Focus-android: Introduce setting for enabling/disabling "secure mode" (screenshots)

[pocmo]

Theme: _Default Browser_

User Story

I disocvered content of a page that I want to revisit later (save to my device)

Feature

Allow users to screenshot. (Turn off/on via settings? We know a lot of people screenshot content)

Tasks:

• [x] Add setting (How do we actually explains this? - This controls screenshots and whether the app shows up in "recent apps")
• [x] Dynamically switch SECURE flag on/off based on setting changes.
• [x] Copy

[pocmo]

I wonder if we could introduce a nicer way to screenshot a (complete) website without introducing a complicated setting with side effects (app content shows up in app switcher)

[pocmo]

@antlam If we just introduce a setting... I wonder what copy we'd use. From the Android docs: "treat the content of the window as secure, preventing it from appearing in screenshots or from being viewed on non-secure displays." - So in our case this means you can't take a screenshot of Focus, it won't show up in "recent apps" and you can't cast it to other screens.

[pocmo]

I wonder if we could do the following instead of introducing a setting:

• Manually hide/show the content when the activity is resumed/paused - With that the content should not show up in "recent apps"
• Remove the secure flag. With that users can screenshot and cast the app (It's there choice after all) and we wouldn't need to introduce a potentially confusing setting

[pocmo]

I wonder if we could do the following instead of introducing a setting:

• Manually hide/show the content when the activity is resumed/paused - With that the content should not show up in "recent apps"
  
  
  
  • Remove the secure flag. With that users can screenshot and cast the app (It's there choice after all) and we wouldn't need to introduce a potentially confusing setting
  
  

I just tried that. What happens is:

• You see the view disappearing
• The activity is getting minimized in a nice animation
• The view suddenly is visible again

It looks like Android is taking a snapshot of the activity before onPause() is getting called. So this workaround doesn't work unfortunately.

[pocmo]

I tried adding/removing the SECURE flag dynamically in onResume(): Removing the flag works and the app content shows up in "recent apps" again. However adding the flag doesn't work without restarting the activity. :(

[pocmo]

I wonder if it would be more straight forward to offer a screenshot action and then open the screenshot in the default app for viewing images (or sending a share intent). This allows us to do more things in the future (some kind of local library, adding additional data to the screenshots, ..)

[pocmo]

@antlam Do you think it's worthwhile to add our own (potentially better) screenshot implementation or do you think we should go with the setting [This might require restarting the app, needs some more investigation]?

[antlam]

@pocmo sorry for the delay!

I like the idea of implementing our own. But I also know that users are accustomed to taking screenshots the same way they've always been doing it. So my worry here is that we would be forcing them to learn a new habit.

[pocmo]

@antlam Copy for the settings

[brampitoyo]

If we assume that most users will take screenshots by holding down the sleep/wake and volume-down buttons, but Focus doesn’t enable “secure mode” by default, then what would happen if I perform that gesture?

If we do nothing, it wouldn’t be ideal, but perhaps that’s all we’re allowed to do.

But if we can pop open a permission dialogue that say “Enable secure mode”, then it would be ideal. Furthermore, in this dialogue, we can then explain what enabling it will mean (“we’ll allow screenshot, but your app’s thumbnail will also appear on the switcher”).

[antlam]

I think the system shows a notification. But I'm not sure what else we can do. @pocmo ?

[brampitoyo]

I found out that we can’t show a custom message on this permission dialogue, but we can say something beforehand.

But a gesture inherently doesn’t have a label. So what can we do?

Proposal 1

• User executes screenshot gesture
• Show show permission dialogue
  
  
  
  • if Deny, then show snackbar “To take screenshots, allow Focus to access your photos”
  
  
  • if Allow, then show dialog “Copy, Save or Share”. This dialogue contains a message telling the user to be careful
  
  

This solution has two flaws:

• The screenshot isn’t instantly captured the first time around. The user must go through the “Copy, Save or Share” dialogue the first time the permission is given
  
  
  
  • In subsequent gestures, the user won’t need to go through this dialogue, though.
  
  
• The default system string for permission warning doesn’t capture the enormity of enabling Secure Mode correctly. It says “give us access to your photos”, but it doesn’t say “if you enable this, your app thumbnail will appear on the app switcher, and you’ll lose some privacy”.

Solution 2

• User executes screenshot gesture
• Show snackbar: “To take screenshots, go to Settings and turn off Secure Mode”
• User taps on Settings and turns off Secure Mode
• User goes back to page and executes screenshot gesture

(The Settings UI is clearly not final. We’ll most certainly have to redesign it. But I hope my intent came through).

[antlam]

I think showing the dialog can be confusing since it's an Android convention to use a dialog after a user long-presses, rather than when they hold down the hardware buttons for a screenshot.

But I like the feedback of the snack bar, with the short-cut to Settings! More messaging/copy that we'll need to lock down.

[brampitoyo]

Sounds good. Let’s agree on shipping the snack bar when you perform a screenshot gesture without enabling Secure Mode.

