1397757 - Need "Learn More" page for HTML5 Canvas warning of fingerprinting resistance

Status: VERIFIED FIXED

(Firefox :: Page Info Window, enhancement, P2)

Description

[Ethan Tseng [:ethan]]

Bug 967895 added a UI prompt to warn users when Firefox detects a web page is trying to extract data from HTML5 Canvas API.

The original UX design (bug 1382111) has a "Learn more..." link in the prompt.
However, we don't have a help page to provide such information.

It would be great if we can add a support page to explain to users what fingerprinting protection is.
A support page like this:
https://support.mozilla.org/en-US/kb/tracking-protection-pbm?as=u&utm_source=inproduct

Comment 1

[Ethan Tseng [:ethan]]

Hi Jared,

Is this the right component (to add a support page)?
If not, please help me correct it.

Comment 2

[Jared Wein [:jaws] (please needinfo? me)]

Sheppy, did I move this to the right component?

Comment 4

[Joni Chan]

I just saw this. Do you still need a Learn More page? Please use this link in the UI and we'll have it redirect to a localized SUMO article: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprint-permission

When is this feature going to be on Beta?

Comment 5

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Hi Joni,

We do still need the Learn More page, yes. This feature is already in beta under a non-default flag.

Comment 6

[Joni Chan]

I've written a draft here: https://docs.google.com/document/d/1Q6Fk-x4lAPjaBV5yaqDfr9VGCzPFBcR2ErPRZ9GxBX0/edit?usp=sharing

Please add any comments and a screenshot or a test site we can use to bring up this prompt.

Comment 7

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Hey Joni, I worked on the document a bunch - let me know what you think. I'm also adding a couple more folks for visibility.

Comment 8

[Alice Wyman]

(In reply to Joni Savage ("need info" me) from comment #6)
> I've written a draft here:
> https://docs.google.com/document/d/1Q6Fk-x4lAPjaBV5yaqDfr9VGCzPFBcR2ErPRZ9GxBX0/edit?usp=sharing
> 
> Please add any comments and a screenshot or a test site we can use to bring
> up this prompt.

From bug 1382111 comment 24 (quote)
"If you need other sites for test, please try this: https://amiunique.org/fp "

That test site shows me a permission prompt in Firefox 58 with privacy.resistFingerprinting set to true.

Comment 9

[Simon Mainey]

(In reply to Tom Ritter [:tjr] from comment #7)
> Hey Joni, I worked on the document a bunch - let me know what you think

Mentioning here since I do not wish to log into google docs
- mention geolocation requests are blocked
- add zoom (perhaps to the window size line) - Zoom is often a question asked on r/firefox

If anyone wants a tidy summary of RFP effects look at the "resolved" section in the first post at https://github.com/ghacksuserjs/ghacks-user.js/issues/7 (bugzillas linked) or look at the list in section 4500 at https://github.com/ghacksuserjs/ghacks-user.js/blob/master/user.js#L1538

Comment 10

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

(In reply to Simon Mainey from comment #9)
> Mentioning here since I do not wish to log into google docs
> - mention geolocation requests are blocked

Shoot, I thought we had changed this. We discussed this a while back and I guess we never filed a bug on it. I opened Bug 1441295

> - add zoom (perhaps to the window size line) - Zoom is often a question
> asked on r/firefox

Added, thanks!

Comment 11

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

So, I don't really mind my website being advertised on the Learn More page, but if we don't want to do that we will also need to blur our the EV Badge that says "Tom Ritter LLC"

Comment 12

[Simon Mainey]

https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting

The "Any Site-Specific Zoom settings are not applied" list item is missing

Comment 13

[Joni Chan]

Thanks for working on the doc. I've added an updated screenshot with the EV badge blurred out and added the site-specific zoom settings that you've added to the GDoc.

So "...geolocation requests are blocked..." mentioned in comment #9 no longer applies to the doc, right?

Comment 14

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

(In reply to Joni Savage ("need info" me) from comment #13)
> So "...geolocation requests are blocked..." mentioned in comment #9 no
> longer applies to the doc, right?

Right, let's just leave that out for now, even though technically I need to write that patch still.

