Fenix: GUI settings for a number of privacy-related options

[starscollide5]

What is the user problem or growth opportunity you want to see solved?

Some settings provide privacy-conscious Firefox users with finer control over their browsing experience:

• media.peerconnection.enabled - enable/disable WebRTC

• privacy.resistFingerprinting - _self-explanatory_

• privacy.trackingprotection.fingerprinting.enabled - _self-explanatory_

• privacy.firstparty.isolate - enable/disable isolating cookies to first-party domain, which prevents tracking across multiple domains

• geo.enabled - enable/disable geolocation tracking

• media.navigator.enabled - enable/disable ability to track microphone and camera status

• network.cookie.lifetimePolicy - determines when cookies are deleted

• network.dns.disablePrefetch - disable/enable prefetching DNS requests

• network.prefetch-next - another setting to enable/disable prefetching DNS requests

• webgl.disabled - _self-explanatory_

• dom.event.clipboardevents.enabled - prevents websites from getting notifications if you copy, paste, or cut something from the page

• media.eme.enabled - enable/disable playback of DRM-controlled HTML5 content

• browser.safebrowsing.phishing.enabled - _self-explanatory_ covered by #14163

• browser.safebrowsing.malware.enabled - _self-explanatory_ covered by #14163

Settings like privacy.trackingprotection.fingerprinting.enabled, privacy.trackingprotection.cryptomining.enabled, privacy.trackingprotection.enabled and network.cookie.cookieBehavior while already present in the GUI, are insufficient. It makes perfect sense to add all the missing settings mentioned to the GUI.

How do you know that this problem exists today? Why is this important?

There are currently two problems:

1. about:config is unavailable in Fenix release, making these settings impossible to adjust

2. these settings should be adjustable via GUI in the first place, there is no good reason hiding them from Firefox users

Who will benefit from it?

Every privacy-conscious Firefox Fenix user will benefit from this change.

[cadeyrn]

It doesn't make sense to have one issue for 14 requests. Let's say Mozilla wants to implement an option for seven of these requests but not for the other seven requests. What should they do with your issue? They can't say it's FIXED after implementing a few options or close it as WONTFIX because both would not be true.

FWIW I don't agree with most of your requests. For example privacy.resistFingerprinting. It causes a lot of breakage and causes already a lot of support requests for the desktop Firefox - even though there is no visible setting. Most people don't understand the consequences. It should really not be made more prominent. I also don't see how disabling a web standard like WebGL can be "self-explanatory". It's not self-explanatory at all why this should be disabled. The request for SafeBrowsing is already covered by #14163.

[starscollide5]

It doesn't make sense to have one issue for 14 requests. Let's say Mozilla wants to implement an option for seven of these requests but not for the other seven requests. What should they do with your issue? They can't say it's FIXED after implementing a few options or close it as WONTFIX because both would not be true.

Thank you for this. It is my first time in Firefox repository, I was not aware that making a separate request for each feature was the way to go.

FWIW I don't agree with most of your requests. For example privacy.resistFingerprinting. It causes a lot of breakage and causes already a lot of support requests for the desktop Firefox - even though there is no visible setting. Most people don't understand the consequences. It should really not be made more prominent.

I am not proposing to have these settings enabled by default. I am merely proposing to give back access to them. about:config was removed from Firefox Android, and as far as I read on the subject, it it not coming back. Hence the request.

Users who understand the consequences of changing described settings should not suffer being completely locked out of the functionality because someone doesn't know what they're doing.

I also don't see how disabling a web standard like WebGL can be "self-explanatory". It's not self-explanatory at all why this should be disabled.

WebGL is a potential security risk. User should have an option to disable it completely in their browser settings.

[andreicristianpetcu]

"power users" should not use release.
"normal users" should not mess with network settings they have a poor understanding of.

[starscollide5]

"power users" should not use release.

Why shouldn't they?

If user has need for advanced functionality, they most likely also require a perfectly stable build from release channel expressing predictable behaviour - arguably even more than "normal users" who don't touch anything beyond basic setup.

"normal users" should not mess with network settings they have a poor understanding of.

Hiding proposed settings behind a warning similar to the one displayed when editing about:config on desktop should be enough to discourage users who don't know what they're doing. Users should be warned of the consequences, instead of being denied customization options altogether. As of now, the functionality is simply removed from release channel, which is wrong on so many levels.

[yoasif]

It doesn't seem to make sense at this point to build out GUI options for things that don't have GUI toggles on desktop. Each of these features needs more work to be productized, so each should have bugs created, ideally for desktop first, because I'm guessing you would get a lot more testing there.

[liablenotre]

FWIW I don't agree with most of your requests. For example privacy.resistFingerprinting. It causes a lot of breakage and causes already a lot of support requests for the desktop Firefox - even though there is no visible setting. Most people don't understand the consequences. It should really not be made more prominent.

Maybe putting those settings into the secret menu would be a viable solution.

It doesn't seem to make sense at this point to build out GUI options for things that don't have GUI toggles on desktop. Each of these features needs more work to be productized, so each should have bugs created, ideally for desktop first, because I'm guessing you would get a lot more testing there.

If I understand correctly, one of the reasons, those features don't have a GUI option yet, is, because they are not tested enough on firefox desktop? Is this about possible GUI bugs or about bugs in the implementation of those about:config entries?

[starscollide5]

It doesn't seem to make sense at this point to build out GUI options for things that don't have GUI toggles on desktop.

They don't need GUI on desktop, because desktop still has about:config on all channels - thankfully. This whole request wouldn't make any sense if Firefox Fenix didn't completely drop about:config with no hope of its return to release channel in the near future. It is an attempt at damage control for affected users.

Thus, I believe these settings shouldn't be added to desktop GUI - unless Firefox devs decide to remove about:config from desktop too, that is.

Each of these features needs more work to be productized, so each should have bugs created, ideally for desktop first, because I'm guessing you would get a lot more testing there.

Well, I have to start somewhere...

Maybe putting those settings into the secret menu would be a viable solution.

Yes, that'd be great!

[liuche]

Enabling about:config has already been filed in #14707 so I won't address it here.

Thanks for listing out these specific settings - a lot of these are pretty advanced controls that the average user won't understand how to use, and some may not work on Fenix yet because they were originally made with Desktop in mind and may not be exposed in the API yet, and some are already shown through the UI (such as trackingprotection.fingerprinting).

When we approach privacy settings, we don't go through and add a bunch of toggles, but try to group them so that they can be presented in a clear manner to users. However, I appreciate this list, and we're constantly looking at improving privacy controls.