672352 - Explain how Firefox uses permissions in Android Market description

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: General, defect, P2)

Description

[Matt Brubeck (:mbrubeck)]

Android applications must request permission at installation time to perform certain activities.  For Firefox, some of these permissions are:

* Fine (GPS) location -- Firefox 4 and later
* Read phone status and identity -- Firefox 8 and later (bug 667980)
* Read contact data -- Not yet landed, possibly Firefox 8 and later (bug 583242)

Some users have already been confused or sent negative feedback about the location permission.  As we add permissions, even more users will think or worry that Firefox is misusing their data.  "Read phone status and identity" is often used for tracking by advertisers, and "contact data" is obviously highly sensitive and users should be reluctant to share it.

Since the permission request is usually encountered within the Android Market app or web site, I think this is the best place to explain to users how Firefox uses these permissions while respecting their privacy.  I suggest adding a paragraph like the following to our Android Market description:

"About permissions: GPS location is used only when you choose to share your location with a web site. Phone state and identity is used only to change settings based on your network speed. Contact data is used only to provide suggestions when filling out forms."  (The last sentence should be added only after bug 583242 ships.)

If we can't make space for all that, then a pointer to our privacy policy might be better than nothing.  However, the Android Market does not allow hyperlinks, so I expect that far fewer people would read it in that case.

Comment 1

[Irina Sandu]

Adding Jaclyn

And my perspective:


I think it is good to address the overall topic of security in Android and mobile, which is likely to get even more interest going forward. I think that security can be one of our differentiators in a market where one of our main competitor is a proxy browser and it is good to be talking about it more broadly.

Concerning permissions on Android particularly, it might be that the Android description is not read by a lot of users, but there are a series of other places where we can communicate this: in-product after install or in the menu settings, in "About", on the product page, on SUMO.

Comment 2

[Jesse Ruderman]

If we describe our use of the permissions in our Android Market description, are we barred from making new uses of the data in future versions, even if the new uses are just as privacy-preserving?

In general, Firefox addons are not prevented from abusing these permissions. (Maybe AMO enforces some rules, and pure-JS extensions only get to use our APIs, but that's a lot to explain.) Do we need to mention this?

> GPS location is used only when you choose to share your location with a web site

We might want to present the language list in a different order depending on your country. If you type "Port Washington" into an <input type="-moz-place">, we might want to disambiguate to the one nearest you before submission.

> Phone state and identity is used only to change settings based on your network speed.

"Change settings" is vague. How about "Phone state and identity is used only to detect your network type. Firefox tries to conserve bandwidth on slow & metered connections."

In the future, we might want to mute web page sounds when you're on a phone call, or throttle animations when you're below 20% battery.

> Contact data is used only to provide suggestions when filling out forms.

The word "form" means different things to different people, and it's being used less often on the web now that we have AJAX and JS APIs.

Comment 3

[Jesse Ruderman]

"Mozilla is committed to your privacy. Firefox currently uses scary-sounding permissions only in order to: ..."

Comment 4

[Matt Brubeck (:mbrubeck)]

Nominating for tracking because this affects marketing deliverables for the Firefox 8 beta and final releases.

Comment 5

[Matt Brubeck (:mbrubeck)]

(In reply to Matt Brubeck (:mbrubeck) from comment #0)
> If we can't make space for all that, then a pointer to our privacy policy
> might be better than nothing.  However, the Android Market does not allow
> hyperlinks[...]

The latest version of the Android Market does make URLs into links, so it is now possible for us to add a link to the privacy policy or other pages with more details.

Comment 6

[Ian Melven :imelven]

fwiw, i really like the idea of a wiki/web page somewhere discussing the security/privacy aspects in Fennec (since there are many cool things we are doing that we could promote, DNT, clearing site data and listing what data a site has that i just saw in Nightly's tablet UI, etc.) and linking to the privacy policy as well. 

we could also document caveats around things like SD card usage as well here.

Comment 7

[Thomas Arend [:tarend]]

My proposal is to add a section "Meet your new mobile browser" (to be rephrased) to the new redesigned about:home (see Bug 669166) and to keep it there for a few days after installation or upgrade. That link / button would link to a page that shows (1) new and important features (with links to most recent release notes and to http://www.mozilla.org/en-US/mobile/features/), (2) How Firefox protects your privacy. (2) could describe (a) DNT and related features, (b) have a section "Permissions explained" as requested here. Ian will link potential design proposals to Bug 669166 .

Comment 8

[Matt Brubeck (:mbrubeck)]

(In reply to Thomas Arend [:tarend] from comment #7)
> My proposal is to add a section "Meet your new mobile browser" (to be
> rephrased) to the new redesigned about:home (see Bug 669166) and to keep it
> there for a few days after installation or upgrade.

