Opened 3 years ago

Last modified 15 months ago

#20843 new defect

Tor Browser: How do we help users to use higher security?

Reported by: arthuredelstein Owned by:
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: ux-team
Cc: mrphs, yawning, brade, mcs, intrigeri, linda, dmr Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

The security slider lets users adjust their Tor Browser's behavior along the security-usability tradeoff. But Tor Browser is a juicy target, so we'd like to encourage users to use Medium-High Security or higher. But right now we set the default to Low because we don't want to scare away naive users who would think that Tor Browser is "broken" at higher security levels (when JavaScript and other features are disabled).

So an interesting UX question is how to design an interface that helps more users choose higher security, without driving users away. Testing would be important, I think.

Child Tickets

TicketStatusOwnerSummaryComponent
#20967closedtbb-teamShow security level in Torbutton icon or make it more visible in generalApplications/Tor Browser
#21034newtbb-teamPer site security settings?Applications/Tor Browser
#21065newtbb-teamMake it easier to switch between security levels in Tor BrowserApplications/Tor Browser
#21106newtbb-teamstart TBB with the security setting openApplications/Tor Browser
#21153reopenedtbb-teamChanging the security level does not reload the page anymoreApplications/Tor Browser
#21183closedBasic Usability IssuesApplications/Tor Browser
#23150newlindaRe-evaluating tor browser's security controls: let's have one place to adjust all per-tab, global, persistent, and per-session security preferences.Applications/Tor Browser
#25559newtbb-teamMiscellaneous security- and privacy-related prefs for Tor BrowserApplications/Tor Browser
#26167closedMake Torbutton security settings more customizableApplications/Torbutton
#26407newtbb-teamGo over security slider governed preferences and update them where neededApplications/Tor Browser

Change History (14)

comment:1 Changed 3 years ago by cypherpunks

One thing we can do is to not make users have to resort to allowing *everything* on a page when it doesn't work/you need js.

comment:2 Changed 3 years ago by yawning

Cc: yawning added

comment:3 Changed 3 years ago by yawning

One thing that came up during the browser meeting yesterday when arguing about this and related topics is to display a periodic in browser reminder if the security slider is set to "Low" similar to the widget that informs the users that it exists on first launch.

comment:4 Changed 3 years ago by mcs

Cc: brade mcs added

comment:5 Changed 3 years ago by ninavizz

Howdy—as a longtime UX'er (who's had a lot of experience with both actual design and with users in research efforts), many of the Tor browser's usability issues feel pretty easily obvious and resolvable. I don't feel that many would require testing to be improved upon from how things are today. I'm a novice to security tech, and don't code (or plan to ever learn how to code) — and almost all "how to" things about Tor are written and visually/cognitively presented in what reads as techie jibberish, to me. The website is also somewhat painful to make sense of.

I realize the above sounds rude and potentially arrogant. It's said only to be completely honest, and as a big believer in a product I want more folks worldwide to have greater cognitive access to.

I put together some wireframes to articulate issues I've observed as the most show-stopping for me, as a new user of the Tor browser.

https://drive.google.com/open?id=0BzRaXGZ006aoWHJLd0hBT3IyRUE

My $.02 :)
Happy to help as much as I'm able to!

Longer term, I'd also recommend a design director as a permanent staff hire of the Tor project. For UX stuff on the browser, organizing and executing user research projects (qualitative studies and in-person testing are essential), and shaping user-facing advocacy/education materials, a full-time lead of volunteer contributing designers and writers, and someone to shape best practices for managing design within the Tor community, seems like a missing piece that could make a big difference. Shorter-term, potentially coordinating with some of the UX'ers at Mozilla for bi-weekly reviews of user-facing product tweaks/additions? I'd be happy to make some introductions, if that'd help.

comment:6 Changed 3 years ago by yawning

Longer term, I'd also recommend a design director as a permanent staff hire of the Tor project.

https://trac.torproject.org/projects/tor/wiki/Linda

Who should probably be cced on this, but I'm not going to be the one to force them into viewing this mess.

comment:7 in reply to:  5 Changed 3 years ago by mrphs

Replying to ninavizz:

Howdy—as a longtime UX'er (who's had a lot of experience with both actual design and with users in research efforts), many of the Tor browser's usability issues feel pretty easily obvious and resolvable. I don't feel that many would require testing to be improved upon from how things are today.

I couldn't agree more.

I put together some wireframes to articulate issues I've observed as the most show-stopping for me, as a new user of the Tor browser.

https://drive.google.com/open?id=0BzRaXGZ006aoWHJLd0hBT3IyRUE

Thank you! This is amazing work. I hope the UX or Tor Browser team would make use of it.

comment:8 in reply to:  6 Changed 3 years ago by lnl

Replying to yawning:

Longer term, I'd also recommend a design director as a permanent staff hire of the Tor project.

https://trac.torproject.org/projects/tor/wiki/Linda

Who should probably be cced on this, but I'm not going to be the one to force them into viewing this mess.

