Open Bug 471658 Opened 15 years ago Updated 3 months ago

Disable Private Browsing mode when parental controls are enabled

Categories

(Firefox :: Private Browsing, enhancement, P4)

enhancement

Tracking

()

Future

People

(Reporter: ehsan.akhgari, Unassigned)

References

(Depends on 2 open bugs)

Details

(Keywords: common-issue+)

I could imagine that once we release Firefox 3.1, there will be many parents which will be wary of this feature, because it gives their children the ability to browse the web in an uncontrolled manner.  This was brought to my attention from a user's comment at <http://ehsanakhgari.org/blog/2008-11-11/first-private-browsing-extension#comment-403>.

I think the correct thing for us to do in this regard is to disable the private browsing service when parental controls are enabled.  This won't cover all users (i.e. those not using Windows Vista) but it would be very nice to obey platform settings in this regard, where they are available.

IE 8 will do a similar thing in their InPrivate Browsing implementation <http://www.microsoft.com/windows/internet-explorer/beta/features/browse-privately.aspx>.

And I really think that we need this for 3.1, so I'll start working on a patch as soon as the UX decision is confirmed.
Flags: wanted-firefox3.1?
Do we already block Clear Private Data and deleting individual history entries, cookies, etc.? If not, wouldn't this rather imply that it's actually possible locking Firefox down so that tracks are always visible within the browser?

Really: If you want to know where your kids are surfing, either talk to them or read your router's logs... ;-)
(In reply to comment #1)
> Do we already block Clear Private Data and deleting individual history entries,
> cookies, etc.?

No, but parents can set Parental Controls to log all visited site URLs, which means that running under private browsing mode in Vista won't be that much private.

So, we either need to disable this logging inside the private browsing mode, or obey the OS settings and not allow entering the private browsing mode with Parental Controls turned on in the first place.  I'd opt for the latter solution.

> If not, wouldn't this rather imply that it's actually possible
> locking Firefox down so that tracks are always visible within the browser?

Yes, but keep a couple of points in mind.  We already obey other parts of the Parental Controls settings, and there are other ways to lock down the private browsing mode...

> Really: If you want to know where your kids are surfing, either talk to them or
> read your router's logs... ;-)

I don't have any children myself, and if I did, I don't think this is the ideal solution to protect kids, but anyway I think there will be a number of parents which will get affected by this.
(In reply to comment #2)
> No, but parents can set Parental Controls to log all visited site URLs, which
> means that running under private browsing mode in Vista won't be that much
> private.

In that respect private browsing mode is never really private, is it? We can never control what happens outside of Firefox itself - or do you propose to not allow PB mode either when a logging firewall, etc. is running?

OTOH PB mode might still be of value, even with parental controls enabled, even if one child doesn't want the other child to accidentally stumble over its favorite pony site (both children sharing a common account).

> We already obey other parts of the Parental Controls settings

AFAICT parental control is mostly about not allowing certain URLs and not about forcing history to be undeletable.

> I think there will be a number of parents which will get affected by this.

How exactly? All the logging already happens outside of Firefox, so why not let children learn about privacy issues earlier on?
I think a point here is to not give a false sense of security with PB mode when it's known to not be private at all. I could also see how some parents would be annoyed if it appeared that this circumvented their settings, even if it didn't.

Ideally the ability to disable PB mode (and/or all history clearing) would just be exposed to the parental controls for people to decide on their own, but I don't know how much leeway parental controls gives us here. Can an option just be added to the parental controls panel?
(In reply to comment #3)
> In that respect private browsing mode is never really private, is it?

Actually, upon closer inspection of the code, it seems that the logging code has been implemented in nsIParentalControlsService, but is not called anywhere.  So, the current implementation only blocks downloads as per parental control settings.

> We can never control what happens outside of Firefox itself

Actually logging the URLs is the responsibility of browsers, and the OS doesn't do anything outside of Firefox here.

> - or do you propose to not
> allow PB mode either when a logging firewall, etc. is running?

No, my suggestion was not based on the fact that URLs may be logged.  It was based on the fact that parents may not want their kids to use the private browsing mode if they have defined any special controls to "control" their kids.

