Better privacy on camera mute in Firefox 60
On a web conference call, have you ever wondered if people can see you? Maybe you’ve tried to decipher the site’s video-mute button, often some red camera symbol with a slash through it—“Is it on or off? Does red mean stop or live? Is the slash telling me I’m muted now, or to click here to mute?”—All the while the camera light at the top of your laptop keeps glaring at you brightly.
We have fixed this in Firefox 60.
We can’t fix the websites, but in Firefox 60, whenever you video-mute, your laptop or USB camera hardware light will now extinguish. Whenever you unmute again, it will light back up. No more worrying if you’re live!
Try it out in Firefox 60 below:Check your camera hardware light and browser indicators in the URL bar when you mute.
This works for the microphone as well, but unless your camera is of the Microsoft LifeCam series—a rare breed whose hardware lights comes on when their mics are hot—you probably won’t notice.
This improves privacy by removing some paranoia over buggy or even malicious websites. After all, the buttons you push to mute and unmute are on the web page. This means the website is interpreting your button pushes and controlling your camera. You’re trusting the web site to do what you asked it to. With this change, you can verify it.
No hardware light on your device? Despair not. Browsers replicate this light in their URL bar: a camera/microphone indicator blinks red whenever the camera and/or microphone are hot. Firefox 60’s indicator additionally turns gray on mute. Importantly, it does not go away, because the website still has permission to access your device(s), and can resume recording you at its discretion, at which point the indicator would begin to blink red again. When the indicator goes away completely, it cannot come back, and the website can no longer record you without asking for permission anew. Preserving this user guarantee was key.
The camera light is not programmable, so you might notice a bit of delay on unmute. That’s because Firefox actually had to turn the camera off, and now has to open it again to unmute. Also, as a safety measure, Firefox will always keep the light on for a minimum of 3 seconds, even if you toggle the checkboxes really fast. If you’re not seeing the light go out, check if you have the camera open in other tabs or programs—ultimately Firefox does not control the light, only its own access to the device. As always, you can click on the camera/microphone indicator to revoke permission.
This feature is desktop-only at the moment. The Android UX will require some more thought.
To web developers
This is a spec-supported feature. To use it, use track.enabled to mute. See the JavaScript tab above for an example.
This seems obvious perhaps, but there are various ways to achieve mute in a peer connection call—e.g. using sender.replaceTrack or altering transceiver.direction—but none of them inform the browser you’re not using the camera and microphone any longer. Even if we could guess, we’re not allowed by the spec to do so. So if you’re using one of those techniques, remember to disable the tracks you’re not using as well, if you want the light to go out. Of course this only works if you’re muting the self-view as well. Devices may only be turned off when all tracks from them are disabled.
Finally, a key motivation for this feature is that it’s compatible with Firefox’s permission model, which is to not persist permissions implicitly. This lets you implement full face-mute in your application without resorting to hacks that might create extra permission prompts for Firefox users on unmute.
