Photo privacy settings concern feedback

[ProbablePrime]

Is your feature request related to a problem? Please describe.

I am collating feedback here from Discord to ensure that we can capture it.

Users are concerned that the new settings to do with user privacy have some issues. I will present them here in a list.

1. Guidelines breaching users, may not be able to have photos taken of them, making reporting more difficult
2. Alternative tooling exists that can bypass these settings

Describe the solution you'd like

The community has provided several ideas:

1. Disable the feature until it "works better"
2. Remove the feature, because it "doesn't work"

Describe alternatives you've considered

Just leaving the feature alone.

Additional Context

Prime's Two Cents

I am collating feedback here from Discord to ensure that we can capture it. I don't personally have an issue with these settings. However as this is the section at the bottom I'll provide my two cents:

• Its the law in some places to wear seatbelts.
• Do seatbelts save lives? Yes.
• Do some people break the law and not wear their seatbelt? Yes
• Do seatbelts save all lives? No.
• Then should wearing seatbelts be the law? Yes.

The point of this feature is not to provide maximum control or privacy, the goal is to make incremental increases to your privacy options. and by that measure this is a great feature.

Anything we do in this area can be bypassed by taking a photo of the screen with a phone camera or whatever and there's no software solution that can remedy that. Government websites try, by disabling right click or blanking the screen when someone presses print screen.

But absolute protection is often never the goal. This feature raises the "difficulty level" to breach someone's wishes and boundaries and that's alright by me.

Clearing up some Rumors

1. This feature was discussed as a team
2. This feature was discussed with moderation
3. As a team we decided we were ok to launch this feature
4. This feature honestly, did not take that long. Less than half a day.

Prime's Request

Please keep feedback focused, I originally moved this from the discord because there was lots of discussion that boiled down to problems 1 and 2 on my list. So those are simplified in the post.

Requesters

No response

[Frooxius]

I think the important thing to realize is that absolute protection is not a feasible goal - there is no way to prevent all possible ways to capture an user in the session - say we even got some cooperation from the OS and API's and prevented any screen recording with external tools (which is already unlikely on itself) - the user could still take a photo of their screen with their phone.

Things like privacy and security are sliding scales. What these settings do, is allow users to get a bit more privacy than they otherwise would, which I believe is a good goal.

Look at it from this perspective - if you wanted to absolutely maximize security, the best thing we could do there is constantly record everything that is happening in all sessions (even private) - voice, actions, poses, everything that happens. It would make resolving all moderation concerns and reports extremely easy.

But would you be okay with that? Would your friends and other users be okay with that? I know I wouldn't, because that would be huge invasion of privacy.

So where does the line lie?

If users are not comfortable having data about them stored in people's accounts, this gives them more control on the platform to limit how much data is captured - it won't stop absolutely everything, but you know what they say - perfect is enemy of good. And I think giving people a bit more control over their privacy is good.

For the moderation, in cases you do need to report someone, you still can:

• Use external capture tools (ideally OBS recording of the event, or just hitting PrintScreen)
• Use logs (which we'll prefer anyways, because the screenshot metadata is much easier to doctor/fake)

Using external tools for the recording is preferred for moderation as well, because:

• They capture exactly what you're seeing as you're seeing it
• Users can override/detect when you're taking a capture and use overrides to display something different on those

[ultrawidegamer]

While I do think privacy is very important, I also believe that the feature of hiding oneself from images can be easily used to evade moderation. Additionally, if there are future plans to improve this feature (i.e., making an in-game reporting system that bypasses the setting), then this feature should be disabled in the interim. This is to prevent unintentional harm to people trying to report users (like those using the Oculus runtime without SteamVR)

[Frooxius]

I'd recommend reading my post above.

In short, there are already other ways to hide yourself from screenshots as well. Generally for moderation purposes we'd recommend using external capture tool anyways, since that captures the screen as is.