> OTOH PB mode might still be of value, even with parental controls enabled, even
> if one child doesn't want the other child to accidentally stumble over its
> favorite pony site (both children sharing a common account).

Yeah, that's a valid usecase which will be rendered impossible if this happens.

> AFAICT parental control is mostly about not allowing certain URLs and not about
> forcing history to be undeletable.

It is in fact far more extensive than that, but like I said we only implement the download manager part.  So, I stand corrected.

> > I think there will be a number of parents which will get affected by this.
> 
> How exactly? All the logging already happens outside of Firefox, so why not let
> children learn about privacy issues earlier on?

No logging is done outside of Firefox (not by Parental Controls at least).  My point is that if someone sets up Parental Controls on their kid's account, they probably want to control how the kid uses the computer (including the web).  So, if a browser allows the kid to use an invisibility cloak, it has violated the expectation of the parents by performing an action (allowing the private browsing mode).
(In reply to comment #4)
> I think a point here is to not give a false sense of security with PB mode when
> it's known to not be private at all. I could also see how some parents would be
> annoyed if it appeared that this circumvented their settings, even if it
> didn't.

Because the logging doesn't currently happen, there is no false sense of security.

> Ideally the ability to disable PB mode (and/or all history clearing) would just
> be exposed to the parental controls for people to decide on their own, but I
> don't know how much leeway parental controls gives us here. Can an option just
> be added to the parental controls panel?

No, as far as I know it's supposed to work the other way around: the OS defines some settings, and various apps read and obey those settings.
Based on this then I would agree with you, disabling PB with parental controls on seems like the best option available. However you said that "the current implementation only blocks downloads" (looks like logging is bug 372905), so if users can still clear their history and browse without logging via parental controls then there's no point to disabling PB mode as-is. Blocking the clearing of history while under parental controls would be a perquisite to this.
I think the ideal route here may be to fully support logging first and then disable PB mode only when logging is enabled. Beyond that I think just having an about:config pref to disable PB mode and/or history clearing should be enough.

What does IE8 do here? If we're talking specifically about user expectations of PB modes under MS parental controls, then we should probably go along with what MS does itself.
(In reply to comment #8)
> I think the ideal route here may be to fully support logging first and then
> disable PB mode only when logging is enabled. Beyond that I think just having
> an about:config pref to disable PB mode and/or history clearing should be
> enough.

Hmm, this is a valid point, although I think the about:config pref may not be the best way to do it.

> What does IE8 do here? If we're talking specifically about user expectations of
> PB modes under MS parental controls, then we should probably go along with what
> MS does itself.

They seem to disable their InPrivate Browsing mode under parental controls, like I said in comment 0.
(In reply to comment #9)
> Hmm, this is a valid point, although I think the about:config pref may not be
> the best way to do it.

Maybe create an extension that can lock in these settings requiring a password to change things.

> They seem to disable their InPrivate Browsing mode under parental controls,
> like I said in comment 0.

Ah sorry, missed that. Do you know if it's disabled on any parental controls being on or just certain ones? I would still argue that disabling ours entirely on any parental controls being on seems a bit wrong, but users may expect it to be disabled nonetheless.
(In reply to comment #10)
> Ah sorry, missed that. Do you know if it's disabled on any parental controls
> being on or just certain ones? I would still argue that disabling ours entirely
> on any parental controls being on seems a bit wrong, but users may expect it to
> be disabled nonetheless.

I haven't tested this myself, but from what I read on their web page it seems that it's disabled with parental controls being turned on itself.

Note that parental controls has a global on/off setting, and once it's on, there are some options to configure (and some defaults value), so acting on the mode being on is not that strange.
I'm pretty pro-privacy, and don't like mechanisms that disenfranchise people's ability to control their information, even if they are beneath the age of majority. Helpfully, many of these approaches are sufficiently poorly implemented that kids just route around them anyhow.

Having said that, though, parental controls of various stripes are a thing that exists, and that many people employ, many of those no doubt our users. Electing not to respect those controls in the expected ways because we don't like them is not the best thing for our users. Electing not to implement this support because there are other ways to delete information also feels like it misses the point.

