6 ms·

I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to b

by yosefk 10y ago

I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or the basic fact that different pixels are drawn by different programs, not to mention URL structure, or (gasp) Unicode and how it fits there, or how rnicrosoft.com isn't what they're looking for? What makes them understand this? Nothing. Software vendors are very happy with uninformed users (in fact these are the best users because they don't realize which of your programs and services can be replaced with an alternative and how), and users are very happy to stay uninformed, too. Not saying I know how to fix this, just that in my experience non-tech people are so completely unaware of what's going on that this "line of death" thing is not even a thing for them.

userbinator 10y ago
To fix this the answer is to educate the users, and also oppose this style of UI that makes things opaque and hard to comprehend. (Maybe when users are better educated they will automatically find the problems with such UI and thus further oppose it.) Incidentally, if users customised their environments more, they would be far less likely to be fooled by fake dialogs and such, because they would look very obviously different. With the setup I have, it's almost hilarious to see all the adverts with fake dialogs and buttons that look nothing like the real ones on my system; the font, the colours, the controls, everything stands out as being different.
- enraged_camel 10y ago
  >>To fix this the answer is to educate the users I used to believe this too. Over the past several years though, I've worked with many, many users from all walks of life, and I've come to realize the hard truth: the users simply don't give a shit. They already use a billion other apps in their day-to-day work and don't have time to spend watching training videos or reading documentation. So if they have to be educated to be able to use your app properly, you've lost. This isn't to say that all users are like that. There are definitely ones who are tech-savvy and competent and curious. But the overwhelming majority want nothing other than to click a few buttons and get the results they want from the app. Anything more complex will cause them to give up and move on.
  - BurningFrog 10y ago
    Another way to think about the same thing. The user is the boss of the software. The user is not a peripheral that I get to reprogram. I must accept the user as is, and adapt as best as possible to their actual capabilities.
    - angersock 10y ago
      Counteranalogy: If you have a shitty boss, it makes sense to interpret their directions in the way that is most convenient. If users with to abdicate their positions as bosses, then they clearly are not to be considered as having valid authority.
- ams6110 10y ago
  Back when it was still possible (Windows XP? Maybe Windows 7?) I would always turn off all the modern Windows chrome and animation and make it look like Windows 2000. Made for better responsiveness and as you say, you could spot fake dialog boxes in an instant. Not a Windows user these days but I understand it's not possible to get the old Windows 2000 look anymore, though I'm sure you can still change color themes and appearance to some extent.
  - hlandau 10y ago
    You can still do this as late as Win7. I think this was eliminated in Win8, but I've not used it myself. If you do use Aero, you can change the window chrome colour to something custom, which should catch out sites trying to fake windows. I don't think browsers provide any way to get the window chrome colour, though come to think of it, I'm fairly sure IE does/used to provide system colour names in CSS, so it might not be impossible... (If you recall the Win2000-era colour customization window, which IIRC you can still access in current versions of Windows, it's just hidden, you can set things like default window background colour, which traditionally in the Win2000 era was grey. So I guess the idea is that websites could use these system colours if you changed them to be consistent with the OS. Of course nobody really does this.)
    - notriddle 10y ago
      Windows 10 lets you pick a "custom accent color," and it allows you to make a few other custom tweaks as well (should the titlebar be white or colored?). Since this is part of the initial setup wizard, I think it would be pretty hard to fake a Windows 10 dialog from inside a web browser.
      - Stratoscope 10y ago
        That problem is easily solved. In your malware, simply use the default settings for all of those things, and you will catch the 97% of users who never customize any of it. You can afford to lose the remaining 3%.
- xenadu02 10y ago
  >To fix this the answer is to educate the users That's like saying the fix for road deaths is to educate drivers. We already proved that doesn't work nearly as well as designing better cars, roads, and signs. Educating 7 billion human beings is a lot of work. A mind-bogglingly insane amount of work. Security is even worse because one lapse in judgement, one sick or busy day, can completely erase a lifetime of following security best-practices. The power of software is the power to make machines do the work. Why would we want to make 7 billion people take responsibility for a problem that could be solved by a few thousand programmers?
  - userbinator 10y ago
    Why would we want to make 7 billion people take responsibility for a problem that could be solved by a few thousand programmers? Precisely so that those 7 billion people will not be at the mercy of the few thousand programmers (and those who they represent the interests of.) Creating more walled gardens --- which is effectively what you seem to be proposing --- only gives those in control even more power.
