Re: Private Browsing UI
Mike Beltzner
> One of the (currently unowned) features in the Firefox 3 PRD is
> implementing a private browsing mode. We are still trying to find
> someone to work on this, but in the meantime, I've put a wiki page
> up at http://wiki.mozilla.org/PrivateBrowsing with some mockups so
> we can start discussing the user interface.
Thanks, Alex, for starting these mockups off. Right now the
differences seem to be mostly colour-based, which isn't an accessible
solution, but is a good start. How about instead of just changing the
colour of the location bar, we change the texture used on the entire
surrounding frame of the chrome, turning it into some sort of
construction-zone yellow and black striped texture. Or maybe
different shades of grey to be a bit more subtle.
My feelings on this are that the UI..:
- be on or off, for the entire session, not just a single window or
tab
- as you mention, be clearly scoped and defined; I think having the
content area blocked and overlaid with a message explaining the scope
of the mode which users need to confirm with a click (always, no
"don't show me this again")
- shouldn't offer to save passwords, create bookmarks, or do other
things which leave a constant footprint; I don't think this should
become a "private mode profile" feature
cheers,
mike
Mike Connor
Having had a few recent discussions on the implementation, I'm going
to propose that we actually launch a second instance of Firefox that
does not, in fact, share profile data at all with your existing
profile. IMO it would be very difficult to make private browsing
truly private if it shared any data with your existing profile. Thus
you could have both private and public sessions running at the same
time, and the second instance would never touch the disk, rather than
getting into "mostly private, but not completely" hell.
-- Mike
Robert Kaiser
> Having had a few recent discussions on the implementation, I'm going to
> propose that we actually launch a second instance of Firefox that does
> not, in fact, share profile data at all with your existing profile. IMO
> it would be very difficult to make private browsing truly private if it
> shared any data with your existing profile. Thus you could have both
> private and public sessions running at the same time, and the second
> instance would never touch the disk, rather than getting into "mostly
> private, but not completely" hell.
Yes, it sounds to me like a separate instance with more or less a
private, in-memory-only, temporary profile sounds the most sane way to
go, I guess anything else would break lots of code in sometimes very
subtle ways as a profile-in-profile or something was never in any
programming concept when writing it.
Robert Kaiser
Gervase Markham
> Thanks, Alex, for starting these mockups off. Right now the differences
> seem to be mostly colour-based, which isn't an accessible solution, but
> is a good start. How about instead of just changing the colour of the
> location bar, we change the texture used on the entire surrounding frame
> of the chrome, turning it into some sort of construction-zone yellow and
> black striped texture. Or maybe different shades of grey to be a bit
> more subtle.
How important is it that the fact you are in Private Browsing Mode is
not obvious to a casual over-the-shoulder observer?
> My feelings on this are that the UI..:
>
> - be on or off, for the entire session, not just a single window or tab
Yes; having it per-tab makes "accidents" much more likely.
> - as you mention, be clearly scoped and defined; I think having the
> content area blocked and overlaid with a message explaining the scope of
> the mode which users need to confirm with a click (always, no "don't
> show me this again")
I think that's fair. If people want to dodge that, they can install the
"Quick Porn Access" extension.
Oh, sorry, am I stereotyping again? :-)
> - shouldn't offer to save passwords, create bookmarks, or do other
> things which leave a constant footprint; I don't think this should
> become a "private mode profile" feature
Good point. No bookmark creation. Although it's an open question what
you present to the user when they press Ctrl-D.
Gerv
Gervase Markham
> Having had a few recent discussions on the implementation, I'm going to
> propose that we actually launch a second instance of Firefox that does
> not, in fact, share profile data at all with your existing profile. IMO
> it would be very difficult to make private browsing truly private if it
> shared any data with your existing profile. Thus you could have both
> private and public sessions running at the same time, and the second
> instance would never touch the disk, rather than getting into "mostly
> private, but not completely" hell.
While I can see the advantages of this implementation method, it would
probably mean that your existing bookmarks, saved passwords, extensions,
customisations etc. were inaccessible. Which would be a shame.
Gerv
Alex Faaborg
It's not just color, but also includes major changes in brightness,
which for low vision and color blind users should still be
perceptible right? For vision impaired users we need to remember to
change the window title. I've also been thinking about including a
small status label in front of the URL bar that literally says
private: http://people.mozilla.com/~faaborg/files/20070515-
privateBrowsing/stealthMode.jpg
Note: johnath isn't a fan of the privacy door knob icon because it
looks too much like a lock. I think we can get around this problem
by changing the color and making it appear less metallic.
