Add ability to mark breach as "resolved"

sandysage commented 5 years ago

Once I’ve addressed a breach, I want to be able to check-off (dismiss) the associated breach alert within dashboard (eg checked off as “done”).

Acceptance criteria

[ ] Should be able to resolve/dismiss a breach (from the breach detail page)
[ ] Should be able to revisit resolved/dismissed breaches from an archive or collapsed state
[ ] From the breach detail, I should be able to see what emails are affected by the breach
[ ] I should see an indicator on the dashboard of progress made (ie # of breaches resolved/# of total breaches)
[ ] The feature should encourage/celebrate resolving breaches, both as individual breaches are resolved and if all breaches are resolved (delight)
[ ] Should give people another option for taking action for "data aggregator breaches", since changing passwords or deleting accounts is not effective.
[ ] Should incite surprise and delight when taking actions
[ ] Should instill confidence that I know what to do next to protect myself

Other considerations

[ ] Improve the core recommendations logic so that we provide the right steps for effective remediation based on the types of data compromised
[ ] Should be able to highlight associated security tips (ie not just changing the breached account password but also anywhere else I use that same password)
[ ] Should promote Lockwise + Firefox for further automation of resolving breaches in the browser - to be explored in #1223
[ ] Measure the success or failure of resolving breaches via telemetry
[ ] Mitigate the relationship between about:logins breaches in Firefox and the dashboard of Monitor; if someone resolves in one location, update the other accordingly (https://bugzilla.mozilla.org/show_bug.cgi?id=1593095)
[ ] We may need to reconsider our "show 4 breaches and hide the rest" logic for overflow scenarios, in lieu of the need to 'hide' resolved breaches

Recommendations Logic Revamp

https://docs.google.com/spreadsheets/d/1MlRHSs5PVEO0baDduWLTBJWWSQuwOCVZewhPuDN3ZKE/edit?usp=sharing

Visual design

https://mozilla.invisionapp.com/share/QPUNSW95VU8#/screens

Engineering Tasks

Back-end

[ ] Add a breaches_resolved JSON column to subscribers table to store data like:

[
{"email_address": <primary_email_address>, "recency_indices":[0,2]},
{"email_address": <another_email_address>, "recency_indices":[1]},
]

[ ] Augment bundleVerifiedEmails function with logic to add properties to the emailEntry objects:
- "resolved": true|false
- "recency_index": Number

[ ] Add an HTTP POST endpoint for /user/breach/resolution that accepts subscriber_id, (optional) email_address_id, and recency_index and:

SELECT * FROM subscribers s, email_addresses ea WHERE s.id = subscriber_id
const breachesResolvedJSON = subscriber.breaches_resolved
if `email_address_id`
emailAddress = email_address.email
else
emailAddress = subscribers.primary_email
breachesResolvedJSON[emailAddress].recency_indices.push(recencyIndex)
UPDATE subscribers SET breaches_resolved = breachesResolvedJSON

Front-end

Breach Detail Pages:

[ ] Add/modify existing logic to show recommendations based on a breach's exposed data classes instead of the breach "type".
[ ] Add new UI related to resolving breaches.

New UI:

[ ] Add new "Breach Successfully Resolved!" templates and logic for determining which message should be surfaced. (Question for later: What happens when ALL breaches have been resolved?)
[ ] Add "New in Firefox Monitor..." blurb when zero breaches have been resolved and determine how long this blurb persists if a user has signed in a few times and hasn't resolved any breaches.
[ ] Add Progress Bar UI

Misc. Dashboard Updates:

[ ] Update Breach Summary callouts to include numbers for resolved breaches and passwords.
[ ] Update Breach Cards:
- Update card UI for "New" and "Resolved" states.
- Figure out how to handle any potential spacing conflicts between long breach titles and longer translations of "Resolved" - especially on mobile.
- Show "Resolve this breach" link in /dashboard breach cards.
[ ] Swap section headline string in /dashboard
[ ] Add UI for hiding resolved breaches.

sandysage commented 5 years ago

Reposting an idea for dismissing breaches on Monitor: We can also “snooze” breaches in a way that will cause a push notification to appear to the user after some amount of time. So something like “Remind me tomorrow” or “Remind me next week”. So when people are looking at their breach report, we could give them the option to “snooze” certain breaches that way.

If this is a direction we consider, we can probably learn something from the Snooze Tabs research that Sharon did on the Test Pilot feature: https://docs.google.com/document/u/0/d/1UdT7RoWI6S79BxgXYSTwSDcSoOVQRr0ir6sSjqMCGt4/mobilebasic

jenniferdavidson commented 5 years ago

Chiming in with some thoughts:

Another potential way to phrase the purpose of this epic, using a bit of the '5 Whys method':

I want to feel like I'm making progress in protecting myself online.
Why? Because protecting myself online means I'll have a lower chance of bad things happening online to me.
Why? Because companies use my data to sell me things I don't want, and maybe even put me at higher risk for identity theft. (I don't know if that's actually true, but it might be a thing?)

Other things, perhaps for the future considerations section:

[ ] Should give people another option for taking action for "data aggregator breaches", since changing passwords or deleting accounts is not effective.
[ ] Should incite surprise and delight when taking actions
[ ] Should instill confidence that I know what to do next to protect myself

And. A metaphorical thought. Is protecting oneself online like slowly building up your super suit (think Quantum super suit!)? A breach takes off a piece of your armor. You resolving a breach replaces it. Generating good passwords gives you even more armor. I'm thinking how building a super suit could be like eco-mode in apps and cars where a visualization changes and builds over time to encourage an individual's sustainable practices, with visual surprises along the way (what will happen to this tree next?).

groovecoder commented 5 years ago

Note: I filed https://bugzilla.mozilla.org/show_bug.cgi?id=1593095 for corresponding feature/epic/enhancement on the Firefox desktop side.

groovecoder commented 4 years ago

We can close this one, right?

EMMLynch commented 8 months ago

Closing since we've redesigned the site and functionality since this was created. If you feel that this is still needed, please let me know.

mozilla / blurts-server