Forgetful Browsing

Staś Małolepszy stas at
Fri Jul 17 13:12:43 UTC 2015

(This is also available at,
with webm illustrations.)

I'd like to suggest a new feature in Firefox which combines Private
Browsing with the Forget Button and emphasizes Mozilla's commitment
to user's privacy by extending the scope of forgetting to partners.


  The user should be able to retroactively create private browsing
  contexts from already open tabs.  The browsing history for those tabs
  will be forgotten by the user agent when the context is closed.
  Additionally, the search query will be forgotten by the search engine
  if one of the ship-by-default engines was used.

## Problem Definition

We know that our users abuse private browsing to have two email
accounts open side-by-side or to do a quick search (often times on
behalf of someone else) that will not be remembered by the browser nor
by the search engine.

Switching modes is a hard task, however.  Users have to remember to
start by opening a new private browsing window in the first place.
The idea to use a private window often comes as an afterthought.  The
only solution then is to use the Forget Button which is a drastic
measure:  all tabs and windows are closed and all history from
X last minutes is deleted.

If private browsing is an a priori method then the Forget Button is
a posteriori.  There's a need for a solution which sits in the
middle and puts users in control of what should be forgotten during the
entire lifecycle of the task.

## Retroactive & Selective

Forgetful Browsing combines the best of two worlds.  It's forgiving to
the user because it's retroactive and less drastic because it's selective.

For the purpose of this document I chose Tab Groups as the
vehicle for demoing the main concepts behind Forgetful Browsing.

## How it works

At any point in time the user can make any set of tabs private.  In
order to do so, the user creates a new tab group in the Tab Groups view
or right-clicks on the tab title and selects Move To… > New Private

Upon closing of a forgetful tab, the entire browsing history from the
tab is deleted as if the tab was created private.  All cookies created
or modified during the lifetime of the tab are also deleted.

  Note: The cookie behavior is different from regular private tabs.
  In Forgetful Browsing modified cookies are also cleared which may
  cause the user to become logged out from her usual websites.

Additionally, the user agent makes an API request to search engines and
ad networks participating in the Forgetful Browsing movement which
makes them forget this part of the user's browsing history.

## Why It Works

Forgetful Browsing allows users to rectify the decision about browsing
privately at any point in time.  There's no need to decide upfront.  It
reduces the user's cognitive load and enforces the feeling of being in
control of her online experience.

It also helps establish a cooperative relationship between the user and
content providers:  it's opt-in, selective and occasional.  It works
similar to the Do Not Track header, but the it's easier to respect for
content providers and has an immediate effect visible to the user.

Last but not least, Forgetful Browsing provides a validation to the
user as to why certain search engines are shipped by default with the
user agent.  These search engines are the ones that care about the
user's privacy and allow users to delete parts of their browsing

(Search engines are a start;  the network of privacy-aware websites and
services can grow with time.  All that is required is an API entry
point which the user agent can use to make the request on behalf of the

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the firefox-dev mailing list