Functional Programming in C++

"Private browsing mode" for activities

Published by Ivan Čukić in the KDE development: Activities section, on 28 June 2015

The statistics collection feature of KActivities is slowly becoming a core part of Plasma.

This raises some privacy concerns as can be seen in the bug filed against the KRecentDocument framework. While KRecentDocument has nothing to do with KActivities, the issues mentioned in this report have been on my mind since I started working on the usage tracking mechanism of KActivities (long before said report).

Disabling tracking

For some time now, the configuration dialogue for Activities had the option to turn off the usage tracking completely or just for specific applications. It also allowed the user to forget the recent history - a feature commonly found in web browsers.

Forgetting

Now that we got this feature exposed in the UI, we also got more fine-grained options of what part of statistics to forget. You can forget the statistics on per-activity, per application and per document basis.

Private mode

While this provides a nice way to ask the system to forget something, it is not enough.

The latest feature (and the reason for writing this post) is that starting from today, the activity manager supports setting the ‘private mode’ (internally called ‘off the record’ mode) for activities. When you put an activity in this mode, no usage stats will be collected for that activity.

Currently, this feature is not exposed in the UI, but it will be as soon as we decide where is the best place to put it.

Private temporary activity

Another thing that I worked on is to allow the user to create a temporary activity which will never collect any data, and which will auto-destruct when the user exits it.

Unfortunately, I don’t see this feature merged.

While this would be a really nice way to deal with private things (similar to a web browser which opens a new private window), it opens a can of worms similar to the one we had while implementing encrypted activities for Plasma Active (one of many cans of worms encrypted activities had :) ).

The main culprit which would make this feature unsafe is the session handling mechanism. While I could easily delete the temporary activity as soon as the user switches to another one, I would not be able to guarantee that all applications opened in that activity are really killed.

They might get automatically moved to another activity, one that is not set as ‘private’.

M
I'm very glad there is some work going on KDE privacy settings. Thank you for your hard work!
Tom
One feature I've always wished for was the ability to not remember any files from specific folders or from any hidden folder in general. Would something like that be possible to implement?
Heiko Tietze
I believe there are two types of history: the one every application offers (i.e. recent files in Kate), which should stay responsible for it, and the activity history that is just another "layer". My suggestion is to have a blank history when the activity is created (as well if copied from a fully configured) and let the application decide about recent documents within this activity. The drawback is that history is not shared.
Private mode sounds awkward to me. It complicates the usage for no good reason. If my activity should be temporary I'd just delete it after use. If the activity should have more restrictions in terms of privacy that has to be configured with the system settings. My vision of activities presumes it as, simplified spoken, separated .config/kde directories plus more KCMs. Just as if the user logs off an on. If really necessary I would place such a private mode checkbox (on/off) at the UI where the activity is created.
And last but not least the statistics would go to the activity switcher along with some other stats, such as name of the activity, number of running apps etc. Next to the information a small icon could provide the option to reset the usage stat.
You may read and comment my notes from the last VDG session with mockups how I imagine the final solution at https://etherpad.user-prompt.com:8082/public_pad/Activities
RPC
Excellent move, in some cases when one is working on classified projects, even document names seen on someone's history list can be revealing. I very much prefer privacy as a default.
Ivan Čukić
@Tom
Funny you should mention it. The path-based filtering was the first thing I did, but did not blog about it. Mind that this does not affect applications not using KActivities for the recent document management. Hopefully, these will wither in numbers.
@Heiko
The history is empty for new activities.
The 'private mode' can be what you are proposing. My first idea was to add a checkbox to the activity settings, but wanted to see whether it being an often changed property has a use-case.
As for the implementation, nothing changes.
Now, I'm not sure about cramping more information in the already busy activity switcher panel. The number of currently open windows, yes, other stuff... not sure.
Will check out the notes later, when I cool down a bit (I hate summer sometimes).
@RPC
The document names and privacy was one of the biggest problems we had with Plasma Active and activity encryption. I agree that it can be as revealing as the document contents.
As for the privacy by default, this would only lead to dozens of bug reports about the 'recent documents not working'. Since the data is not shared with anyone (and is storred locally), I'd say it is not that dangerous for data collection to be switched on by default, and if somebody has something really private (a real use-case, but not a common one), it is easily switched off.