    - skybrian 10y ago
      What's the alternative? Building software is a collective process that often depends on experts. Nowhere is this more clear than in cryptography, which everything else depends on. With hardware it's even worse. We need to get everything reviewed and decided on in the open, so that independent experts can verify it. But getting rid of experts - forget it, that's a cabin in the woods scenario that doesn't scale. Of course we can always do more to educate more people, but that's a way of increasing the number of local experts. You're still going to be surrounded by lots of non-programmers who can easily make naive mistakes.
- cel1ne 10y ago
  > To fix this the answer is to educate the users. Impossible. The way to improve is to restrict the amount of damage that can be done by spoofed websites and have multiple safe-guards in place. People cannot be expected to learn these technicalities. If they get a phone call, on the other hand, and are asked whether they really intended to make a large purchase that raised a flag somewhere, they will know what to say.
PretzelFisch 10y ago
All these browsers have that darn Modal dialog alert that lets the code below the line of death trap you on their site. Definitely a disconnect with the plight of their users.
- notriddle 10y ago
  After the first pop-up Chrome and Firefox let you say "block all the dialogs from this site from now on."
  - PretzelFisch 10y ago
    I have not seen that consistently, maybe there is a bug. Also the trick works for basic auth and I don't think they have addressed that yet?
    - meredydd 10y ago
      I believe the commonest circumvention is to redirect to another URL and back, thereby making this a "new" page visit and reset that checkbox.
- madeofpalk 10y ago
  Safari on both iOS and Mac have changed their Modal dialog alert that sites can trigger to be visually distinct from OS dialogs, which is a small welcome change. http://imgur.com/a/wRElN http://imgur.com/a/wRElN Also worth nothing that in Safari the modals don't block the rest of the browser (I believe at least Firefox does this as well?) and are fully contained to its own tab.
- magila 10y ago
  The latest variation on this I've seen is sites which repeatedly force Chrome to switch to full-screen view, thus preventing you from navigating away from them. Apparently they've found a way to override Chrome's anti-abuse mechanisms.
gwu78 10y ago
"I think the real issue here is everybody cares about usability but nobody actually cares about users..." Could this also apply to the WhatsApp "backdoor" thread from yesterday?
madeofpalk 10y ago
The problem is that 'security' often comes at a direct cost to 'usability'. Now of course I know that something can't be all that usable if the users are being hacked all the time, but on the simplest level it remains true. Take MFA for example - absolute 'usability' nightmare! Makes your product many many times harder to use and fails horrible under fairly common use cases (like that time I had to mail in a certified copy of my ID overseas to AWS to regain access to our root account).
sgt101 10y ago
Here's a test; find a six year old, get the six year old to look for stuff on the web. See how confused they are when the search box jumps to the url bar. See how they react to the clickbait and ads that get in the way of every interaction that they have. See how they struggle with dozens of peoples ideas about page layouts and responsiveness. Now, you will say : kids are good at using tech, look they are on x,y & z. They know how to do things I don't! But the thing is that they are using services learned one at a time - not access to the library of babel that we all hoped for ! I agree with your post up to the end. The Very happy to stay uninformed too is like "the soviet people love communism". User don't know what is out there that they could get. Especially users don't know what it is that could be made and put out there. This is because tech people don't actually give a toss about HCI and information retrieval, just selling ads and raising rounds of funding. Don't be evil.
- Terr_ 10y ago
  I believe that "kids these days are good with technology" is a phrase uttered by older people who are actually seeing the kids' willingness to experiment without fear, and assume that it must mean proficiency. Not quite the same thing in the end, though.
  - TeMPOraL 10y ago
    One leads to the other; if said older people would be less afraid to experiment, they'd learn things as quickly and they'd too become proficient.
    - schlowmo 10y ago
      While this is basically true, there is also the difficulty to teach less tech-savvy where it's save to experiment and where not. (And this is where things like "The Line of Death" come into play.) Anectdotal example: On one hand I sometimes get almost mad when I try to help my parents with computer problems (especially via phone) because they didn't even bothered with randomly trying somewhat problem-related buttons or options.[0] They just get paralyzed (by the fear they could break something) because something happens what isn't routine, even if the solution could be found within minutes even by non tech people. On the other hand I'm glad about the same behaviour when they call me to ask if some mail or website is legitimate or not. About half of the calls are false positive scam suspicions, but I'm happy looking into them, as long it helps them not getting scammed. [0] https://xkcd.com/627/ https://xkcd.com/627/
benevol 10y ago
> in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. And why is that? It's because doing the opposite is in the way of maximizing your ROI (return on investment). Put simply, it reduces the company's (investor's/owner's) money. It's always about the money.