There is a potential quick alternative we could consider:

• Moderation capture toggle. If you turn this on, it will capture everything as is in-game and bypass this setting (and render transform/material overrides) AND notify moderation team that you performed this capture to prevent abuse of this feature.

With that, if you need to capture something for moderation purposes, you flip that switch on, make the capture, then turn it off.

[PointerOffset]

Unfortunately I think having a toggle to bypass a privacy option isn't a great solution for this concern. A privacy option should probably be respected as a user would never want to be uncertain that the feature works. If they're uncertain, it's untrustworthy and as-good-as-useless to them. It also adds an extra step for someone trying to make a report when it'd likely be less confusing to just tell them to use Print Screen.

I don't really believe this creates issues for moderation though. It's not any more difficult than before to capture a screenshot for moderation. In desktop you can press Print Screen and in VR there are button shortcuts for SteamVR screenshots. And, as has been mentioned, recording clips with something like ShadowPlay or OBS is the strongest evidence for moderation anyway. This feature does not impact that type of evidence gathering.

This also means a user found to be intentionally bypassing this privacy setting can be reported more easily for their harassment. Users can now prove they have active privacy settings and report if they find a user knowingly circumventing it. It makes a cleaner case for harassment in these circumstances where it previously would've been easier to deny.

This seems to be an overall beneficial privacy setting addition as-is. There's always more work to do but I don't see there being more harm than good on this.

[Frooxius]

I do agree, generally having ShadowPlay or OBS footage is best for a few reasons:

• It captures events, voice and more context, which gives moderation more data to work with
• It's harder to manipulate - screenshots can be edited more easily than videos
• It cannot be messed with on the user side either - it captures what the user sees in the session

The moderation capture toggle is just a possible compromise for this, that would be quick to implement right now. The idea of that is that you'd only use it when you actually want to make a report - the captures would be logged for the moderation team, so if people use it to capture screenshots and they don't make any reports, they'll get in trouble for doing so - they will already do so if they bypass the feature in other ways.

[ultrawidegamer]

@PointerOffset while I agree that users can use multiple other ways to capture this information, users should not have to jump out of VR or have additional software running to be able to get moderation information as users might not have good enough computers to do this

[Frooxius]

It's not necessary to jump out of VR - you can use the Desktop tab that's in the dash.

[Veeridian]

I'd recommend reading my post above.

In short, there are already other ways to hide yourself from screenshots as well. Generally for moderation purposes we'd recommend using external capture tool anyways, since that captures the screen as is.

There is a potential quick alternative we could consider:

• Moderation capture toggle. If you turn this on, it will capture everything as is in-game and bypass this setting (and render transform/material overrides) AND notify moderation team that you performed this capture to prevent abuse of this feature.

With that, if you need to capture something for moderation purposes, you flip that switch on, make the capture, then turn it off.

I really like this idea, especially if it sends the photo in question to the moderation leads, with full metadata and name of photographer.

[shiftyscales]

For that reason- it might be better to leave things as-is for now, @Frooxius - as I addressed in my initial posts about this issue on Discord- the inclusion of these settings doesn't allow users to do anything they already couldn't, e.g. they could hide from cameras with the RenderTransformOverride, and the RenderMaterialOverride.

Likewise, photo metadata shouldn't be considered as a good standard for proof for how easily it can be manipulated, and the information contained in it could be found elsewhere, e.g. in log files.

Having the ability to override the privacy settings for the purpose of an abuse report could be useful- however, I think that functionality would be best-reserved for an in-app reporting tool that is more fully-featured, whenever that is developed down the line.

I don't think there is immediate need to prioritize development on such tooling now, however.

They don't necessarily need any additional software either, @ultrawidegamer - e.g. on SteamVR, the system key + trigger takes a screenshot, and is both a more quick, and reliable way to take a screenshot than even Resonite native options like the finger photo gesture/stream camera.

