1687722 - Consider enabling HTTPS-Only Mode in ETP Strict Mode

Status: NEW

(Core :: Privacy: Anti-Tracking, task, P3)

Description

[Christoph Kerschbaumer [:ckerschb]]

We should consider enabling https-only-mode in ETPs (Enhanced Tracking Protection) strict-mode.

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Attachment: https_only_strict_mode.png

We could add another line after Fingerprinters that basically indicates that HTTPS-Only-Mode is enabled.

Comment 2

[Johann Hofmann [:johannh]]

Do you mind if I move this to the Privacy component? This seems like a call for the Privacy team to make :)

Arthur, should we set something up to discuss this briefly? It feels like a good idea to me but I’d like to make sure we’re all comfortable with this. It’s definitely not easy getting a feature out of strict mode (i.e. regressing user privacy) retroactively if we end up not wanting it after all.

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Moving the component is totally fine. Please note that this bug is really for consideration only at this point. Consideration in a sense that we should start a discussion around putting https-only into strict mode eventually :-)

Comment 4

[Arthur Edelstein [:arthur]]

Content strategy discussion: https://docs.google.com/document/d/1e1R3vRpxHJodRH6f1VVmG9zVGYNWVxqUlPYF41SavMc/edit#heading=h.bp0844hyhnx4

Comment 5

[Meridel [:meridel]]

Michelle and I chatted a bit with Arthur about this already, but wanted to sum it up here so I can clear my need-info!

I recommend we take a step back and consider redesigning and reframing the privacy and security section of Preferences entirely. The current design and information architecture can't gracefully accommodate continued one-off additions— and I don't think doing so is communicating our protections in a clear and compelling way to users. At first glance, HTTPs-Only mode doesn't fit well under the "block tracking" umbrella of the current ETP section.

I recommend we revisit the broader goals for privacy and security messaging and roadmap post MR1.