We should do this because parents who have decided to use parental controls shouldn't be forced to use IE to have them respected.  I agree that this is not our only bug wrt parental controls, but the fact that we have missing support in other places doesn't justify shelving the specific support that Ehsan is talking about here.  I'm not saying that that is your argument, Dave, I just want to dispense with it here in case it should be suggested, because I think Ehsan's proposal to respect those controls is a contained, incremental improvement that we shouldn't bog down with re-architecture.
Oh, I'm sure this is all circumventable one way or another, but that's actually irrelevant to this discussion.  ;)

I agree with your reasoning here, and as you noted I'm not actually against just disabling PB fully under parental controls. I'm in favor of fully supporting the controls in a better way and disabling PB under certain circumstances, however I know full well that isn't necessarily going to happen for 3.1. I guess the best way I could describe my opinion on simply disabling PB mode under parental controls would be to call it a placebo. It won't actually do anything substantive; users can still wipe their histories at will. However, some parents will expect it to be disabled so in this case a placebo might be the best course of action available.
The decision seems simple. We shouldn't disable the feature because it's a placebo. We should only disable the feature when there's an actual conflict of our support for Parental Controls.

So far, we've not received many (or any?) enhancement requests to implement the logging service required to generate parental control activity reports. That tells me that this Vista feature isn't being commonly used. If someone wants to attack bug 372905, they should by all means do so, and once we're reporting that information to the OS, we should probably ensure that this bug is taken in order to not give the user a false sense of privacy.

I actually want to make sure that the parental control we do monitor is the web filter; that seems far more relevant to parents, to me, than being able to get a list of visited URIs.

Removing uiwanted, adding dependency on bug 372905.

(Philisophically, I tend to be swayed by Johnath's arguments: we must act in the best interests of the user, and the user must be considered to be the owner/administrator of the system as well as the user of the application. Should the administrator feel the need to monitor the usage of their users, we should respect that - but we should also make it clear to the user that such monitoring is taking place. I'm quite sure that the Add-On space will provide a suitable solution for those who wish to actively circumvent such monitoring)
Depends on: 372905
Flags: wanted-firefox3.1? → wanted-firefox3.1-
Keywords: uiwanted
(In reply to comment #14)
> So far, we've not received many (or any?) enhancement requests to implement the
> logging service required to generate parental control activity reports. That
> tells me that this Vista feature isn't being commonly used.

In all fairness, this could just as easily be interpreted that users don't use Firefox if they really want the full Vista parental controls and thus don't bother to complain to us. (i.e. if you don't build it, they won't come)

Of course for all we know most parents just use other parental control software that doesn't rely on Firefox doing something for it. I actually find Vista's method to be a little odd; relying in any part on other software to enact your not-necessarily-clear rules sounds like a good way to... not work.
This is a pretty difficult bug to provide a UX opinion on, because there are two users, and they both want exactly opposite things to happen.

We can of course recommend that people who want logging (or don't want logging) install an extension, but that doesn't help us choose the best default behavior.

>(Philisophically, I tend to be swayed by Johnath's arguments: we must act in
>the best interests of the user, and the user must be considered to be the
>owner/administrator of the system as well as the user of the application.

If you are running with an account where parental controls are turned on, can you even install Firefox?  If it is impossible to install Firefox when running in this type of account, the decision becomes clearer, because we can now more or less establish that the user who installed Firefox is a parent who wishes to lock down their computer, and we can do what they want.

However, if you can install Firefox, then we are back to it being difficult for Firefox to always serve the needs of the user (regardless of what those needs are), because we can't figure out who our user is.  I'll pull out my Vista machine to check how this works.
I'm apparently running Vista business, so I can't play around with the feature.  Here is another way to look at the trade off:

If the administrator turns on logging, we have no choice but to disable private browsing because we don't want to give the user a false sense of confidence.

However, I think we should only consider implementing this bug if we also implement 372905, because otherwise we would be potentially disabling private browsing mode for no reason (especially since I believe logging is off by default).
(In reply to comment #17)
> I'm apparently running Vista business, so I can't play around with the feature.