[coolymike]

1. Guidelines breaching users, may not be able to have photos taken of them, making reporting more difficult
2. Alternative tooling exists that can bypass these settings

These two essentially mean that

1. It's inconveniencing legitimate users, by making it more difficult to screenshot someone breaking the guidelines (especially in VR without Steam screenshots).
2. Legitimate users don't benefit much, as someone prepared to record or take a screenshot of them can still do so.

It's already possible to mimic the functionality of the "don't appear in screenshots toggle, using some of the games more complex systems (like RenderTransformOverrides). This would allow privacy-minded people more familiar with the platform to have the same functionality as that toggle, without making it an option every user can simply turn on or off, which would make it much more likely to be abused by malicious users.

For the moderation, in cases you do need to report someone, you still can:

• Use external capture tools (ideally OBS recording of the event, or just hitting PrintScreen)

OBS recording is not always feasible, as not everyone has the processing power or setup to run both Resonite and OBS instant replay at the same time. Pressing PrintScreen (or Win+Shift+S, or any other screenshot keybind) might not be doable while in VR, for example when using a "cloud" PC (or physically not being close to your keyboard). VR runtime screenshots are also not always available, for example when using (iirc) Oculus Runtime, or one of the open source runtimes. Taking pictures in game, although partially flawed due to RTO, was still a valid and quick way of capturing evidence for reporting. As far as I know, nobody has used an RTO to not appear in in-game screenshots for malicious purposes.

• • Use logs (which we'll prefer anyways, because the screenshot metadata is much easier to doctor/fake)

• Likewise, photo metadata shouldn't be considered as a good standard for proof for how easily it can be manipulated, and the information contained in it could be found elsewhere, e.g. in log files.

The content of screenshots is often used for reporting, not the metadata. If it's also easily faked, I'm assuming the screenshot metadata doesn't provide much (if any) value during player reports. It still contains a lot of sensitive info.

I suggest keeping the setting for exclusion from screenshot metadata, but removing or disabling the setting for not appearing in screenshots at all. This would keep the solution for most of the privacy concerns (being included in photo metadata when you're not in the picture that was taken), without making it extremely easy for malicious users to break the guidelines with a lot lower chance of anyone having evidence when being reported.

Moderation capture toggle. If you turn this on, it will capture everything as is in-game and bypass this setting (and render transform/material overrides) AND notify moderation team that you performed this capture to prevent abuse of this feature.

Such a toggle would reduce privacy of users looking to make anonymous reports with screenshot evidence, and make the privacy feature inconsistent for legitimate users who want it enabled. It's also pretty common to have a user perform a guideline breaking action for a short time before leaving or stopping. Having to go into a menu before taking a screenshot would be enough time for the guideline breaking user to leave in a lot of cases.

• I do agree, generally having ShadowPlay or OBS footage is best for a few reasons:

• It's not necessary to jump out of VR - you can use the Desktop tab that's in the dash.

• e.g. on SteamVR, the system key + trigger takes a screenshot

Since I play on both Linux and Windows, both under Proton and Linux native, the desktop tab does not work in many cases, and is disabled everywhere else to prevent crashing. My most used VR runtime does not have a screenshot feature like SteamVR, as such I rely on in game screenshots. Software that records an "instant replay" buffer is too taxing on my system, as such I don't run it alongside Resonite "just in case I need to report something".

As a privacy-minded individual, I don't particularly enjoy being in unwanted screenshots. Aside from screenshot metadata, avoiding being in unwanted screenshots has not been an issue at all. For all those reasons, I suggest removing the "Don't appear in screenshots" toggle, but keeping the "Don't appear in screenshot metadata" toggle.

[Frooxius]

I really like this idea, especially if it sends the photo in question to the moderation leads, with full metadata and name of photographer.

Expanding on this, we could actually do this relatively simply.

If you capture screenshot when this mode is on, it gets automatically sent to the moderation leads with data about who captured it, when and where. It doesn't spawn in the world and doesn't save to your normal locations, it just sends it to the mod leads via the messaging system.

