[System Settings] if “when locked, allow [...] notifications” is disabled, notifications should not be shown

[John Lenton]

Under system settings -> Privacy & Security -> Phone locking there's a “When locked, allow: notifications and quick settings” checkbox. When it is unchecked, if the lockscreen is up, notifications should be suppressed.

[Matthew Paul Thomas (mpt)]

Confirmed in 14.10 r244.

[Matthew Paul Thomas (mpt)]

Ah, I see the problem here.

This setting is supposed to control access to the indicator menus from the lock screen, and it does. However, people can't reasonably be expected to know what an "indicator menu" is. Many things on the screen act as "indicators" of various sorts, and the visual design of indicator menus makes them look rather unlike menus.

Meanwhile, the notifications design placed notifications in a "Notification Centre" indicator menu. So when we came to give this setting an understandable name -- trying to summarize everything that appeared inside indicator menus -- we settled on "Notifications and quick settings".

Unfortunately, that makes it seem as if notification bubbles themselves are also controlled by this setting, when they are not.

Possible solutions to this problem:
1. Abolish the setting altogether, never allowing access to indicator menus from the lock screen.
2. Find a name that clarifies the current behavior: obviously including the Notification Center but obviously not including notification bubbles.
3. Change the name to "quick settings", and change its behavior so that it no longer controls access to the Notification Center.
4. Change the effect of the setting so that it also controls notification bubbles on the lock screen.

Any other ideas?

[Mirco Müller (macslow)]

Ah, thanks for the clarification mpt! I was a bit surprised by John's initial question regarding this, as I don't recall having heard from Design that notification (-bubbles) were meant to be suppressed in any way.

[John Lenton (chipaca)]

Without that toggle it means that you could leak private things (content of SMSes, snippets and senders of email) even though the lockscreen is up, which some people want to avoid. We (in push notifications/poll daemon) were asked to implement this; Ted Gould suggested that unity notifications was where to do this, quite reasonably: if leaking an email sender or snipped was a privacy issue, so is an sms sender/snippet.

Given that context, (4) seems to be what we want. Or we want (2), and another checkbox on that list explicitly for bubbles and such.

[Mirco Müller (macslow)]

Whatever the solution is going to be, please remember, that the notification-daemon does not have any domain- or context-knowledge about the notification (and its contents) it receives. So any suppress-filtering will have to be based solely on the notification-type: snap-decision, ephemeral, interactive (aka clickable), confirmation (aka synchronous).

[Matthew Paul Thomas (mpt)]

I just discussed this with James Mulholland, who is overseeing both notifications and indicators at the moment. He said (and I agree) that any setting claiming to control access to notifications should control access to both notification bubbles and the Notification Centre.

So, please pick one of these for RTM, in order from most to least desirable, and hardest to easiest to implement...

1. Change "Notifications and quick settings" to "Quick settings", that covers all indicator menus except the Notification Centre, with a separate checkbox for "Notifications" that covers both the Notification Centre and notification bubbles.

2. Change "Notifications and quick settings" to "Quick settings", and always block notification bubbles and access to the Notification Center at the lock screen.

3. Hide the "Notifications and quick settings" setting altogether for now, and always block access to all indicator menus at the lock screen.

Let us know which one you're going for, so we can update the spec accordingly.

[John Lenton (chipaca)]

What should happen to a blocked snap decision?

[kevin gunn (kgunn72)]

adding onto what Mirco stated, I don't think this is a good road to go down.
I'm afraid we're gonna paint with too big a brush and the user will indavertently turn off notifications/alerts that they didn't realize.

The right thing to do is to properly support this via application & user settings right?
e.g. the sms app should have its own "show notifications on the lock screen" or "allow showing message content in alert on lock screen"
like wise with email client app
i suppose you could argue, i don't want my phone showing the contact info of the people calling me....what if some guy is with girlfriend#1...away from his phone, and girlfriend#2 calls....so even phone app might have settings

besides, it the content of the alert...not the alert itself....maybe a compromise is to show the alert skeleton when device is locked? and just don't show content/contact/specific info....

[John Lenton (chipaca)]

About the settings, if they're to be per app, I guess the ones that go via postal would be under the Notifications preferences. That makes sense, although if it is entirely per app it will make turning them all off a little tedious. Discovering the settings for SMS, if they are not also put under Notifications, will be harder (i'm an advocate of making SMSes use the postal service, but that's a conversation for the sprint).

In any case, whether the setting is global or per app, there needs to be support for this at the unity level: doing the check at any other level is just too racy.

[kevin gunn (kgunn72)]

for sure, regardless of the switch being set in settings...unity would end up being a slave to those settings & figuring out what to draw and what not to draw.

[Matthew Paul Thomas (mpt)]

"What should happen to a blocked snap decision?"

Sorry, I don't understand the question. If it's blocked, it shouldn't appear.

"The right thing to do is to properly support this via application & user settings right?"

Yes, and in future we will have app settings, but not for RTM, and even when they are implemented we might still have a global setting.

"besides, it the content of the alert...not the alert itself...."

Not necessarily. If you're using Grindr or Period Tracker, to pick just two examples, you might not want the lock screen to show *any* hint of a notification from the app, regardless of its contents.

[kevin gunn (kgunn72)]

"besides, it the content of the alert...not the alert itself...."

Not necessarily. If you're using Grindr or Period Tracker, to pick just two examples, you might not want the lock screen to show *any* hint of a notification from the app, regardless of its contents.

>>> but is the desire to not show grindr or period tracker notifications really a potential user security issue ? honest question

btw, rtm is too close to alter this behavior imho.
please talk to JoeO if you want to escalate.

[Matthew Paul Thomas (mpt)]

Kevin, It's not a user security issue, it's a privacy issue, which is why it's under "Privacy" rather than "Security". You may not have noticed this because the area containing the "Privacy" intro label looks like a list item, which is bug 1191029.

I do not think a "When locked, allow: Notifications and quick settings" setting should exist that does not, in fact, control notifications at the lock screen. A simple way to fix this for RTM would be to remove the setting altogether, never allowing access to indicator menus at the lock screen. The Unity API Team have scheduled substantial work on implementing greeter profiles for the indicators, determining which items should be present when the setting is turned on. Removing the setting, and blocking all access to indicator menus at the lock screen, would be less work rather than more.

[Albert Astals Cid (aacid)]

unity8 waiting for design -> Incomplete