My main concern about scary permissions is that users see them (and must agree to them) before installing the browser, so they will prevent some users from installing the browser at all.  If this is indeed a problem, then it can't be addressed post-installation.

Comment 9

[Ian Melven :imelven]

(In reply to Matt Brubeck (:mbrubeck) from comment #8)
> (In reply to Thomas Arend [:tarend] from comment #7)
> > My proposal is to add a section "Meet your new mobile browser" (to be
> > rephrased) to the new redesigned about:home (see Bug 669166) and to keep it
> > there for a few days after installation or upgrade.
> 
> My main concern about scary permissions is that users see them (and must
> agree to them) before installing the browser, so they will prevent some
> users from installing the browser at all.  If this is indeed a problem, then
> it can't be addressed post-installation.

perhaps we can put a link to this forthcoming page to the description in the Market and kill two birds with one stone ? (perhaps specifying also in the Market description to follow the link for more information about permissions used as well the other things tarend mentioned)

Comment 10

[Ian Melven :imelven]

current release on the Android Market also asks for (in addition to the ones mentioned by mbrubeck in the initial bug description) : 

* Storage - Modify/delete SD card contents (i assume this is for moving the app/profile to the SD card if the user wishes to)

* Network communication - Full Internet access (hopefully obvious ?)

* System Tools - Install shortcuts (i assume this is for web apps, both as current and as planned for the future)

the current Beta on the Android Market asks for the same set of permissions also

Comment 11

[Doug Turner (:dougt)]

note:

with flash support pending, we will add new feature requests required by the adobe plugin.

Comment 12

[Jaclyn Fu]

Hi all,

I'm currently updating the mobile FAQ and thought we could explain some of the scary permissions this section.  Thoughts?

Which of these permissions should be highlighted?

Comment 13

[Ian Melven :imelven]

(In reply to Jaclyn Fu from comment #12)
> Hi all,
> 
> I'm currently updating the mobile FAQ and thought we could explain some of
> the scary permissions this section.  Thoughts?
> 
> Which of these permissions should be highlighted?

i think it would be great to put these in the mobile FAQ. IMO, 
'Fine (GPS) location' and 'Read phone status and identity' are the two that are potentially scary to users and need explanation as to why we want them and how we use them. 'modify/delete sd card contents' might be in there too, i assume this is used for writing/modifying profile data stored on the SD card if the user chooses to move the app to the SD card (and possibly saving downloads?). I checked with a friend @ google and they told me this perm is not related to moving the app to the sd card itself, as i thought above.

Comment 14

[Matt Brubeck (:mbrubeck)]

Less than a day after Firefox Beta 8.0 was released, we are already receiving questions/complaints about the "Phone status and identity" permission.  I really think that we should put something about this in the Market description.

Comment 15

[Jaclyn Fu]

I don't think the description is the place for this information, but do agree that we should address these concerns in a different place.  Michelle, we can work together on a SUMO page? Or it could even be a Wiki page.

I propose adding this link to the description instead including in the copy text since it will detract from overall messaging.  But since users reach the permissions notification as they're installing, I'm not sure if they will go back into the Android Market description to find their answers, I'm guessing they'll do a Google search (where the SUMO article would be found)

Comment 16

[Matt Brubeck (:mbrubeck)]

I filed bug 691054 to remove the "Phone state and identity" permission.

Comment 17

[Ian Melven :imelven]

(In reply to Jaclyn Fu from comment #15)
> I don't think the description is the place for this information, but do
> agree that we should address these concerns in a different place.  Michelle,
> we can work together on a SUMO page? Or it could even be a Wiki page.
> 
> I propose adding this link to the description instead including in the copy
> text since it will detract from overall messaging.  But since users reach
> the permissions notification as they're installing, I'm not sure if they
> will go back into the Android Market description to find their answers, I'm
> guessing they'll do a Google search (where the SUMO article would be found)

the description on the market currently links to http://support.mozilla.com/en-US/mobile#os=android&browser=m7 which has a few FAQs on it. i suggest linking a SUMO article there via a question on permissions perhaps. i'm happy to help with the article also.

Comment 18

[Matt Brubeck (:mbrubeck)]

(In reply to Jaclyn Fu from comment #15)
> I don't think the description is the place for this information, but do
> agree that we should address these concerns in a different place.  Michelle,
> we can work together on a SUMO page? Or it could even be a Wiki page.

Adding a link is fine, as long as it is fairly prominent in the description, and the description text says that the link has to do with permissions.  ("Questions about app permissions? See the FAQ at...")