by yosefk 10y ago

userbinator 10y ago

To fix this the answer is to educate the users, and also oppose this style of UI that makes things opaque and hard to comprehend. (Maybe when users are better educated they will automatically find the problems with such UI and thus further oppose it.) Incidentally, if users customised their environments more, they would be far less likely to be fooled by fake dialogs and such, because they would look very obviously different. With the setup I have, it's almost hilarious to see all the adverts with fake dialogs and buttons that look nothing like the real ones on my system; the font, the colours, the controls, everything stands out as being different.

enraged_camel 10y ago
>>To fix this the answer is to educate the users I used to believe this too. Over the past several years though, I've worked with many, many users from all walks of life, and I've come to realize the hard truth: the users simply don't give a shit. They already use a billion other apps in their day-to-day work and don't have time to spend watching training videos or reading documentation. So if they have to be educated to be able to use your app properly, you've lost. This isn't to say that all users are like that. There are definitely ones who are tech-savvy and competent and curious. But the overwhelming majority want nothing other than to click a few buttons and get the results they want from the app. Anything more complex will cause them to give up and move on.
- BurningFrog 10y ago
  Another way to think about the same thing. The user is the boss of the software. The user is not a peripheral that I get to reprogram. I must accept the user as is, and adapt as best as possible to their actual capabilities.
  - angersock 10y ago
    Counteranalogy: If you have a shitty boss, it makes sense to interpret their directions in the way that is most convenient. If users with to abdicate their positions as bosses, then they clearly are not to be considered as having valid authority.
ams6110 10y ago
Back when it was still possible (Windows XP? Maybe Windows 7?) I would always turn off all the modern Windows chrome and animation and make it look like Windows 2000. Made for better responsiveness and as you say, you could spot fake dialog boxes in an instant. Not a Windows user these days but I understand it's not possible to get the old Windows 2000 look anymore, though I'm sure you can still change color themes and appearance to some extent.
- hlandau 10y ago
  You can still do this as late as Win7. I think this was eliminated in Win8, but I've not used it myself. If you do use Aero, you can change the window chrome colour to something custom, which should catch out sites trying to fake windows. I don't think browsers provide any way to get the window chrome colour, though come to think of it, I'm fairly sure IE does/used to provide system colour names in CSS, so it might not be impossible... (If you recall the Win2000-era colour customization window, which IIRC you can still access in current versions of Windows, it's just hidden, you can set things like default window background colour, which traditionally in the Win2000 era was grey. So I guess the idea is that websites could use these system colours if you changed them to be consistent with the OS. Of course nobody really does this.)
  - notriddle 10y ago
    Windows 10 lets you pick a "custom accent color," and it allows you to make a few other custom tweaks as well (should the titlebar be white or colored?). Since this is part of the initial setup wizard, I think it would be pretty hard to fake a Windows 10 dialog from inside a web browser.
    - Stratoscope 10y ago
      That problem is easily solved. In your malware, simply use the default settings for all of those things, and you will catch the 97% of users who never customize any of it. You can afford to lose the remaining 3%.
xenadu02 10y ago
>To fix this the answer is to educate the users That's like saying the fix for road deaths is to educate drivers. We already proved that doesn't work nearly as well as designing better cars, roads, and signs. Educating 7 billion human beings is a lot of work. A mind-bogglingly insane amount of work. Security is even worse because one lapse in judgement, one sick or busy day, can completely erase a lifetime of following security best-practices. The power of software is the power to make machines do the work. Why would we want to make 7 billion people take responsibility for a problem that could be solved by a few thousand programmers?
- userbinator 10y ago
  Why would we want to make 7 billion people take responsibility for a problem that could be solved by a few thousand programmers? Precisely so that those 7 billion people will not be at the mercy of the few thousand programmers (and those who they represent the interests of.) Creating more walled gardens --- which is effectively what you seem to be proposing --- only gives those in control even more power.
  - skybrian 10y ago
    What's the alternative? Building software is a collective process that often depends on experts. Nowhere is this more clear than in cryptography, which everything else depends on. With hardware it's even worse. We need to get everything reviewed and decided on in the open, so that independent experts can verify it. But getting rid of experts - forget it, that's a cabin in the woods scenario that doesn't scale. Of course we can always do more to educate more people, but that's a way of increasing the number of local experts. You're still going to be surrounded by lots of non-programmers who can easily make naive mistakes.
cel1ne 10y ago
> To fix this the answer is to educate the users. Impossible. The way to improve is to restrict the amount of damage that can be done by spoofed websites and have multiple safe-guards in place. People cannot be expected to learn these technicalities. If they get a phone call, on the other hand, and are asked whether they really intended to make a large purchase that raised a flag somewhere, they will know what to say.