> construction-zone yellow and black striped texture
I'm not getting the construction metaphor. Also, wouldn't that
convey a sense of nervousness? I would like the "stealth mode" theme
to make the user feel at ease, invisible, and sneaky.
> shouldn't offer to save passwords, create bookmarks, or do other
> things which leave a constant footprint
I agree, if we save any type of information the user is going to
start questioning what else is being saved.
-Alex
On May 18, 2007, at 11:58 PM, Mike Beltzner wrote:
> On 16-May-07, at 11:02 PM, Alex Faaborg wrote:
>
>> One of the (currently unowned) features in the Firefox 3 PRD is
>> implementing a private browsing mode. We are still trying to find
>> someone to work on this, but in the meantime, I've put a wiki page
>> up at http://wiki.mozilla.org/PrivateBrowsing with some mockups so
>> we can start discussing the user interface.
>
> Thanks, Alex, for starting these mockups off. Right now the
> differences seem to be mostly colour-based, which isn't an
> accessible solution, but is a good start. How about instead of just
> changing the colour of the location bar, we change the texture used
> on the entire surrounding frame of the chrome, turning it into some
> sort of construction-zone yellow and black striped texture. Or
> maybe different shades of grey to be a bit more subtle.
>
> My feelings on this are that the UI..:
>
> - be on or off, for the entire session, not just a single window
> or tab
> - as you mention, be clearly scoped and defined; I think having
> the content area blocked and overlaid with a message explaining the
> scope of the mode which users need to confirm with a click (always,
> no "don't show me this again")
> - shouldn't offer to save passwords, create bookmarks, or do other
> things which leave a constant footprint; I don't think this should
> become a "private mode profile" feature
>
> cheers,
> mike
Alex Faaborg
> not obvious to a casual over-the-shoulder observer?
In the current designs we are not considering that use case to be
important, although we could enable it with a preference. The
purpose of the rather dramatic theme change is to reduce mode errors,
and to convey a sense of "stealth." Also the dark theme has a day/
night, good/evil, metaphor associated with it.
> Although it's an open question what
> you present to the user when they press Ctrl-D.
Probably the same favicon hanging tab non-modal notification for
quick bookmarks (this will be posted to the Places UI thread soon),
but it has a message explaining that bookmarking is disabled while
private browsing.
-Alex
> _______________________________________________
> dev-apps-firefox mailing list
> dev-apps...@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-apps-firefox
Mike Connor
Why would it be a shame? We could, of course, load bookmarks and
passwords and toolbar config into memory from the parent profile,
though it'd be a one-way copy only. I think, especially in the
extension case, that we'd run the risk of data leaking out, unless we
force all of the APIs that touch disk to obey this pref. The middle
ground is probably not something I would sign off on for Firefox 3,
given the need to make core changes to auth, cookies, and any number
of other things that would need to temporarily set themselves aside,
then come back when you dropped the toggle. It also hits a lot of
odd interactions that would be either painful to spec and implement,
or produce odd behaviours.
I don't like the global toggle concept at all, since I will likely be
logged into sites or retrieving information based on auth/cookie info
from my "non-private" session, and switching modes sucks. Consider
the following setup:
I have GMail Notifier running in my statusbar.
I have the ebay sidebar open, watching my auctions.
I switch into private browsing mode:
* existing auth sessions are set aside
* existing cookie stores/hashtables are set aside (don't want to leak
into private browsing any more than we want to leak out)
My extensions stop working unless I log back in to all of them, as do
any of the sites I'm logged into from separate tabs.
Private Browsing, as an alternate mode (vs. people who just disable
cookies/pwmgr/etc and enable Clear Private Data on shutdown) should
be designed for the task people are looking to do without leaving a
trace. This could be the stereotypical porn viewing, banking
actions, etc. People are not going to context switch globally as
much as they will need to context switch for specific sets of tasks,
and we should design the interaction with that in mind. They should
be able to launch a private session, and even switch between the two
(i.e. I might be filling out a passport or loan application with a
lot of sensitive info, but still want to check gmail, or use my web-
based IM client, etc).
