Extension Manager:Projects:Improve Add-on Installation

From MozillaWiki
Jump to navigation Jump to search
Feature Status ETA Owner
Extension Manager:Projects:Improve Add-on Installation Finalizing plan for initial improvements in Firefox 6, beginning to scope out further research for future Firefox. 2011-05-19 Jennifer Boriss

Summary

The process of installing Firefox add-ons is currently fraught with user experience issues. The process involves differently-styled windows, unnecessary amounts of user interaction, and delays which users find confusing and annoying.

Our goal is to make the process of installing add-ons more efficient and smoother while (at the least) not effecting and (at the best) improving security.

While general improvements in efficienty and consistency are the goal, several specific issues fall under this category:

  • Not switching windows styles during installation, and removing all modal dialogs. Currently, the verified add-on information confirmation notification is modal, while the download notification window at the beginning of the process and confirmation/restart notification at the end of the process are in the arrow panel notification style
  • Reducing the timer wait time from 3 seconds to 1, and giving more understandable messaging about the delay
  • Not giving the implication that AMO and AMO's reviewed code are untrusted, specifically by:
    • Removing "author not verified" messaging for verified authors
    • Messaging reviewed add-ons differently to unreviewed add-ons and relaying the different meaningfully to users
    • Not requiring permission for AMO to install add-ons

Team

Who's working on this?

  • Feature Manager: Jennifer Boriss
  • Lead Developer:
  • Product Manager:
  • QA:
  • UX: Jennifer Boriss
  • Security: Jesse Ruderman

Release Requirements

Several user experience improvements detailed in bug 646602.

Next Steps

Outline specific UI flow changes to implement and any related security changes

Open Issues

How different trust levels of add-ons can be both determined and messaged to users appropriately

Related Bugs & Dependencies

Likely:

  • bug 416605 - Reduce security dialog delay from 2 seconds
  • bug 643020 - Implement the new install UI in the content area
  • bug 652896 - Allow AMO to show extension install dialog before downloading XPI

Possible:

  • bug 646602 - Installing add-ons from AMO should not invoke the security prompt

Wontfix:

  • bug 561177 - Remove countdown from add-on install dialog(wontfix - we're reducing, not removing, the delay)
  • bug 588266 - Firefox add-on installation dialog should use doorhanger notification
  • bug 616100 - Remove redundant install delay (undo fix for Bug 162020) [for non-AMO sites]

Notes

  • possible changes to add-on dialogs and their impact
  • goal improve add-on installation for users
    • lengthy steps seem in consistent to users, ex: countdown, and UI differences
    • perception on AMO that even AMO is not trusted even when add-on comes from Moz
    • implication is this should not be trusted even if linked to by trusted spaces.
  • streamline process, make easier, less clicks, possibly reduce or remove countdown

Q: What are the risks entailed in installation and is AMO less risk than other sites?

  • Should be clear that AMO is a website that is part of the app, but what if AMO is hacked? Does this neccessarily help?
  • If you go to AMO as a website then this is a prefered experience, like the bits in FX
    • Desire: AMO having a different status
    • Dialoge is needed as click-jacking is still prevalent/possible on AMO
    • A site cannot frame the add-on tab, where as getting a click attack on AMO is somewhat trivial
  • Need clear dialog for AMO sandbox

mockup: https://people.mozilla.com/%7Ejboriss/dump/flow_chart_for_addon_download2.pdf

suggestions:

  • We could lower the delay from 2 noisy seconds to 1 quiet second
  • We could show the user-intent-verification first, before the download finishes. Then there aren't 2 separate "waiting" steps as long as the download is fast
     
    • this would require AMO to supply the stuff that's supposed to appear in the dialog, as part of the installtrigger call, but it would make the UI much better.
  • We could make it so any link to addons.mozilla.org opens in a new tab, and use browser-side defenses against clickjacking on that tab
  • We could deny InstallTrigger if clicked within 1 second of selecting the tab/window, to make clickjacking AMO harder
  • Rather than author information, which is never verified, could show AMO status
    • (not on AMO; sandboxed; full review; old version)
    • popularity
    • average review score

Unresolved Questions:

  • AMO warnings (slows down firefox? has privacy policy?)

Designs

Interaction is described in bug 646602.

Use Cases

  • Installing human-reviewed add-ons from AMO
  • Installing automated security review sandbox add-ons from AMO
  • Installing add-ons not from AMO (default buyer beware)
  • (possibly) Installing trusted add-ons not on AMO (e.g. AdblockPlus)

Test Plans

None so far.

Goals

Make add-on installation a more efficient, more consistent, and more secure experience

Non-Goals

Retrieved from "https://dev.wikimo.nonprod.webservices.mozgcp.net/index.php?title=Extension_Manager:Projects:Improve_Add-on_Installation&oldid=302920"