[tor-bugs] #8313 [TorBrowserButton]: Display a confirmation upon enabling Flash

[Tor Bug Tracker & Wiki]

#8313: Display a confirmation upon enabling Flash
--------------------------------------------+-------------------------------
 Reporter:  mikeperry                       |          Owner:  mikeperry   
     Type:  enhancement                     |         Status:  needs_review
 Priority:  major                           |      Milestone:              
Component:  TorBrowserButton                |        Version:              
 Keywords:  tbb-usability, MikePerry201303  |         Parent:  #7470       
   Points:                                  |   Actualpoints:              
--------------------------------------------+-------------------------------

Comment(by proper):

 What I did:
 1. Installed Debian Wheezy 32 bit
 2. Installed Tor Browser
 3. Installed Tor Button torbutton-1.5.1pre2.xpi
 4. Installed flashplugin-nonfree
 5. Restarted Tor Browser with the new Tor Button

 Bug 1:
 I saw popup twice right after Tor Browser started with check.top. I don't
 think it's the right time?

 Bug 2:
 In another ticket you said, you don't want to train users to click on
 random popups when the browser starts. Good point. Please don't. (Seeing a
 popup when clicking on enable in the plugins manager is acceptable unless
 someone has a better idea.)

 Suggestion 1:
 Often read users don't know what an IP address is. Tails devs recommend to
 me once to use IP/location instead. No strong opinion here.

 Suggestion 2:
 "Harm your privacy" isn't strong enough. "Harm your anonymity" perhaps? Oh
 well, you plan on fixing the (#7008) IP bypass problem. Well, if #7008
 gets implemented, you can change back to "Harm your privacy". In
 meanwhile, when not using special precautions with stock TBB, IP leak is
 imho "Harm your anonymity".

 Suggestion 3:
 Time until "ok" can be pressed is too short.

 User experience, without flash enabled:
 Go to youtube.com, click on some random video, got a flash one, for a
 second I see "this plugin is disabled, click here to enable". Then I see
 "This video is currently unavailable." (a noscript window). It's a lie.
 The video is available. I click on it. Temporarily allow <ultra long
 link>. Ok. For a second I see "this plugin is disabled, click here to
 enable". Video starts. Fine.

 Click on a recommend video. For a second I see "this plugin is disabled,
 click here to enable". "The Adobe Flash Player is required for video
 playback. Get the latest Flash Player." Click? Oh, I have this already
 installed. User question: why did one video work and why doesn't this
 video work?

 Good. Try something else. Go to dailymotion. Click a random video. Looks
 good. Let's click play. "Media not supported." (a noscript windows)
 Temporarily allow (noscript). Click play. "Media not supported." Ok, at
 least it's consistent.

 I think it's a bit too difficult for the mortal user. If you trained them
 "flash = youtube, flash = no anonymity" and they see the noscript
 question, they may say no and be disappointed or create support requests.
 "Where can I say yes, where I must say no."

 User experience, with flash enabled:
 Go to youtube.com, click on some random video, got a flash one, "click
 here to enable unknown plugin", "click", "plays".

 Go to dailymotion, click on some random video. Got a drop down popup
 "would you like to activate the plugins on this page?" (always activate
 plugins for this site; never activate plugins for this site; now now)
 Click activate. I see a tower for many seconds, perhaps because Tor is
 slow. Video plays. Let's click on some other recommend video. "Click here
 to activate unknown plugin." Click. I see a tower for many seconds,
 perhaps because Tor is slow. Video plays. Many people probable already
 give up when they see that tower and no video playback.

 Concern:
 Users will most likely think "it's ok to enable for youtube", then they
 forget to disable it and shoot their own feet. Or not... If I understand
 right even with flash enabled they have to activate the plugin every time
 for every page/video/click?

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/8313#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online