilla Fx. I can work on the patch, but I've never worked on any bug involving UI, so I'm not sure about the procedure there.

Comment 1

[Chris Karlof [:ckarlof]]

Ryan, thoughts on priority here?

Comment 2

[Ryan Feeley [:rfeeley]]

How do users lose data when they disable, for example, password syncing when they have those passwords in the client they are currently using?

Comment 3

[Hector Zhao [:hectorz]]

(In reply to Ryan Feeley [:rfeeley] from comment #2)
> How do users lose data when they disable, for example, password syncing when
> they have those passwords in the client they are currently using?

No, they don't lose data by just unchecking sync engines.

Some user would uncheck all the engines, with the intention of "properly" disconnecting the current profile from the sync service, before reinstalling the operating system w/o any backup, and their data is lost.

Some user would reinstall the OS and Fx, log into their account, then if there's a delay in the automatic download, uncheck then check a sync engine in an attempt to trigger an immediate download of the data.

It's mostly about what users think the checkboxes do. Some think it's about whether to sync e.g. passwords from/to this profile, while actually it's whether any passwords will be synced across all profiles.

Comment 4

[Mark Hammond [:markh] [:mhammond]]

It sounds like we just want bug 1215415?

Comment 5

[Hector Zhao [:hectorz]]

(In reply to Mark Hammond [:markh] from comment #4)
> It sounds like we just want bug 1215415?

Yes, I think that would make it a lot less confusing.

But I still think a warning before wiping server data will be helpful, maybe even when it's triggered by a more explicit user action.

Comment 6

[Ryan Feeley [:rfeeley]]

Per-device datatype selection is not something we should switch to without careful consideration as it will likely require additional UI. Going that route means we should also provide users with a way to manually remove certain datatype from our servers, but also we need strong confidence in our ability to merge stale server data.

I'm hesitant to introduce an additional dialog or browser UI, but what about simply showing a notification that said let users know when a given datatype has been activated/deactivated and wiped from our servers?

I'm sure Michelle can help me write something, but I think it's the right UI.

Password syncing activated
Password syncing has been activated making them available everywhere you use Firefox.

Password syncing deactivated
Password syncing has been deactivated. Any password data has been wiped from our servers.

Comment 7

[Ryan Feeley [:rfeeley]]

Attachment: notifications-passwords.png

Comment 8

[Hector Zhao [:hectorz]]

(In reply to Ryan Feeley [:rfeeley] from comment #6)
> 
> I'm hesitant to introduce an additional dialog or browser UI, but what about
> simply showing a notification that said let users know when a given datatype
> has been activated/deactivated and wiped from our servers?
> 
> ...
> 
> Password syncing deactivated
> Password syncing has been deactivated. Any password data has been wiped from
> our servers.

IIUC, when an user sees this notification, their data is already lost? We'd really want to give users a chance to think again before that happens. If prompting for every action is too much, maybe at least when an user does that for the first time?

Comment 9

[Lina Butler [:lina]]

I really like your suggestion of showing a notification, Ryan, but I'm wondering if we might go further. I feel like the "delete from server" behavior is action at a distance that isn't clear in the current UI, and I agree with Hector that it's too late to do anything once it's removed.

To use another example, I'd expect that unchecking "Mail" or "Contacts" in iCloud prefs on OS X would stop syncing my mail and contacts to the device...not delete all my mail from the server.

In Sync's case, the server is a whiteboard, not a backup, so maybe the example doesn't make sense. But I wonder if there's something we can do to clarify that this is different than other sync systems.

Maybe we could wait to remove the data until the notification disappears, and having the notification say "Click to Undo." (Where "undo" just means we'd cancel the pending deletion). Or maybe we could have the header read "Sync these on all my devices." Or add a "Save" button, with text above it that reads "<unchecked data types> will no longer sync on: <list of devices with icons>."

What do you think?

Comment 10

[Mark Hammond [:markh] [:mhammond]]

(In reply to Hector Zhao [:hectorz] from comment #8)
> IIUC, when an user sees this notification, their data is already lost? We'd
> really want to give users a chance to think again before that happens. If
> prompting for every action is too much, maybe at least when an user does
> that for the first time?

"in theory", the user just re-enables the engine if that's not what they want. There are a few assumptions about that, but it's fairly close to true.

(In reply to Ryan Feeley [:rfeeley] from comment #6)
> Per-device datatype selection is not something we should switch to without
> careful consideration as it will likely require additional UI. Going that
> route means we should also provide users with a way to manually remove
> certain datatype from our servers, but also we need strong confidence in our
> ability to merge stale server data.

I think everyone agrees that this is where we want to end up - hopefully this year - so maybe a simple modal approach like comment 0 is fine given we really don't expect many users to hit it in practice and it should only be temporary.

Another alternative might be for those checkboxes to be replaced with a text description of what is being synced and a button labeled "change" that (a) turns them into checkboxes that can be changed and (b) shows a little warning note about what changing actually does.

Anyway, enough bike-shedding for me!

Comment 11

[mheubusch]

Not sure what the proposed solution is (modal per comment 0 or checkbox proposed by Mark) but here is my recommended text for modal.  Ryan - LMK if you want to work together on a different interface for the short term or longterm solution. 


Uncheck "%1$S" to permanently delete all stored "%1$S" and stop syncing "%1$S" with other devices signed in to your Firefox Account. 

Continue to delete all stored "%1$S"?
Yes| No

Comment 12

[Mark Hammond [:markh] [:mhammond]]

TBH I'd rather see if we can do bug 1215415, but I'm not sure how practical that is at this stage.