Wow, MS really does love nickle and diming its users to death.  :/

Is implementing logging support for 3.1 a reasonable possibility? I wouldn't think it'd need any string or other GUI changes.
fwiw an administrator account can't have parental controls turned on for it, only a standard account (which can't install programs). Of course you could always tweak the policies to make a standard account capable of installing programs, but that still means that the administrator had to create the account...
Bug 372905 was filed a while back to cover the logging issue.
(In reply to comment #16)
> If you are running with an account where parental controls are turned on, can
> you even install Firefox?  If it is impossible to install Firefox when running
> in this type of account, the decision becomes clearer, because we can now more
> or less establish that the user who installed Firefox is a parent who wishes to
> lock down their computer, and we can do what they want.

By default, you can't install to the program files folder, but you can install Firefox to your user directory for example (just tested it).
As much as I disdain preferences, so far the only way I've thought of to figure out who the user is would be to have Firefox on the side of the first person who installs it.  So, some type of (vista only) installation pref: [] enable parental controls
Only really matters once bug 372905 is fixed.

Alex, that's kinda wacky.  The administrator wins, that's just how computers work.  Let's not try to change that paradigm. :)
Priority: -- → P4
Target Milestone: --- → Future
How about this? why don't we allow an option in about:config to disable private browsing mode.  Thats a start isn't it?  Right now about:config only offers 2 private browsing options: 
browser.privatebrowsing.autostart (which defaults to false)
and
browser.privatebrowsing.dont_prompt_on_enter (which defaults to false)
Please see comment 23.  Until bug 372905 is fixed, this issue is moot.
I do SUMO and MozillaZine support every day of the week, parents are very upset with not having a method of turning Private Browsing off. Some mothers see this feature solely for viewing porn, is that the reputation that Mozilla wants for Firefox? The porn browser?
Currently deleting "nsPrivateBrowsingService.js" is the fix that is circulating the forums, is that what we want parent users to do to be comfortable with their children using Firefox?
This Bug has been going for over 9 months now, an official fix is needed for Firefox 3.6 - any kind of preference that a parent can set, even if it isn't perfect.
Bug 372905 is 2 1/2 years old and hasn't been assigned to anyone, waiting for that to go anywhere is foolish, IMO. How many users is Firefox going to lose by the time an elaborate fix to work with Vista is created and tested?
(In reply to comment #26)
> I do SUMO and MozillaZine support every day of the week, parents are very upset
> with not having a method of turning Private Browsing off. 

That common now? Add the common-issue keyword if it has become a big sticking point on SUMO.

> Some mothers see this feature solely for viewing porn, is that
> the reputation that Mozilla wants for Firefox? The porn browser?

Every major browser has a private browsing mode now, and the mode is by no means only for that. Calling it "Guest Mode" would also be appropriate.

> Currently deleting "nsPrivateBrowsingService.js" is the fix that is circulating
> the forums, is that what we want parent users to do to be comfortable with
> their children using Firefox?

Don't tell them to start deleting files like that. You could probably come up with some user chrome CSS to get rid of some menu items you don't want or something.

Please see comment 13 and after. Unless all ability to clear any history items is also removed, there's no point in disabling PB mode. You'd not actually remove the ability to cover your tracks; just the newest feature to do so. Of course, I guess you could then make the argument that other history clearing methods should be disabled along with PB when there's parental controls on, but there'd still be other ways to clear the history manually.

The core issue, no matter how you put it, is still bug 372905. Firefox does not fully support the parental controls as of yet. Anything done with respect to this stuff is really just window dressing until that's done. Disabling all this might appease some parents, but their kids wouldn't really lose what they're trying to take away.

> This Bug has been going for over 9 months now, an official fix is needed for
> Firefox 3.6 - any kind of preference that a parent can set, even if it isn't
> perfect.
> Bug 372905 is 2 1/2 years old and hasn't been assigned to anyone, waiting for
> that to go anywhere is foolish, IMO. How many users is Firefox going to lose by
> the time an elaborate fix to work with Vista is created and tested?

