1637344 - Add message to show dFPI is incompatible with FPI

Status: VERIFIED FIXED

(Firefox :: Settings UI, enhancement, P1)

Description

[Gary Chen [:xeonchen]]

In bug 1631676 we silently convert cookie behavior 5 to 4 (disable Dynamic FPI) if the user has First-Party Isolation enabled.

To make it clearer, we should consider adding some message to remind the user that dFPI is not compatible with FPI.

Comment 1

[Steven Englehardt [:englehardt]]

Attachment: fpi_active.png

Comment 2

[Steven Englehardt [:englehardt]]

Attachment: fpi_no_active.png

privacy.firstparty.isolate = false

Comment 3

[Steven Englehardt [:englehardt]]

As an example of what we mean by silently hiding the face that dFPI exists: Comment 1 shows the current Custom UI when privacy.firstparty.isolate = true and Comment 2 shows the UI when ``privacy.firstparty.isolate = false`. The same differences would exist if dFPI were the default cookie policy for Standard / Strict.

Comment 4

[Steven Englehardt [:englehardt]]

We chatted a bit more about our options here, such as possibly displaying a warning message that dFPI and FPI are different, giving users the option to click a button to switch, and adding a learn more page to understand the differences between the two. This approach would put a lot of onus on the user. It may also be confusing if the user also has an extension that forces FPI back on after the user manually disables it. We decided to pivot to a simpler approach.

Since FPI + cookie policy 4 and dFPI (which includes cookie policy 4) both provide isolation, we've decided to keep the UIs here consistent between the two. An FPI user in Standard or Strict will still block cross-site tracking cookies + social media tacker cookies, and isolate all remaining third-party cookies. FPI is just an alternate way (and slightly less web-compatible) way to achieve that. Instead of adding a big warning message that compares the two, we can just add a note that says "First-Party Isolation is enabled. This may override your cookies settings.".

The only consequence of the new approach is that the cookie settings "Cross-site and social media trackers" (cookie behavior 4) and "Cross-site and social media trackers, and isolate remaining cookies" (cookie behavior 5) apply the exact same policy under the hood (i.e., cookie behavior 4 + FPI). If it's not too difficult we can consider hiding "Cross-site and social media trackers" for these users to resolve this issue, but that doesn't seem necessary.

Comment 5

[(inactive) Nihanth Subramanya [:nhnt11]]

Attachment: Bug 1637344 - Show message in privacy preferences to indicate FPI is incompatible with dFPI. r=johannh!

Comment 6

[(inactive) Nihanth Subramanya [:nhnt11]]

Attachment: Bug 1637344 - Clean up browser_statePartitioning_strings.js. r=Gijs!

Depends on D96371

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3a5c4fa8a47b
Show message in privacy preferences to indicate FPI is incompatible with dFPI. r=fluent-reviewers,johannh,preferences-reviewers,flod
https://hg.mozilla.org/integration/autoland/rev/9e4048b69861
Clean up browser_statePartitioning_strings.js. r=Gijs,preferences-reviewers,ntim

Comment 8

[(inactive) Nihanth Subramanya [:nhnt11]]

Attachment: Bug 1637344 - Remove trailing whitespace mistakenly included in new string. r=cbrindusan!

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/30dff1eefdce
Remove trailing whitespace mistakenly included in new string. r=cbrindusan,fluent-reviewers,flod

Comment 10

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/3a5c4fa8a47b
https://hg.mozilla.org/mozilla-central/rev/9e4048b69861
https://hg.mozilla.org/mozilla-central/rev/30dff1eefdce

Comment 11

[Alin Ilea, Desktop Test Engineering]

Verified - Fixed in latest Nightly 85.0a1 (build id: 20201120094511). "Cross-site and social media trackers, and isolate remaining cookies" is displayed in the Cookies drop-down when the privacy.firstparty.isolate pref is set to false.
The "Cross-site and social media trackers, and isolate remaining cookies" is not displayed in Beta 84.0b3 following the same steps. Is that ok?
Thanks!

Comment 12

[Steven Englehardt [:englehardt]]

(In reply to Alin Ilea from comment #11)

Verified - Fixed in latest Nightly 85.0a1 (build id: 20201120094511). "Cross-site and social media trackers, and isolate remaining cookies" is displayed in the Cookies drop-down when the privacy.firstparty.isolate pref is set to false.
The "Cross-site and social media trackers, and isolate remaining cookies" is not displayed in Beta 84.0b3 following the same steps. Is that ok?
Thanks!

Thanks! That's expected since dynamic first party isolation is not enabled in beta.

Comment 13

[Alin Ilea, Desktop Test Engineering]

Great, thanks for the answer. I will change the status and the flag accordingly.