Opened 5 months ago

Last modified 2 months ago

#22785 new defect

Show an alternative icon for features that are blocked and not broken.

Reported by: linda Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: ux-team,
Cc: isabela, arthuredelstein Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description (last modified by linda)

Tor Browser blocks certain features, and especially so if the user is using the the highest security setting. Currently, there is nothing distinguishing elements on a page which were legitimately broken versus ones that were blocked.

Instead of the broken image icon, it would be ideal to have another icon (onion icon?) there instead if it was blocked, to indicate that it's not broken, and Tor Browser is working as intended. Adding a popup on hover or click to describe why it was blocked would be even better! I've mocked this up below.



Child Tickets

Attachments (2)

page-with-broken-icon.png (59.3 KB) - added by linda 5 months ago.
page-with-onion-icon.png (105.6 KB) - added by linda 5 months ago.

Download all attachments as: .zip

Change History (13)

Changed 5 months ago by linda

Attachment: page-with-broken-icon.png added

Changed 5 months ago by linda

Attachment: page-with-onion-icon.png added

comment:1 Changed 5 months ago by linda

Description: modified (diff)

comment:2 Changed 5 months ago by arthuredelstein

Some features could be click to play. Other blocked features don't have a visible location in content, but could perhaps be listed in a popup, similar to how Privacy Badger counts trackers.

comment:3 Changed 4 months ago by gk

Related: #20314.

comment:4 Changed 3 months ago by antonela

Is TOR who is blocking this image/content? or is NoScript?

If is NoScript, I'd like to suggest keeping the same contextual menu we have at the top bar and allow the user to show the content if they want to [we can add a line about how dangerous it could be].

If is TOR, I'm 100% in with your approach.
I'm attaching a mockup and the onion icon to use.

I made 2 options, green and purple. And also a quick mockup to show how it will look.

Mockups
Before
https://share.riseup.net/#SUZ7tGEG3c1dpzl6lpgP1w

After - Green
https://share.riseup.net/#tZWiVAdViU486qOyXunowg

After - Purple
https://share.riseup.net/#t8ZgbRcHcwGdtm8SE1egoA

Assets [green and purple]
https://share.riseup.net/#cum4BGLtJWOm_Iy8VZJUPw

comment:5 Changed 3 months ago by linda

Antonela, great work!

I agree that we should have it dependent on who is doing the blocking. Sometimes, it's NoScript, but sometimes, it might be the Security Slider settings. I also don't know what technically happens if you have "Allow Scripts Globally" on NoScript but put your Security Slider setting on High (which supposedly blocks javascript).

I don't know if it blocks javascript if one of the two settings are set, or if the Security Slider sets the NoScript options when you choose high but it's overwritten if you toggle the Noscript afterwards... So this really depends. Clarification is welcome here.

I think it could be the case that Tor's security preferences are blocking the media. In this case, I say we use the purple onion. All of our onions are purple, so it would be good to keep with the theme!

comment:6 in reply to:  5 Changed 3 months ago by cypherpunks

Replying to linda:

I also don't know what technically happens if you have "Allow Scripts Globally" on NoScript but put your Security Slider setting on High (which supposedly blocks javascript).

I don't know if it blocks javascript if one of the two settings are set, or if the Security Slider sets the NoScript options when you choose high but it's overwritten if you toggle the Noscript afterwards... So this really depends. Clarification is welcome here.

With Security Settings set to High and toggling on NoScript's "Allow Scripts Globally" or the other option for allowing it on a single site will indeed allow JS to run globally/on specific site.

comment:7 Changed 3 months ago by linda

Thanks for the clarification, cypherpunk. :)

I can see when Noscript could override the security settings and allow scripts to run, but could it also block scripts? I'm imagining that I have my security settings on low, but then I click the "Forbid Scripts Globally" option.

I really wished that it couldn't, and Tor has the final say in blocking all things, and Noscript allows the exceptions, because that would make it easier to understand/it makes sense to just use the onion icon drawn above to indicate that something has been blocked on purpose/isn't broken. But I have a feeling it might not be the case..

comment:8 Changed 3 months ago by brade

For me, seeing a small onion icon does not convey that an image didn't load or that something is "broken." The onion should be something more. Perhaps it could have a frame around it (octagon? I'm not sure if that is universal and it doesn't quite mean blocked)? I think it is important that the icon convey a "broken" state or "blocked" state.

comment:9 in reply to:  7 Changed 3 months ago by gk

Replying to linda:

Thanks for the clarification, cypherpunk. :)

I can see when Noscript could override the security settings and allow scripts to run, but could it also block scripts? I'm imagining that I have my security settings on low, but then I click the "Forbid Scripts Globally" option.

Yes, it could.

comment:10 Changed 3 months ago by gk

FWIW: We should consider the case where websites can't get rendered at all due to some slider setting (see: #23324 where disabling SVG is causing this). Those might be cases where no blocking icon on the page can be shown (I have not looked closer at that). And having such cases + plus cases where we *would show* an icon is pretty confusing.

comment:11 in reply to:  10 Changed 2 months ago by linda

Replying to gk:

FWIW: We should consider the case where websites can't get rendered at all due to some slider setting (see: #23324 where disabling SVG is causing this). Those might be cases where no blocking icon on the page can be shown (I have not looked closer at that). And having such cases + plus cases where we *would show* an icon is pretty confusing.

This is a good point. Hmm...

Note: See TracTickets for help on using tickets.