Arguing for the placebo, are we? ;)
(In reply to comment #27)
> Please see comment 13 and after. Unless all ability to clear any history items
> is also removed, there's no point in disabling PB mode. You'd not actually
> remove the ability to cover your tracks; just the newest feature to do so. Of
> course, I guess you could then make the argument that other history clearing
> methods should be disabled along with PB when there's parental controls on, but
> there'd still be other ways to clear the history manually.
> 
Sir,

I do not want to give 'guests' complete privacy.  I want to be able to know that they have done something private as evidenced by the lack of a browser history.  I never clear my browser history.  If I have a babysitter, I check my browser history after I come back, if it is in tact, I can be pretty sure that the babysitter did nothing of which I would disapprove.  If the browsing history is deleted, the babysitter is not called again.  Private browsing allows the babysitter to defeat this simple method of detection.
David, can you please confirm if this is a common issue on SUMO, or redirect to another person on the SUMO team who can?
davidbear1961: Please read the portion you quoted. As it currently stands, your babysitter can just clear the last hour of their history without clearing the rest and you would never know. Your simple method of detection is already defeated, regardless of PB mode. That's my point.

As has been stated above, you, as the admin, get to decide how to handle this. You're just not given you the tools to do so yet. The problem is that until parental controls are correctly supported it doesn't make much sense to half-ass it and disable one way to cover tracks but not all the others. Logging should be supported and when that's on all history altering should be disabled, including PB mode, CRH dialog, forget this site, etc. Someone just needs to be tracked down to actually implement all that.
Trying to get a better grasp of what people are asking for here.  If a user goes to the library window, views history, and then right clicks on an item, are "Delete this Page" and "Forget about this Site" disabled as well?  So instead of mandatory history non-collection (private browsing mode), you would like mandatory history collection?
Pretty much. Whenever Windows' Parental Controls are set to log activity (bug 372905) Firefox would disable all features that allow the user to hide that activity to reflect the presiding OS setting. This would get rid of the privacy tools the parents/admins don't want and would avoid giving users a false sense of privacy with tools that won't be able to protect them.
Summary: Disable Private Browsing mode when parental controls are enabled → Disable Private Browsing mode and all history clearing when parental controls are enabled
Dave, can you please file individual bugs for other history clearing tools?  Let's keep the individual scope of each bug small.
Summary: Disable Private Browsing mode and all history clearing when parental controls are enabled → Disable Private Browsing mode when parental controls are enabled
Depends on: 536644
Depends on: 536645
(In reply to comment #33)
> Dave, can you please file individual bugs for other history clearing tools? 
> Let's keep the individual scope of each bug small.

Sure. Filed individual bugs:
bug 536644 & bug 536645
(In reply to comment #29)
> David, can you please confirm if this is a common issue on SUMO, or redirect to
> another person on the SUMO team who can?