I think that a clear separation is the better choice, overall, in a
task-oriented design.
-- Mike
Mike Shaver
> On 21-May-07, at 5:17 AM, Gervase Markham wrote:
> > probably mean that your existing bookmarks, saved passwords,
> > extensions,
> > customisations etc. were inaccessible. Which would be a shame.
>
It'd be a shame, in my opinion, because it would be conflating "I wish
to not have my browser keep a record of my activities" with "I wish
the browser didn't have any of my customizations, some of which might
in fact be related to privacy or security", because of an
implementation artifact.
Do you think that that conflation is something that users will expect
or enjoy? A low-priv relaunch as "safe mode" with a "delete after
use" option might be closer to what we'd actually be delivering, and
would then get advantage from the implementation choices, rather than
just pain and apologetic workarounds. :)
Mike
Gervase Markham
> It'd be a shame, in my opinion, because it would be conflating "I wish
> to not have my browser keep a record of my activities" with "I wish
> the browser didn't have any of my customizations, some of which might
> in fact be related to privacy or security", because of an
> implementation artifact.
What he said :-)
Gerv
Mike Beltzner
> It's not just color, but also includes major changes in brightness,
> which for low vision and color blind users should still be
> perceptible right? For vision impaired users we need to remember to
> change the window title. I've also been thinking about including a
> small status label in front of the URL bar that literally says
> private:http://people.mozilla.com/~faaborg/files/20070515-
> privateBrowsing/stealthMode.jpg
Yeah, I think a visible label is almost a must. I guess what I'm
saying is that people need to be able to determine at a glance whether
or not they are in the private browsing mode, and I'm pretty sure that
we agree there. Theme customizations are good, explicit indicators
that we can point people to are better.
> Note: johnath isn't a fan of the privacy door knob icon because it
> looks too much like a lock. I think we can get around this problem
> by changing the color and making it appear less metallic.
I'm not sure that people are going to get the door-hanger iconic
metaphor either, but we can experiment there, and we *do* use it for
"privacy" in the preferences UI ...
> > construction-zone yellow and black striped texture
>
> I'm not getting the construction metaphor. Also, wouldn't that
> convey a sense of nervousness? I would like the "stealth mode" theme
> to make the user feel at ease, invisible, and sneaky.
I was going for highly visible and noticable, but your points are well
taken.
cheers,
mike
> > shouldn't offer to save passwords, create bookmarks, or do other
> > things which leave a constant footprint
>
> I agree, if we save any type of information the user is going to
> start questioning what else is being saved.
>
> -Alex
>
> On May 18, 2007, at 11:58 PM, Mike Beltzner wrote:
>
> > On 16-May-07, at 11:02 PM, Alex Faaborg wrote:
>
> >> One of the (currently unowned) features in the Firefox 3 PRD is
> >> implementing a private browsing mode. We are still trying to find
> >> someone to work on this, but in the meantime, I've put a wiki page
> >> up athttp://wiki.mozilla.org/PrivateBrowsingwith some mockups so
Greg Campbell
>> Note: johnath isn't a fan of the privacy door knob icon because it
>> looks too much like a lock. I think we can get around this problem
>> by changing the color and making it appear less metallic.
>
> I'm not sure that people are going to get the door-hanger iconic
> metaphor either, but we can experiment there, and we *do* use it for
> "privacy" in the preferences UI ...
Whoa. I thought that was a lock too. I wondered why "security" is a
closed lock and "privacy" was a poorly-drawn open lock. Now I get it.
But boy is that icon bad.
If the door hanger is a must, probably should draw the door too. A least
the knob.
mcdav...@netscape.net
Just to brainstorm a little ... maybe use a mask icon to convey
privacy?
Some challenges:
- Not in common use as a UI element, so the user base is not already
trained to recognize it for what it is or to associate a particular
meaning.
- Several negative connotations already established for masks (robber
mask, ski mask, hockey mask)
- Would it work, cross-culturally?
- Maybe Lone Ranger-style or Amadeus-style party mask (held on a stick
over the eyes only)
- Can it be rendered in a 16x16 or 24x24 space?
Just an idea.
Jan Steffen
> Just to brainstorm a little ... maybe use a mask icon to convey
I'd suggest some spy/secret agent analogy.
Perhaps a spy mask, sunglasses or a typical kind of hat?
