Closed Bug 1397757 Opened 2 years ago Closed 2 years ago

Need "Learn More" page for HTML5 Canvas warning of fingerprinting resistance

Categories

(Firefox :: Page Info Window, enhancement, P2)

enhancement

Tracking

()

VERIFIED FIXED
Tracking Status
firefox60 - fixed
firefox61 --- fixed

People

(Reporter: ethan, Assigned: tjr)

References

(Blocks 1 open bug, )

Details

(Whiteboard: [tor][fingerprinting][fp-triaged])

Attachments

(1 file)

Bug 967895 added a UI prompt to warn users when Firefox detects a web page is trying to extract data from HTML5 Canvas API.

The original UX design (bug 1382111) has a "Learn more..." link in the prompt.
However, we don't have a help page to provide such information.

It would be great if we can add a support page to explain to users what fingerprinting protection is.
A support page like this:
https://support.mozilla.org/en-US/kb/tracking-protection-pbm?as=u&utm_source=inproduct
See Also: → 967895
See Also: → 1382111
Hi Jared,

Is this the right component (to add a support page)?
If not, please help me correct it.
Flags: needinfo?(jaws)
Component: Preferences → General
Flags: needinfo?(jaws)
Product: Firefox → support.mozilla.org
Sheppy, did I move this to the right component?
Flags: needinfo?(eshepherd)
Whiteboard: [tor][fingerprinting]
Component: General → Learning Area
Flags: needinfo?(eshepherd)
Product: support.mozilla.org → Developer Documentation
Component: Learning Area → Knowledge Base Content
Product: Developer Documentation → support.mozilla.org
Duplicate of this bug: 1419938
Priority: -- → P2
Whiteboard: [tor][fingerprinting] → [tor][fingerprinting][fp-triaged]
I just saw this. Do you still need a Learn More page? Please use this link in the UI and we'll have it redirect to a localized SUMO article: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprint-permission

When is this feature going to be on Beta?
Flags: needinfo?(ethantseng)
Hi Joni,

We do still need the Learn More page, yes. This feature is already in beta under a non-default flag.
Flags: needinfo?(ethantseng)
I've written a draft here: https://docs.google.com/document/d/1Q6Fk-x4lAPjaBV5yaqDfr9VGCzPFBcR2ErPRZ9GxBX0/edit?usp=sharing

Please add any comments and a screenshot or a test site we can use to bring up this prompt.
Flags: needinfo?(ethantseng)
Hey Joni, I worked on the document a bunch - let me know what you think. I'm also adding a couple more folks for visibility.
Flags: needinfo?(jsavory)
Flags: needinfo?(jsavage)
Flags: needinfo?(arthuredelstein)
Flags: needinfo?(ethantseng)
(In reply to Joni Savage ("need info" me) from comment #6)
> I've written a draft here:
> https://docs.google.com/document/d/1Q6Fk-x4lAPjaBV5yaqDfr9VGCzPFBcR2ErPRZ9GxBX0/edit?usp=sharing
> 
> Please add any comments and a screenshot or a test site we can use to bring
> up this prompt.

From bug 1382111 comment 24 (quote)
"If you need other sites for test, please try this: https://amiunique.org/fp "

That test site shows me a permission prompt in Firefox 58 with privacy.resistFingerprinting set to true.
(In reply to Tom Ritter [:tjr] from comment #7)
> Hey Joni, I worked on the document a bunch - let me know what you think

Mentioning here since I do not wish to log into google docs
- mention geolocation requests are blocked
- add zoom (perhaps to the window size line) - Zoom is often a question asked on r/firefox

If anyone wants a tidy summary of RFP effects look at the "resolved" section in the first post at https://github.com/ghacksuserjs/ghacks-user.js/issues/7 (bugzillas linked) or look at the list in section 4500 at https://github.com/ghacksuserjs/ghacks-user.js/blob/master/user.js#L1538
(In reply to Simon Mainey from comment #9)
> Mentioning here since I do not wish to log into google docs
> - mention geolocation requests are blocked

Shoot, I thought we had changed this. We discussed this a while back and I guess we never filed a bug on it. I opened Bug 1441295

> - add zoom (perhaps to the window size line) - Zoom is often a question
> asked on r/firefox

Added, thanks!
So, I don't really mind my website being advertised on the Learn More page, but if we don't want to do that we will also need to blur our the EV Badge that says "Tom Ritter LLC"
https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting

The "Any Site-Specific Zoom settings are not applied" list item is missing
Thanks for working on the doc. I've added an updated screenshot with the EV badge blurred out and added the site-specific zoom settings that you've added to the GDoc.