[shiftyscales]

That definitely sounds like a useful feature for the short-term. :)

[shiftyscales]

Perhaps an automated message from the Resonite account could be sent to the user that took such a screenshot with a reference number, and a link to the ticketing system/instructions on how the user can submit additional information about their photo/ticket?

[Frooxius]

Legitimate users don't benefit much, as someone prepared to record or take a screenshot of them can still do so.

I strongly disagree with this.

As I mentioned in my initial post, these things are a sliding scale. And just because "better privacy" doesn't mean "perfect privacy", doesn't mean it doesn't hold value to people.

Such a toggle would reduce privacy of users looking to make anonymous reports with screenshot evidence, and make the privacy feature inconsistent for legitimate users who want it enabled.

From my perspective, you are essentially arguing, that we should reduce privacy of normal users during daily use of Resonite who want more privacy at the cost of increasing privacy of anonymous reporters.

For that, I'd weigh what's more common and which one we want to optimize for and I'd say anonymous reports are less frequent.

If you want to specifically make anonymous report and include evidence like that, we'd expect the reporter to put more leg-work into it - this is something we expect anyways, because anonymous reports need to have a higher standard of evidence anyways to be acted upon.

It's also pretty common to have a user perform a guideline breaking action for a short time before leaving or stopping. Having to go into a menu before taking a screenshot would be enough time for the guideline breaking user to leave in a lot of cases.

So would going to the "make moderation report" feature that is proposed.

The only solution for this is to make the data capture at all time - which means sacrificing people's privacy just in case someone's doing something bad. That to me is pushing it beyond the line - it's kinda like having a private area constantly monitored with cameras in case someone does something bad.

But most importantly, with implementation of https://github.com/Yellow-Dog-Man/Resonite-Issues/issues/1749, you could just place it on your hand and have that toggle accessible with single button press. As such, enabling it wouldn't take more than 1 second, which I don't think would pose any real problem.

As a privacy-minded individual, I don't particularly enjoy being in unwanted screenshots. Aside from screenshot metadata, avoiding being in unwanted screenshots has not been an issue at all. For all those reasons, I suggest removing the "Don't appear in screenshots" toggle, but keeping the "Don't appear in screenshot metadata" toggle.

You might be fine with this, but that doesn't mean this applies to everyone. Some people are genuinely uncomfortable showing up in photos and videos and I'd like those have more privacy options to improve their experience.

[coolymike]

From my perspective, you are essentially arguing, that we should reduce privacy of normal users during daily use of Resonite who want more privacy at the cost of increasing privacy of anonymous reporters.

No, I am arguing that a "moderation capture toggle" would be a privacy negative for both anonymous reporters, and users who do not want to be seen in screenshots. Anonymous reporters would require external software to take a screenshot, since the in-game "moderation" screenshots would be forcibly linked to a Resonite account. Users who do not want to be seen in screenshots cannot be sure they're not seen in screenshots, as anyone could enable the moderation capture toggle and take a screenshot anyway.

So would going to the "make moderation report" feature that is proposed.

Yes, I did not propose this feature.

The only solution for this is to make the data capture at all time - which means sacrificing people's privacy just in case someone's doing something bad. That to me is pushing it beyond the line - it's kinda like having a private area constantly monitored with cameras in case someone does something bad.

This is an extreme that nobody wants, nobody is arguing to have all data recorded at all times in some way "just in case someone does something against the guidelines".

But most importantly, with implementation of https://github.com/Yellow-Dog-Man/Resonite-Issues/issues/1749, you could just place it on your hand and have that toggle accessible with single button press. As such, enabling it wouldn't take more than 1 second, which I don't think would pose any real problem.

That feature doesn't exist yet. We're talking about the current state of the feature allowing users to toggle whether to be seen in in-game screenshots. If it was a VR/Desktop "keybind" or a single quick button available for users who frequently report others, the concern of a quick event passing without evidence being gathered would be reduced to about the same as taking a SteamVR or finger photo screenshot.