> But since users reach the permissions notification as they're installing,
> I'm not sure if they will go back into the Android Market description to
> find their answers, I'm guessing they'll do a Google search (where the SUMO
> article would be found)

Many users - especially most first-time installers - will be coming from the description to get to the install dialog, and will automatically return to the description if they cancel or complete the installation.   This is why explaining permissions in the description is a fairly common practice for Android Market publishers.

Our Firefox Beta reviews are getting hammered by permissions-related complaints at the moment, by the way.

Comment 19

[Matt Brubeck (:mbrubeck)]

"Read phone state and identity" has been removed from Firefox 8/9/10 (bug 691054).

"Hardware controls: Take pictures and video" has been added in Firefox 9 (bug 659188).

"Your personal information: Read sensitive log data" was added in Firefox 9 because it is required by the Adobe Flash plugin (bug 630007).

Comment 20

[Ian Melven :imelven]

SUMO article published at https://support.mozilla.com/en-US/kb/how-firefox-android-use-permissions-it-requests

Comment 21

[Jaclyn Fu]

Thanks!

Will show up in the Android description as:


For a complete list of features, check out http://mozilla.org/mobile/features/. 

Have questions or need help? Visit http://support.mozilla.org/mobile. 

The Firefox browser works on most Android devices. See if it works on yours: http://www.mozilla.org/mobile/platforms/

Want to know more about the permissions Firefox requests? http://mzl.la/FirefoxPermissions

Comment 22

[Ian Melven :imelven]

(In reply to Jaclyn Fu from comment #21)
> Thanks!
> 
> Will show up in the Android description as:
> 
> 
> For a complete list of features, check out
> http://mozilla.org/mobile/features/. 
> 
> Have questions or need help? Visit http://support.mozilla.org/mobile. 
> 
> The Firefox browser works on most Android devices. See if it works on yours:
> http://www.mozilla.org/mobile/platforms/
> 
> Want to know more about the permissions Firefox requests?
> http://mzl.la/FirefoxPermissions

i saw this is live in the Android Market, awesome !

can we (should we) resolve this bug ? we have the SUMO page live and the market linking to it, plus a blog post from mbrubeck that covers the recent 'phone state and identity' change.

Comment 23

[Jaclyn Fu]

I'm OK with closing it out.  Let's continue to monitor if we still get any user feedback.  

Thanks!

Comment 24

[Arun Raghavan]

Two things:

1. Can this be added to the FF beta as well?

2. The permissions page does not talk about the need to access the system log (which is a pretty large concern)

Comment 25

[Ian Melven :imelven]

(In reply to Arun from comment #24)
> Two things:
> 
> 1. Can this be added to the FF beta as well?

Arun, do you mean : add the link to the FF beta Android Market description ? i don't see it there so i'm assuming so. 

> 2. The permissions page does not talk about the need to access the system
> log (which is a pretty large concern)

this was added in FF9 which went to Firefox Beta on the Android Market a few days ago - it seems like we need to update the permission page for Beta. "Hardware controls > Take pictures and video" was also added in FF9.

For now, i'm reopening this to get the link added to the Firefox Beta Market page and also to update the SUMO page with the new permissions.

Comment 26

[Arun Raghavan]

(In reply to Ian Melven :imelven from comment #25)
> (In reply to Arun from comment #24)
> > Two things:
> > 
> > 1. Can this be added to the FF beta as well?
> 
> Arun, do you mean : add the link to the FF beta Android Market description ?
> i don't see it there so i'm assuming so. 

Yes, that's what I meant.

Comment 27

[Matt Brubeck (:mbrubeck)]

The new Fx9 permissions are covered in the latest version of https://support.mozilla.com/en-US/kb/how-firefox-android-use-permissions-it-requests#os=android&browser=m9

We may be removing most of the new permissions added in Fx9 and Fx10; see bug 702183 and also bug 679966 comment 143.

Comment 28

[Robert Pollak]

(In reply to Jaclyn Fu from comment #21)
> Will show up in the Android description as:
[...]
> Want to know more about the permissions Firefox requests?
> http://mzl.la/FirefoxPermissions

This link is still missing in the German localization of the description. Btw, the linked page lists the permission "System Tools - Install shortcuts", which I am not asked for when installing FF 9.0 on my Galaxy Nexus.

Comment 29

[Jaclyn Fu]

We were still tweaking the descriptions - the current en-US description has not been translated to all locales yet

Comment 30

[Aaron Train [:aaronmt]]

There are also now Sync permissions which can be added to that SUMO doc.

http://mxr.mozilla.org/mozilla-beta/source/mobile/android/sync/manifests/SyncAndroidManifest_permissions.xml.in

Comment 31

[Jaclyn Fu]

Link to permissions has been added to the description copy

Comment 32

[Matt Brubeck (:mbrubeck)]

I think all the open actions are complete.  Let's open new bugs for any further changes.