PretzelFisch 10y ago

All these browsers have that darn Modal dialog alert that lets the code below the line of death trap you on their site. Definitely a disconnect with the plight of their users.

notriddle 10y ago
After the first pop-up Chrome and Firefox let you say "block all the dialogs from this site from now on."
- PretzelFisch 10y ago
  I have not seen that consistently, maybe there is a bug. Also the trick works for basic auth and I don't think they have addressed that yet?
  - meredydd 10y ago
    I believe the commonest circumvention is to redirect to another URL and back, thereby making this a "new" page visit and reset that checkbox.
madeofpalk 10y ago
Safari on both iOS and Mac have changed their Modal dialog alert that sites can trigger to be visually distinct from OS dialogs, which is a small welcome change. http://imgur.com/a/wRElN http://imgur.com/a/wRElN Also worth nothing that in Safari the modals don't block the rest of the browser (I believe at least Firefox does this as well?) and are fully contained to its own tab.
magila 10y ago
The latest variation on this I've seen is sites which repeatedly force Chrome to switch to full-screen view, thus preventing you from navigating away from them. Apparently they've found a way to override Chrome's anti-abuse mechanisms.

gwu78 10y ago

"I think the real issue here is everybody cares about usability but nobody actually cares about users..." Could this also apply to the WhatsApp "backdoor" thread from yesterday?

madeofpalk 10y ago

The problem is that 'security' often comes at a direct cost to 'usability'. Now of course I know that something can't be all that usable if the users are being hacked all the time, but on the simplest level it remains true. Take MFA for example - absolute 'usability' nightmare! Makes your product many many times harder to use and fails horrible under fairly common use cases (like that time I had to mail in a certified copy of my ID overseas to AWS to regain access to our root account).

sgt101 10y ago

Here's a test; find a six year old, get the six year old to look for stuff on the web. See how confused they are when the search box jumps to the url bar. See how they react to the clickbait and ads that get in the way of every interaction that they have. See how they struggle with dozens of peoples ideas about page layouts and responsiveness. Now, you will say : kids are good at using tech, look they are on x,y & z. They know how to do things I don't! But the thing is that they are using services learned one at a time - not access to the library of babel that we all hoped for ! I agree with your post up to the end. The Very happy to stay uninformed too is like "the soviet people love communism". User don't know what is out there that they could get. Especially users don't know what it is that could be made and put out there. This is because tech people don't actually give a toss about HCI and information retrieval, just selling ads and raising rounds of funding. Don't be evil.

Terr_ 10y ago
I believe that "kids these days are good with technology" is a phrase uttered by older people who are actually seeing the kids' willingness to experiment without fear, and assume that it must mean proficiency. Not quite the same thing in the end, though.
- TeMPOraL 10y ago
  One leads to the other; if said older people would be less afraid to experiment, they'd learn things as quickly and they'd too become proficient.
  - schlowmo 10y ago
    While this is basically true, there is also the difficulty to teach less tech-savvy where it's save to experiment and where not. (And this is where things like "The Line of Death" come into play.) Anectdotal example: On one hand I sometimes get almost mad when I try to help my parents with computer problems (especially via phone) because they didn't even bothered with randomly trying somewhat problem-related buttons or options.[0] They just get paralyzed (by the fear they could break something) because something happens what isn't routine, even if the solution could be found within minutes even by non tech people. On the other hand I'm glad about the same behaviour when they call me to ask if some mail or website is legitimate or not. About half of the calls are false positive scam suspicions, but I'm happy looking into them, as long it helps them not getting scammed. [0] https://xkcd.com/627/ https://xkcd.com/627/

benevol 10y ago

> in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. And why is that? It's because doing the opposite is in the way of maximizing your ROI (return on investment). Put simply, it reduces the company's (investor's/owner's) money. It's always about the money.