1691218 - "Show alerts about passwords for breached websites" should be disabled if the "parent" checkbox is unticked

Status: NEW

(Firefox :: Settings UI, defect, P3)

Description

[Jason Byrne]

Attachment: firefox_logins_and_passwords_toggle_should_clear_sub_checkboxes.png

User Agent: Mozilla/5.0 (X11; Linux i686; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

Preferences -> Privacy & Security
Scroll to Logins and Passwords

Unchecked 'Ask to save logins and passwords for websites'

Actual results:

(Some) child checkboxes of the parent 'Ask to save logins and passwords for websites' checkbox are disabled, but the checked/unchecked status of the child checkboxes stay the same.

Also, the 'Show alerts about passwords for breached websites' is not affected by the status of the parent checkbox.

Expected results:

Child checkboxes should become checked/unchecked, based on the status of the parent checkbox, in addition to the child checkboxes becoming enabled/disabled.

The 'Show alerts about passwords for breached websites' placement implies that it is a child checkbox, but it does not behave as such in any context, since it is neither enabled/disabled nor checked/unchecked when the parent checkbox is checked/unchecked.

I would personally argue that the 'Show alerts about passwords for breached websites' checkbox should not be placed under the (implied) parent checkbox, and should instead be its own standalone option. i.e. regardless of whether you are choosing to save logins/passwords, it would be useful to be alerted to breached websites if/when you visit them.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Preferences' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[:Gijs (he/him)]

Sam, do you know how the breach alerts stuff works and why this is laid out like this?

Comment 3

[:Gijs (he/him)]

(In reply to Jason Byrne from comment #0)

Child checkboxes should become checked/unchecked, based on the status of the parent checkbox, in addition to the child checkboxes becoming enabled/disabled.

As noted in bug 1691217, I don't agree that this is required.

The 'Show alerts about passwords for breached websites' placement implies that it is a child checkbox, but it does not behave as such in any context, since it is neither enabled/disabled nor checked/unchecked when the parent checkbox is checked/unchecked.

I agree that this behaviour is strange and should be fixed.

Comment 4

[Sam Foster [:sfoster] (he/him)]

I'm not sure why it got laid out like that. Maybe :jaws might remember the reasoning? However, the Breach Alerts feature is controlled by the "signon.management.page.breach-alerts.enabled" pref, see https://searchfox.org/mozilla-central/source/browser/components/aboutlogins/AboutLoginsParent.jsm#34-39
If you toggle the "parent" checkbox there in Settings/Preferences, that toggles the "signon.rememberSignons" pref, which kinda makes about:logins in general not very useful, but doesn't actually disable the breach alerts feature AFAICT. Un-indenting it seems reasonable to me.

Comment 5

[:Gijs (he/him)]

Looks like Luke added it in bug 1575597, so hopefully he can clarify why the UI is like this.

Comment 6

[Luke Crouch [:groovecoder]]

There are 2 different "Breach Alert" features ...

1. The alert/pop-up dialog that opens from the url bar when Firefox visits a site that has a breach

2. The "breached" or "vulnerable" password indicators in about:logins

This checkbox is for feature #2, which is why it's nested under the save logins and passwords for websites UI. I agree with OP that the checkbox should follow the heuristics of the other nested check-boxes.

Comment 7

[Javi Rueda :javirid]

(In reply to Luke Crouch [:groovecoder] from comment #6)

There are 2 different "Breach Alert" features ...

1. The alert/pop-up dialog that opens from the url bar when Firefox visits a site that has a breach

2. The "breached" or "vulnerable" password indicators in about:logins

This checkbox is for feature #2, which is why it's nested under the save logins and passwords for websites UI. I agree with OP that the checkbox should follow the heuristics of the other nested check-boxes.

So anything of this needs for the "save login for current site" feature to be enabled. Feature 2 works on already saved login information, no matter if user is still saving new login information for any site or not.