A CCTV probably might work as an icon.
How about this one?
http://bluebuddies.com/gallery/Regular_Smurfs/jpg/20008_Spy_Smurf.jpg
Jan
--
I'm considering whether I should stop taking my anti-paranoia pills
because I think someone has been messing with them.
Gervase Markham
> Just to brainstorm a little ... maybe use a mask icon to convey
> privacy?
I think a Lone Ranger-style mask might work.
> - Several negative connotations already established for masks (robber
> mask, ski mask, hockey mask)
Why do ski and hockey masks have negative connotations? Surely they only
do so as much as cars have negative connotations because bank robbers
use them for getaways?
Gerv
mcdav...@netscape.net
> > - Several negative connotations already established for masks (robber
> > mask, ski mask, hockey mask)
>
> Why do ski and hockey masks have negative connotations? Surely they only
> do so as much as cars have negative connotations because bank robbers
> use them for getaways?
Yeah, maybe it's just one user's bias and not representative of most
people's associations. I don't play/watch hockey and I haven't gone
skiing in years. Still, it seems like every time I see a ski mask,
it's either in some truly scary ransom video or in something like
Steven Spielberg's "Munich" ('72 Olympics hostage crisis). Maybe it's
different for people who live further from the equator. Same with the
hockey masks.
Michael Vincent van Rantwijk, MultiZilla
> On May 25, 12:15 pm, Greg Campbell <glc_b...@fastmail.com> wrote:
>> Mike Beltzner wrote:
>>>> Note: johnath isn't a fan of the privacy door knob icon because it
>>>> looks too much like a lock. I think we can get around this problem
>>>> by changing the color and making it appear less metallic.
>>> I'm not sure that people are going to get the door-hanger iconic
>>> metaphor either, but we can experiment there, and we *do* use it for
>>> "privacy" in the preferences UI ...
>> Whoa. I thought that was a lock too. I wondered why "security" is a
>> closed lock and "privacy" was a poorly-drawn open lock. Now I get it.
>> But boy is that icon bad.
>>
>> If the door hanger is a must, probably should draw the door too. A least
>> the knob.
>
> Just to brainstorm a little ... maybe use a mask icon to convey
> privacy?
>
> Some challenges:
>
> - Not in common use as a UI element, so the user base is not already
> trained to recognize it for what it is or to associate a particular
> meaning.
> - Several negative connotations already established for masks (robber
> mask, ski mask, hockey mask)
What Gervase Markham said, and OT: There is "ice hockey" (goalie mask
allowed) and there is "field hockey" (a major difference) where the
International Hockey Federation (FIH) prohibits any type of mask (both
sisters are hockey players).
Alex Faaborg
> only
> do so as much as cars have negative connotations because bank robbers
> use them for getaways?
I believe ski masks are more commonly associated with theft, murder
and hostage situations than they are with skiing. For instance, if
you do a google image search for "ski mask," many of the images on
the first page contain weapons, and none of them are about skiing.
In terms of hockey masks, they have a strong connotation of murder
due to the eleven "Friday the 13th" movies released over the last 26
years.
>> Amadeus-style party mask (held on a stick
>> over the eyes only)
I think the idea of an amadeus-style party mask is really cool. Of
course the party mask has its own set of movie induced connotations
(which may not localize). In a statistically irrelevant user study
with a sample size of 1, I asked someone completely out of the blue
"what is the first thing that comes to mind when you think of one of
those party masks that you hold up to your eyes" and the response was
"Eye's Wide Shut style... party."
Given what we expect the most popular use case of private browsing to
be, this metaphor isn't exactly off base. And it is considerably
classier than the door knob hanger.
-Alex
mcdav...@netscape.net
> I think the idea of an amadeus-style party mask is really cool. Of
> course the party mask has its own set of movie induced connotations
> (which may not localize). In a statistically irrelevant user study
> with a sample size of 1, I asked someone completely out of the blue
> "what is the first thing that comes to mind when you think of one of
> those party masks that you hold up to your eyes" and the response was
> "Eye's Wide Shut style... party."
Well, here's a few sample icons as a proof-of-concept test of sizing.
This is just to get a sense of how much detail might fit into a 24x24
space on the toolbar (and not to propose any particular approach).
http://i54.photobucket.com/albums/g112/mcdavis941/privacy_icon_tests-2.jpg
http://i54.photobucket.com/albums/g112/mcdavis941/privacy_icon_tests-3.jpg
These build on Alex's mockups. Also, none of the icons are original.