Cc'ing Cheng for verification, but I'd be very surprised if this is a commonly requested feature/issue on SUMO.
SUMO threads where the OP requested help with disabling Private Browsing.
https://support.mozilla.com/en-US/forum/1/539638
https://support.mozilla.com/en-US/forum/1/501877
https://support.mozilla.com/en-US/forum/1/518817
https://support.mozilla.com/en-US/forum/1/433188
https://support.mozilla.com/en-US/forum/1/530288
https://support.mozilla.com/en-US/forum/1/412782
https://support.mozilla.com/en-US/forum/1/425305
https://support.mozilla.com/en-US/forum/1/427985
https://support.mozilla.com/en-US/forum/1/493576
https://support.mozilla.com/en-US/forum/1/489497
https://support.mozilla.com/en-US/forum/1/434922
https://support.mozilla.com/en-US/forum/1/411696
https://support.mozilla.com/en-US/forum/1/461387
https://support.mozilla.com/en-US/forum/1/412556
https://support.mozilla.com/en-US/forum/1/527453
https://support.mozilla.com/en-US/forum/1/517285
https://support.mozilla.com/en-US/forum/1/418788
https://support.mozilla.com/en-US/forum/1/463519
https://support.mozilla.com/en-US/forum/1/424997
https://support.mozilla.com/en-US/forum/1/378652
https://support.mozilla.com/en-US/forum/1/404854
https://support.mozilla.com/en-US/forum/1/401697
https://support.mozilla.com/en-US/forum/1/401697
https://support.mozilla.com/en-US/forum/1/386654
https://support.mozilla.com/en-US/forum/1/433443
https://support.mozilla.com/en-US/forum/1/459993
https://support.mozilla.com/en-US/forum/1/380218
https://support.mozilla.com/en-US/forum/1/489467
https://support.mozilla.com/en-US/forum/1/472409
https://support.mozilla.com/en-US/forum/1/481651
https://support.mozilla.com/en-US/forum/1/514014
https://support.mozilla.com/en-US/forum/1/468791
https://support.mozilla.com/en-US/forum/1/435753
https://support.mozilla.com/en-US/forum/1/472411
https://support.mozilla.com/en-US/forum/1/474374
https://support.mozilla.com/en-US/forum/1/478200
https://support.mozilla.com/en-US/forum/1/492436
https://support.mozilla.com/en-US/forum/1/499753
https://support.mozilla.com/en-US/forum/1/501877
https://support.mozilla.com/en-US/forum/1/469616
https://support.mozilla.com/en-US/forum/1/456388
https://support.mozilla.com/en-US/forum/1/485721
https://support.mozilla.com/en-US/forum/1/502474
https://support.mozilla.com/en-US/forum/1/537398
https://support.mozilla.com/en-US/forum/1/514776
https://support.mozilla.com/en-US/forum/1/436796
https://support.mozilla.com/en-US/forum/1/515423
https://support.mozilla.com/en-US/forum/1/388278
https://support.mozilla.com/en-US/forum/1/458758
https://support.mozilla.com/en-US/forum/1/463561
https://support.mozilla.com/en-US/forum/1/386619
https://support.mozilla.com/en-US/forum/1/527618
https://support.mozilla.com/en-US/forum/1/478844
https://support.mozilla.com/en-US/forum/1/404877
https://support.mozilla.com/en-US/forum/1/463951
https://support.mozilla.com/en-US/forum/1/408051
https://support.mozilla.com/en-US/forum/1/480162
https://support.mozilla.com/en-US/forum/1/380380
https://support.mozilla.com/en-US/forum/1/511426
https://support.mozilla.com/en-US/forum/1/409514
https://support.mozilla.com/en-US/forum/1/518817
https://support.mozilla.com/en-US/forum/1/412053
https://support.mozilla.com/en-US/forum/1/382590
Thanks the-edmeister. So it's on average 2 requests for this per week.
probably a little more than that because a bunch of people post in those threads saying "I want this too"
Ehsan, we've had a few requests for this feature come to security@mozilla.org as well.  Do you have plans/bandwidth to work on it, or would you prefer that I look for someone on our team to implement it?
(In reply to comment #39)
> Ehsan, we've had a few requests for this feature come to security@mozilla.org
> as well.  Do you have plans/bandwidth to work on it, or would you prefer that I
> look for someone on our team to implement it?

We had one conversation with Beltzner and Johnath about whether we want to do this, and if so, how.  I think it's still too soon to think about the implementation cost.  I can take it most likely, but we first need to come up with a decision on how we want to proceed here.

Maybe we should set up a meeting with all the interested parties for discussing this?
There is a new extension at https://addons.mozilla.org/en-US/firefox/addon/disable-private-browsing/ that disables Private Browsing. Of course a savvy teenager can still remove this extension, but it might work for some people in some cases.
This should be really straightforward, shouldn't it?

A simple preference that turns it on and off that can be locked.
So did we ever implement parental controls logging?
(In reply to Ehsan Akhgari [:ehsan] from comment #43)
> So did we ever implement parental controls logging?

Apparently the OS does this automatically so no work was done in FF to enable it.

There are probably two separate issues here.

1. Disable private browsing when parental logging is enabled.

2. Provide a way to disable private browsing completely.
Based on the discussion here, I'd tending to think that 2 is WONTFIX.  1 should be implemented to disable the private browsing mode *only* when parental controls logging is enabled.
um, no.

providing a way to disable private browsing independent of parental controls is very important.

did you not see comment 36?
Under what circumstances would we disable private browsing mode?  And is that going to be based on a preference which users would be able to disable?