You might be fine with this, but that doesn't mean this applies to everyone. Some people are genuinely uncomfortable showing up in photos and videos and I'd like those have more privacy options to improve their experience.

I should've been more clear with my statement, the "I don't particularly enjoy" part is very lightly spoken, and I will go out of my way to stay behind a camera if there's a group photo for example. After around a thousand hours in both games combined, there haven't been any cases where not showing up on in-game screenshots would've prevented me from being in a screenshot I did not want to be in.

[kulzae]

My concern with the dont show me in screenshots feature is the expectations it sets. Those being: Is it expected that this feature will work most of the time. with the exceptions being rare occurrences? Is it expected that people will adhere to this and doing otherwise is cause for moderation action?

The reason being is there ARE going to be circumstances where this will be worked around unintentionally. I don't want peoples expectations to not be met and me get blasted for some thing I created that ends up unintentionally sidestepping this

[Frooxius]

No, I am arguing that a "moderation capture toggle" would be a privacy negative for both anonymous reporters, and users who do not want to be seen in screenshots.

Given that you're arguing about removing the setting altogether, this doesn't make sense to me.

With your proposed solution, users who do not want to be seen in screenshots have no options there - they will always show in screenshots.

With our solution, they will show only if external capture is used or when moderation capture is made (which should be generally rare compared to total volume of screenshots). It doesn't mean they won't ever show, but they will show in significantly less screenshots, which is a privacy positive.

Users who do not want to be seen in screenshots cannot be sure they're not seen in screenshots, as anyone could enable the moderation capture toggle and take a screenshot anyway.

I've already addressed that in my previous posts. Just because we can't have perfect, doesn't mean there's no benefit to better.

This is an extreme that nobody wants, nobody is arguing to have all data recorded at all times in some way "just in case someone does something against the guidelines".

In effect, showing up in screenshots at all times is what this can mean for some people. You're arguing for taking that option away from users and making users appear in screenshots when they do not wish to, just because it makes it faster to capture users doing bad things sometimes.

That feature doesn't exist yet. We're talking about the current state of the feature allowing users to toggle whether to be seen in in-game screenshots.

I don't follow this logic. I have been talking about possible solutions to this problem and what changes we can make, not just the current state - what would be the point of this thread and discussion otherwise?

Obviously the possible solution is not going to exist until we implement it, but I don't see why we would not be able to discuss those solutions for that reason.

My concern with the dont show me in screenshots feature is the expectations it sets.

The in-game description specifically mentions that this is only for in-game screenshots to set that expectation. We can update the wording of both the name and description to make sure that user has the right expectations on what this does and what it does not do.

[ImErinTheBunny]

I would like to point out that this argument is based on the fact that it could be abused and not that it has been. I think this is a reasonable feature that I personally won't be using but I feel there are people with legitimate reason to use it and it should be left as is. If issues arise where the feature is a common problem then it is reasonable to take action and think about disabling it or reworking it.

This feature is meant to better Resonite for the greater good of the community; we should not limit that due to the minority.

[JackTheFoxOtter]

I personally think that giving users more options for privacy, even if only on surface level, is generally a good thing. I have some concerns, like when organizing an event, and we'd take a group picture, I would want to know if someone has this setting enabled by accident and let them know, so I'd at least like to see this reflected in the camera preview. Or perhaps even a world level override for this, so it could be disabled in event worlds. (Basically the same concern I've raised in #1781).

I've slept about it before chiming in, and I do not think this is a moderation concern. It might appear as one currently, but that's only because the current moderation process isn't streamlined to begin with. The ability to file reports directly in-game (including anonymous ones) would basically eliminate those concerns altogether. Being able to submit moderation tickets or collect moderation data in-game is something that's needed regardless of privacy features. This also comes close to the argument of increasing "security" at the cost of decreasing privacy, which I fundamentally disagree with.