I just grabbed whatever I could find and scaled it down after some
editing in Photoshop.
Deb Richardson
> be, this metaphor isn't exactly off base. And it is considerably
> classier than the door knob hanger.
I'm not sure that masks are really the metaphor we want here. Masks don't hide the person, they hide the identity of a person.
The "Personas" Firefox extension uses the mask metaphor, and it seems to make more sense there in that it's changing the appearance of something rather than trying to hide it:
http://www.puffinlabs.com/personas/about/
For Privacy mode I think we're looking more for something along the lines of "Cloaking Technology" or "Invisibility" or, as someone else suggested, "Stealth Mode".
~ deb
pola...@gmail.com
> mcdavis...@netscape.net wrote:
> > Just to brainstorm a little ... maybe use a mask icon to convey
>
> I'd suggest some spy/secret agent analogy.
> Perhaps a spy mask, sunglasses or a typical kind of hat?
> A CCTV probably might work as an icon.
>
>
> Jan
> --
> I'm considering whether I should stop taking my anti-paranoia pills
> because I think someone has been messing with them.
I think an icon with sunglasses would work better than having a mask
icon since the mask icon isn't commonly used in UIs. I also like the
idea of using CCTV as an icon as Jan suggested. How about creating an
icon showing a spray can covering up a CCTV camera? (Just a wild
suggestion here... hehe)
Construction Theme:
I guess why one would use construction style theme to convey privacy
is the sense that it has limits. For example, when you run across a
construction site with fences / yellow tape / cones, you can identify
the site's perimeter clearly and the areas to take caution in.
Changing Themes:
I don't like the idea of having the entire theme change whenever
you're in privacy mode because it will clearly identify to others
close by that you're doing something you don't want others to know.
Instead, why not have the status bar change (colors and/or look) along
with an addition of an unique icon there to signify that you're in
privacy mode.
Absolute vs Relative Privacy:
I love the idea of having a second firefox instance running purely in
memory for protection. Why not have read-only access when it comes to
profile (bookmarks and settings)?
Pau Tomas
The first time the icon appear the blind is open and then it closes
and the whole UI changes.
I think it represents the idea of privacy (you close the blind when
you don't want to be watched) and it's pretty universal.
Brian Erst
*default* to Stealth Mode/Private Browsing. Rather the require a user
to switch to Private Browsing prior to hitting a site (and, therefore,
perhaps inadvertently forget to do so), have a "private list" of sites
that simply are always Private.
I'd rather have Firefox know that when I type "mybanksite.com" in the
URL bar (or otherwise navigate there), it just drops directly into
Private Mode. Tagging a site as a "Private site" should be easy from
the GUI, and when so designating it, FF would then scrub any existing
site-specific info from its logs.
For the porn-obsessed, one can easily see an extension or two that
automatically populate "private lists" with every porn site known to
mankind, but that's up to the extension writers. Just being able to
"private list" a couple of finance sites manually would be great.
dirT...@gmail.com
obviously enough like blinds
-keeping a list of private sites defeats a good bit of the point. my
understanding is that this feature is intended for privacy more than
security.
not including a "dont warn me again" option would be annoying. i
guess i dont care though because i don't see myself -actually using
this feature
-changing the entire theme is not a great idea in my opinion. if your
shopping for an engagement ring or what-have-you and your girlfriend
walks in and sees you are in "private mode" there is no way that she
is going to let that go. you'd be better off using standard mode- the
risk of someone walking in is probably greater than them digging thru
unobvious settings which you would have forgotten to clear
-using black is pretty lame in general. there is definitely an
immature and even porn connotation that would probably go with that.
i think the address bar changing it better than an entire UI change-
but how about a shade of grey instead?
-last but not least, what exactly is the big worry about with
visibility of the fact that you are in private mode? what is the worst
that can happen, they wont have the last few links of their history?
just always start firefox in normal mode.. i'd say you are most likely
to close the browser after "private viewing" anyway.
ps: would it really be that difficult to modify the code where firefox
writes to disk? i have no idea what firefox is coded in, but with
stuff i've worked with, all you'd have to do is wrap write operations
with if(!privateMode){ //write to disk }