This is a circular problem, if we provide a way for disabling private browsing mode, is it targeted at parents disabling it for their children (which is the topic of this bug)?  Would that be a responsible thing to do for our users?  Would that mean that the children (the user) should not be able to override that setting?

And if we implement it in a way that users can override, what would be the point?
The goal here is to provide a basic way to disable private browsing that a child would not be able to easily override.

Having a hidden preference is enough to do that.

A parent could also choose to lock that preference or prevent access to about:config.

I'm sorry, but I don't consider a 5 year old a user that we are catering to here. The needs of the parent should outweigh the needs of the children.
(In reply to Michael Kaply (mkaply) from comment #48)
> The goal here is to provide a basic way to disable private browsing that a
> child would not be able to easily override.

FWIW, that is not what this bug was filed for exactly.

> I'm sorry, but I don't consider a 5 year old a user that we are catering to
> here. The needs of the parent should outweigh the needs of the children.

I think different people have different opinions about this.  See comment 12 for example.

Personally I've swung between both sides of this argument, and I'm not sure I'm feeling very strongly towards any of them, but I find something very wrong about considering some people as lesser users based on their age...  :/
> I find something very wrong about considering some people as lesser users based on their age...  :/

I guess you aren't a parent.
So looking at the current specification for parental controls in Windows 7, I see no reference to logging:

http://windows.microsoft.com/en-US/windows7/Set-up-Parental-Controls

As a separate data point, IE does provide a way to turn off access to their private browsing.

http://helpdeskgeek.com/how-to/disable-turn-off-inprivate-browsing-ie-8/

I think this requirement should be decoupled frmo the parental controls features and simply be "Provide a way to disable private browsing"
Chrome provides a way to disable incognito mode as well

http://code.google.com/p/chromium/issues/detail?id=80494
(In reply to Michael Kaply (mkaply) from comment #50)
> > I find something very wrong about considering some people as lesser users based on their age...  :/
> 
> I guess you aren't a parent.

I am not, but I don't see what that has to do with what I said here.  Please let's keep this discussion technical.

If you want a generic way to disable private browsing, please file a new bug.  This would help not diverge this bug into two issues.
(In reply to Ehsan Akhgari [:ehsan] from comment #53)
> I am not, but I don't see what that has to do with what I said here.  Please
> let's keep this discussion technical.

Should have been a smiley face on that. Sorry to be snarky.

I've opened bug 749400 for a way to disable private browsing.

I believe that this bug should be closed as WONTFIX.

The logging feature referenced here doesn't work and I see no reason to tie private browsing to parental control considering Microsoft doesn't do that with IE.
data point: Chrome disallows Incognito mode if parental logging has been turned on:

   https://code.google.com/p/chromium/issues/detail?id=133560

The justification is that they shouldn't be advertising a browser window as private when its history is being actively tracked by the OS.  That makes sense to me FWIW.  So we'll be the only major browser on Windows that Thinks Different here (RIP Safari for Windows :) unless/until we fix this.

Also note the API weirdness of GetRestrictions() in bug 1087182.  I'm not clear on whether the windows >= 8 requirement is needed only for WPCFLAG_WEB_FILTERED to be detected accurately, or whether that's true for WPCFLAG_LOGGING_REQUIRED as well.
Here's the answer from my source at Microsoft on WPCFLAG_LOGGING_REQUIRED: "The WPCFLAG_WEB_FILTERED flag is not reliable on Win7. I can’t say for certain about the WPCFLAG_LOGGING_REQUIRED. You’d have to test that to see. Similarly, I am not sure how reliable the flags are on Vista. Family Safety was part of the OS in Vista [on windows 7 portions of Web Filter was available as a Windows Live package that had to be downloaded to the PC], so presumably, they would be more reliable there but again you’d want to test."

I don't recall seeing any OS version check in the patches for Chrome's fix here, but I didn't look at all the versions.
See Also: → 749400
For some reason, in macos high sierra, whenever you go into private browsing mode, system parental controls fail to filter adult websites in Firefox. In Safari, the parental controls stay on, even in private mode. System parental controls should stay on in Firefox.
Severity: normal → S3
Type: defect → enhancement
You need to log in before you can comment on or make changes to this bug.