I've now viewed this! And while I don't understand why this discussion was instigated without me or is happening on a ticket, I agree with you, yawning.

I agree in the sense that 1) yes, we need one 2) such a person would be complementary to my role and 3) I agree so much that I've been trying to hire someone for that role.

1-2) UX is broad, but within that field, I consider myself an interface designer and interaction designer. This means that I would like to talk about how information is laid out, abstracted, and communicated. I design what to put where, what the interactions should be, and what components to use.

A graphic designer would help me build assets to use in the interface (i.e. I would design how a website is laid out, but I don't make the pictures, indicators, icons, or choose the colors, fonts or spacing). This is not my area of expertise, nor do I plan it to be my area of expertise. I want to be a better interaction designer, interface designer, and continue to do some front-end coding. I don't see myself being a good graphic designer--and I have no formal training in it either. This doesn't mean that I'm bad at doing my job; it's just that these are two jobs and I got hired for one of them.

3) If the SIDA proposal goes through, we plan to hire a graphic designer for the next year. I would love for this to also be a permanent position, because there is a lot of work that they could do, and I would always need access to one. But that's what we have right now.

comment:9 Changed 3 years ago by arthuredelstein

Replying to ninavizz:

[...]

Tor Browser developer here. I very much appreciate this work and I like just about everything is your wireframes. (You'll be happy to know that in the alpha we have already moved the checkboxes to the Preferences page as you suggest.) I think the awning idea is especially cool.

I think the biggest thing holding us back is limited resources -- we are a very small team of programmers and we have to worry about security and privacy as well as UX. Some of these changes may be more practical than others to implement rapidly. For example, changing some icons and colors should be pretty easy. Creating a new interface for NoScript is a big job and probably requires the help of the NoScript author.

That said, I do want to work on some of these things in the next months. Also, I'd like to invite you to our weekly tbb-dev meetings, in case you have time to attend and are interested.

comment:10 in reply to:  5 Changed 3 years ago by lnl

Replying to ninavizz:

Howdy—as a longtime UX'er (who's had a lot of experience with both actual design and with users in research efforts), many of the Tor browser's usability issues feel pretty easily obvious and resolvable. I don't feel that many would require testing to be improved upon from how things are today. I'm a novice to security tech, and don't code (or plan to ever learn how to code) — and almost all "how to" things about Tor are written and visually/cognitively presented in what reads as techie jibberish, to me. The website is also somewhat painful to make sense of.

I agree with you. I took this job is that there is a lot of good work to be done, and I believe in Tor.

I realize the above sounds rude and potentially arrogant. It's said only to be completely honest, and as a big believer in a product I want more folks worldwide to have greater cognitive access to.

I don't think it's arrogant, but I think you may be missing some context. The UX team is ~2 months old, and I'm a one-person team. I have constraints on what I can work when--there are milestones we need to meet for particular sponsors. I do things that need to be done to meet those goals, since that's our end of the deal. That's where the funding for my job comes from.

This means that I worked on the security slider, metrics website, and OONI web and mobile interfaces--even when I knew that the front page of torproject.org needed work, and the browser needed work. We're currently writing a proposal to get funding specifically to improve the browser and tor project website! I hope we get it.

I put together some wireframes to articulate issues I've observed as the most show-stopping for me, as a new user of the Tor browser.

https://drive.google.com/open?id=0BzRaXGZ006aoWHJLd0hBT3IyRUE

I really like how the security slider is more accessible, how the color choices give stronger brand presence, and the simplicity of the interface.

Longer term, I'd also recommend a design director as a permanent staff hire of the Tor project. For UX stuff on the browser, organizing and executing user research projects (qualitative studies and in-person testing are essential), and shaping user-facing advocacy/education materials, a full-time lead of volunteer contributing designers and writers, and someone to shape best practices for managing design within the Tor community, seems like a missing piece that could make a big difference. Shorter-term, potentially coordinating with some of the UX'ers at Mozilla for bi-weekly reviews of user-facing product tweaks/additions? I'd be happy to make some introductions, if that'd help.

I have extensive experience in qualitative and quantitative user studies and interface and interaction design. I do think that reviews would be helpful for me. I also am confident in my abilities to write, but I just don't have enough time for revising the copy on top of my other responsibilities. I would also love to work with more designers to create images and videos to use in interfaces, advocacy, and education. Let's chat about this more: linda@… or linda on irc #tor-dev or #tor-project. :)

comment:11 Changed 2 years ago by intrigeri

Cc: intrigeri added

comment:12 Changed 2 years ago by linda

Cc: linda added

comment:13 Changed 2 years ago by linda

Component: WebpagesApplications/Tor Browser
Keywords: ux-team added

comment:14 Changed 15 months ago by dmr

Cc: dmr added
Note: See TracTickets for help on using tickets.