There are two elements that will require messaging/copy

1. Snack bar

2. Secure Mode section under settings

3. The snack bar copy will say:

To take screenshots, go to Settings and turn off Secure Mode. [Settings]

When the user tap *Settings(, open Firefox Focus settings on the section labelled _Secure Mode_.

1. The _Secure Mode_ section under settings should say:

Secure Mode [on/off toggle]

Firefox Focus cares for your privacy, so Secure Mode is turned on by default.

Turn off Secure Mode to:
• Take screenshots
• Make the page you view in Firefox Focus appear on your list of recently used apps

To check, tap the ⃞ button on the bottom of your screen and look for Firefox Focus there.

@mheubusch, my copy can probably use some trimming, but the idea is to make users realise the compromise that’s involved when turning off Secure Mode. What do you think?

[pocmo]

Sorry for the delay. I am at I/O this week.

Screenshots are handled by the system exclusively. We can't intercept and/or get notified when the user takes a screenshot. Therefore we unfortunately can't show any helpful UI to assist the user. In the case where screenshots are disallowed the Android system will show a notification (instead of the notification containing the screenshot) - unfortunately it doesn't mentions that the app prevents screenshots (because there could be other reasons like device policies).

[brampitoyo]

Thanks @pocmo for the clarification. After looking into this issue further, you’re right that we can’t have our own dialogue shown.

Instead, the Android system will show a notification that a screenshot couldn’t be captured:

Let me look at some examples of apps that have “Boss Mode” (Orbot, Courier, CameraV, SuperSU) to see if we can learn something from how they hide in plain sight.

[brampitoyo]

Having looked at all the app examples above, I had to revert to a very simple solution: make Secure Mode a part of onboarding along with a few tweaks.

• Make it a checkbox
• Rename it to “Stealth: block screenshots and hide on Recent Apps”
  
  
  
  • Explanation copy: “Be very stealthy. You won’t be able to take screenshots, and Firefox Focus will hide itself on the list of Recent Apps.”
  
  
• Make it clear that you can revert easily: “To change this, go to Settings.”
• The copy on the Settings page should be the same as the onboarding step.

Visually, my mockup doesn’t look the best. We’ll have to think of a good layout for it.

Thoughts, @antlam and @pocmo?

[pocmo]

Secure Mode [on/off toggle]

Firefox Focus cares for your privacy, so Secure Mode is turned on by default.

Turn off Secure Mode to:
• Take screenshots
• Make the page you view in Firefox Focus appear on your list of recently used apps

To check, tap the ⃞ button on the bottom of your screen and look for Firefox Focus there.

I like that this setting will explain the trade-off. However I can't really imagine how this will look like in the settings UI - can you show me a mock? For "Send anonymous usage data" we offer a "Learn more" link and explain more on SUMO - Is this something we should do here too? Maybe we end up with a more brief description inside the app?

[brampitoyo]

Two variations of Secure Mode explanation.

The first one is a long one that clearly explains the tradeoff, but has no “Learn more” link.

The second one is a shorter one that modifies the current text and adds a “Learn more” link:

• Current: Do not show app content in recent apps and screenshots
• Proposed: Disable screenshots and hide Firefox Focus in your Recent Apps list. [Learn more]

Despite wanting to explain everything, I lean more towards the second, shorter option. What do you think, @pocmo?

[pocmo]

In triage we decided to move the first run card to a new issue (and address it after v1) and use this bug just for the setting.

[antlam]

@mheubusch do you have time to look at this too? :)

[mheubusch]

I think we need to explain which state of Stealth (on or off) does what a bit more clearly. I think something like this is a bit more clear:
Stealth
Turn off stealth mode to take screenshots and see Firefox Focus in your Recent Apps list. [Learn more]

[brampitoyo]

Thanks for the suggestion, @mheubusch.

This is the revised mocks with your string:

(Learn more is optional – I think the string is clear enough without having to explain it further).

Now it’s just a question of whether we can get this new copy past string freeze?

[pocmo]

Now it’s just a question of whether we can get this new copy past string freeze?

Yeah, I'll land the strings today!

[brampitoyo]

Thank you @pocmo for landing that string!

Future design idea:

Let’s keep this in mind when we decide that we need long explanatory copy.

Android has a pattern where you say:

Settings title
On

And when you tap on that block, it goes to a sub-page with an on/off switch and a lot of areas below it for explanatory text. We can even include an extra help icon on the upper-right hand side if we want it to lead to SUMO.

The point is, by giving the on/off switch its own sub-page, we get a lot of rooms to write about a setting that might take a while to explain (Tracking Protection comes to mind).

[pocmo]

In triage we decided to use the short version in v1 and I'm going to use the string from #643 in the final export today.

I'm closing this bug which was implementing this feature (for v1). We can file a new bug to explore other options of displaying the setting in later versions. The sub-page is definitely an interesting concept too.

[bbinto]

Screenshots