So "...geolocation requests are blocked..." mentioned in comment #9 no longer applies to the doc, right?
Flags: needinfo?(jsavage)
(In reply to Joni Savage ("need info" me) from comment #13)
> So "...geolocation requests are blocked..." mentioned in comment #9 no
> longer applies to the doc, right?

Right, let's just leave that out for now, even though technically I need to write that patch still.
I'm just re-reading the support page and the list item "You have granted the website permission." doesn't make any sense. It is a standalone statement but fails to say "what"

The original google doc had it as "Canvas data extraction is not allowed unless you grant the website permission"

Since this point is already covered by the preceding sentence ("However, the Canvas Permission Prompt is not the only thing that Fingerprinting Protection is doing. Fingerprinting Detection also looks at other factors:") then I suggest you just remove the line entirely
Also, "Not all fonts installed on your computer are available to webpages" hasn't landed yet but I assume heaven and hell will be moved to land Bug 1336208 for 60 stable?
Comment on attachment 8962995 [details]
Bug 1397757 Add Learn More link for the Canvas Permission Prompt

https://reviewboard.mozilla.org/r/231838/#review237422

Please use "app.support.baseURL" as a base pref and just append the path, like this:

https://searchfox.org/mozilla-central/rev/028cd8342899357d80fafba2d528a0fd5819e316/browser/base/content/browser-media.js#171

Thanks!
Attachment #8962995 - Flags: review?(jhofmann) → review-
Comment on attachment 8962995 [details]
Bug 1397757 Add Learn More link for the Canvas Permission Prompt

https://reviewboard.mozilla.org/r/231838/#review237878

Thanks!
Attachment #8962995 - Flags: review?(jhofmann) → review+
Assignee: nobody → tom
Keywords: checkin-needed
Pushed by ryanvm@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/a6fba6948018
Add Learn More link for the Canvas Permission Prompt r=johannh
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/a6fba6948018
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Flags: needinfo?(jsavory)
Flags: needinfo?(arthuredelstein)
Component: Knowledge Base Content → Page Info Window
Product: support.mozilla.org → Firefox
Comment on attachment 8962995 [details]
Bug 1397757 Add Learn More link for the Canvas Permission Prompt

Approval Request Comment
[Feature/Bug causing the regression]: No regression. Tor would like to have this patch in 60.

[User impact if declined]: Tor would need to carry an additional patch in ESR.

[Is this code covered by automated tests?]: No

[Has the fix been verified in Nightly?]: Yes.

[Needs manual test from QE? If yes, steps to reproduce]: No.

[List of other uplifts needed for the feature/fix]: None

[Is the change risky?]: No

[Why is the change risky/not risky?]: It is a one line change to add a property using an existing pref.

[String changes made/needed]: None
Attachment #8962995 - Flags: approval-mozilla-beta?
Comment on attachment 8962995 [details]
Bug 1397757 Add Learn More link for the Canvas Permission Prompt

add SUMO link to fingerprinting-related prompt, approved for 60.0b10
Attachment #8962995 - Flags: approval-mozilla-beta? → approval-mozilla-beta+

(In reply to Simon Mainey from comment #15)

I'm just re-reading the support page and the list item "You have granted the
website permission." doesn't make any sense. It is a standalone statement
but fails to say "what"

The original google doc had it as "Canvas data extraction is not allowed
unless you grant the website permission"

Since this point is already covered by the preceding sentence ("However, the
Canvas Permission Prompt is not the only thing that Fingerprinting
Protection is doing. Fingerprinting Detection also looks at other factors:")
then I suggest you just remove the line entirely

https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting/revision/157443
The revision by tomrittervg is still pending review.

Flags: needinfo?(jsavage)

Approved the revision. Thank you.

Flags: needinfo?(jsavage)
You need to log in before you can comment on or make changes to this bug.