Comment 15

[Simon Mainey]

I'm just re-reading the support page and the list item "You have granted the website permission." doesn't make any sense. It is a standalone statement but fails to say "what"

The original google doc had it as "Canvas data extraction is not allowed unless you grant the website permission"

Since this point is already covered by the preceding sentence ("However, the Canvas Permission Prompt is not the only thing that Fingerprinting Protection is doing. Fingerprinting Detection also looks at other factors:") then I suggest you just remove the line entirely

Comment 16

[Simon Mainey]

Also, "Not all fonts installed on your computer are available to webpages" hasn't landed yet but I assume heaven and hell will be moved to land Bug 1336208 for 60 stable?

Comment 17

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: Bug 1397757 Add Learn More link for the Canvas Permission Prompt

Review commit: https://reviewboard.mozilla.org/r/231838/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/231838/

Comment 18

[Johann Hofmann [:johannh]]

Comment on attachment 8962995 [details]
Bug 1397757 Add Learn More link for the Canvas Permission Prompt

https://reviewboard.mozilla.org/r/231838/#review237422

Please use "app.support.baseURL" as a base pref and just append the path, like this:

https://searchfox.org/mozilla-central/rev/028cd8342899357d80fafba2d528a0fd5819e316/browser/base/content/browser-media.js#171

Thanks!

Comment 19

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Comment on attachment 8962995 [details]
Bug 1397757 Add Learn More link for the Canvas Permission Prompt

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/231838/diff/1-2/

Comment 20

[Johann Hofmann [:johannh]]

Comment on attachment 8962995 [details]
Bug 1397757 Add Learn More link for the Canvas Permission Prompt

https://reviewboard.mozilla.org/r/231838/#review237878

Thanks!

Comment 21

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a6fba6948018
Add Learn More link for the Canvas Permission Prompt r=johannh

Comment 22

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/a6fba6948018

Comment 23

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Comment on attachment 8962995 [details]
Bug 1397757 Add Learn More link for the Canvas Permission Prompt

Approval Request Comment
[Feature/Bug causing the regression]: No regression. Tor would like to have this patch in 60.

[User impact if declined]: Tor would need to carry an additional patch in ESR.

[Is this code covered by automated tests?]: No

[Has the fix been verified in Nightly?]: Yes.

[Needs manual test from QE? If yes, steps to reproduce]: No.

[List of other uplifts needed for the feature/fix]: None

[Is the change risky?]: No

[Why is the change risky/not risky?]: It is a one line change to add a property using an existing pref.

[String changes made/needed]: None

Comment 24

[Julien Cristau [:jcristau]]

Comment on attachment 8962995 [details]
Bug 1397757 Add Learn More link for the Canvas Permission Prompt

add SUMO link to fingerprinting-related prompt, approved for 60.0b10

Comment 25

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/releases/mozilla-beta/rev/49d67e0e77a9

Comment 26

[Alice Wyman]

(In reply to Simon Mainey from comment #15)

I'm just re-reading the support page and the list item "You have granted the
website permission." doesn't make any sense. It is a standalone statement
but fails to say "what"

The original google doc had it as "Canvas data extraction is not allowed
unless you grant the website permission"

Since this point is already covered by the preceding sentence ("However, the
Canvas Permission Prompt is not the only thing that Fingerprinting
Protection is doing. Fingerprinting Detection also looks at other factors:")
then I suggest you just remove the line entirely

https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting/revision/157443
The revision by tomrittervg is still pending review.

Comment 27

[Joni Chan]

Approved the revision. Thank you.

Comment 28

[Underpass]

Hello, since there is also a "Fingerprinter" menu item in the article

https://support.mozilla.org/en-US/kb/trackers-and-scripts-firefox-blocks-enhanced-track#w_fingerprinters

Would it be possible to insert also a paragraph about the differences between the two protections?

Thanks.

Comment 29

[Alice Wyman]

(In reply to Underpass from comment #28)

Hello, since there is also a "Fingerprinter" menu item in the article

https://support.mozilla.org/en-US/kb/trackers-and-scripts-firefox-blocks-enhanced-track#w_fingerprinters

Would it be possible to insert also a paragraph about the differences between the two protections?

Thanks.

I opened bug 1633062 to update the https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting/ article.