<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hello everyone!<br>
<div class="moz-forward-container"> <br>
The UX team recently conducted research about Click-to-Play
plugins, and we'd like to share our findings and design
recommendations. If you have specific questions about the research
methodology, contact Mary Trombley and Ilana Segal, who conducted
the study. I can answer questions about design.<br>
<br>
<b>1. User Research</b> <br>
* <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://people.mozilla.com/%7Elco/CtP/CTP%20Results%20v14.pdf">http://people.mozilla.com/~lco/CtP/CTP%20Results%20v14.pdf</a><br>
* Goal: understand the user impact of making all Flash CtP (the
study was NOT about vulnerable plugins)<br>
* Since user research contains participant information, please use
your best judgment when sharing widely. We've remove identifying
information, but we definitely do not want to see the participant
photos and quotes in out-of-context locations on the Web!<br>
<br>
<b>2. Design Recommendations<br>
</b>*
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://people.mozilla.com/%7Elco/CtP/130315%20CtP%20Design%20Recommendations.pdf">http://people.mozilla.com/~lco/CtP/130315%20CtP%20Design%20Recommendations.pdf</a><br>
* I presented this in addition to Mary and Ilana's research to
address the user experience needs (as opposed to user interface
needs like "move this button somewhere else").<br>
<br>
<b>3. Outcome of the research+recommendations presentation<br>
</b>* Focus on solving the following two issues:<br>
** What should we do about Java plugins?<br>
** What should we do about the long tail of plugins? (Unity etc.)<br>
* I think we decided to leave current versions of Flash alone for
now? (I'm not sure I remember what we decided...)<br>
<br>
<b>4. Java CtP Design Proposal<br>
</b>* <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://people.mozilla.com/%7Elco/CtP/130318%20CtP%20concepts.pdf">http://people.mozilla.com/~lco/CtP/130318%20CtP%20concepts.pdf</a><br>
* This is a proposal specifically for Java plugins (both for old
versions, and for the current version). The goals were:<br>
** To treat Java as "permanently insecure", and warn users
appropriately<br>
** To make it difficult for the user to enable Java
unintentionally<br>
** To make click-jacking more difficult <br>
** To allow users who *must* use Java for particular sites to
discover a mechanism for trusting those sites (but not
permanently)<br>
* Note: this is a general solution proposal. Many details haven't
been hammered out yet, such as the strings and corner cases.<br>
<br>
Best,<br>
Larissa<br>
<br>
<br>
</div>
<br>
</body>
</html>