3 ms·

Have you ever seen this picture? https://www.reddit.com/r/funny/comments/42xxdh/what_computer_users_see_in_security_warning_boxes/ https://www.reddit.com/r/funn

by hannob 9y ago

Have you ever seen this picture? https://www.reddit.com/r/funny/comments/42xxdh/what_computer_users_see_in_security_warning_boxes/ https://www.reddit.com/r/funny/comments/42xxdh/what_computer... Because that's exactly what you're proposing.

mehrdadn 9y ago
Not that particular one, though I have seen similar, but no, that is not what I was proposing. Where is the "technical crap" in what I just suggested? Which part of it was hard to understand or make a decision on?
- bonaldi 9y ago
  Sorry, I know it was well-meaning, but it's riddled with "technical crap" and assumed knowledge which make it hard to decide upon. Not least a pretty foreign uses of "trust" and "certification" for non-technical people. E.g.: 1. "Certified by" — what does this mean? Is like a rating thing? A tripadvisor thing for the web? 2. "X" who are they? Do they want my money? Do I need a new one? 3. "Current trusted certifier" oh god, did I choose them? Are they bad now? Did I not pay them money? Has it been hacked? Didn't it do a review of BigWebsite yet maybe? I could just wait I guess. 4. There are three buttons that say "yes"! If I hit "always" what if it was wrong? And "if Google verifies" well that's obviously a scam because my web is Google so it would already know. This is all some kind of scam. I'm out of here.
  - mehrdadn 9y ago
    I edited it. Is this better? I honestly don't see why the concept of "This site claims to be WorldBank.com, but we can't verify this. Whom do you trust enough to ask?" requires technical knowledge of any kind. People already understand this is why they have ID cards and background checks -- "I don't know if I can trust this guy; do you trust X to run a background check (or ask him to show an ID card issued by Y)?" is the same exact concept. Why do you think ordinary people fundamentally cannot understand this on the computer when they already understand it (and much more difficult things) just fine in real life? Also, don't forget that none of this applies to when you choose the default settings. This is only if you choose to distrust some organizations.
    - vertex-four 9y ago
      Most people, funnily enough, don't run background checks on other people, and don't have a well-formed mental model of why they're necessary and what the security risks in using them are.
      - mehrdadn 9y ago
        > Most people, funnily enough, don't run background checks on other people They don't do it because they're not employers/landlords/etc. and hence the need never arises, not because they somehow have a complete lack of understanding of the concept. > and don't have a well-formed mental model of why they're necessary and what the security risks in using them are They understand why they need to keep their bank passwords safe, and hence they can understand that they shouldn't enter it on someone else's website. They understand what a fake ID or passport is, and they understand why they shouldn't give their ID numbers to random strangers. The specific examples I used are not the point. I explicitly said they're not perfect; they're just there to get a bigger point across. Look at the larger point. The point is people are already dealing with much more complicated stuff on a daily basis. They understand the concept of lying. They understand that identity theft can wreak havoc on their lives. They understand how to prevent it. So they can handle the concept of what it means to enter their credentials on the wrong site. It's not technical and it's not complicated, and it's not necessary for them to understand how exactly doing the wrong thing might lead to an undesirable result. If you'd like to convince me that the average person can't understand this concept, at least support your claim by providing a link to a study or something that isn't based on a cherry-picked strawman version of what I've suggested? Surely someone's already looked into this kind of an approach and what you're saying isn't just pure speculation?
        icebraining 9y ago
        The issue is not whether they are capable of understanding it, it's that they don't currently, and browsers have to be designed with that fact in mind. Showing them a message like you suggested only works if they already understood it.

by hannob 9y ago

mehrdadn 9y ago

Not that particular one, though I have seen similar, but no, that is not what I was proposing. Where is the "technical crap" in what I just suggested? Which part of it was hard to understand or make a decision on?

bonaldi 9y ago
Sorry, I know it was well-meaning, but it's riddled with "technical crap" and assumed knowledge which make it hard to decide upon. Not least a pretty foreign uses of "trust" and "certification" for non-technical people. E.g.: 1. "Certified by" — what does this mean? Is like a rating thing? A tripadvisor thing for the web? 2. "X" who are they? Do they want my money? Do I need a new one? 3. "Current trusted certifier" oh god, did I choose them? Are they bad now? Did I not pay them money? Has it been hacked? Didn't it do a review of BigWebsite yet maybe? I could just wait I guess. 4. There are three buttons that say "yes"! If I hit "always" what if it was wrong? And "if Google verifies" well that's obviously a scam because my web is Google so it would already know. This is all some kind of scam. I'm out of here.
- mehrdadn 9y ago
  I edited it. Is this better? I honestly don't see why the concept of "This site claims to be WorldBank.com, but we can't verify this. Whom do you trust enough to ask?" requires technical knowledge of any kind. People already understand this is why they have ID cards and background checks -- "I don't know if I can trust this guy; do you trust X to run a background check (or ask him to show an ID card issued by Y)?" is the same exact concept. Why do you think ordinary people fundamentally cannot understand this on the computer when they already understand it (and much more difficult things) just fine in real life? Also, don't forget that none of this applies to when you choose the default settings. This is only if you choose to distrust some organizations.
  - vertex-four 9y ago
    Most people, funnily enough, don't run background checks on other people, and don't have a well-formed mental model of why they're necessary and what the security risks in using them are.
    - mehrdadn 9y ago
      > Most people, funnily enough, don't run background checks on other people They don't do it because they're not employers/landlords/etc. and hence the need never arises, not because they somehow have a complete lack of understanding of the concept. > and don't have a well-formed mental model of why they're necessary and what the security risks in using them are They understand why they need to keep their bank passwords safe, and hence they can understand that they shouldn't enter it on someone else's website. They understand what a fake ID or passport is, and they understand why they shouldn't give their ID numbers to random strangers. The specific examples I used are not the point. I explicitly said they're not perfect; they're just there to get a bigger point across. Look at the larger point. The point is people are already dealing with much more complicated stuff on a daily basis. They understand the concept of lying. They understand that identity theft can wreak havoc on their lives. They understand how to prevent it. So they can handle the concept of what it means to enter their credentials on the wrong site. It's not technical and it's not complicated, and it's not necessary for them to understand how exactly doing the wrong thing might lead to an undesirable result. If you'd like to convince me that the average person can't understand this concept, at least support your claim by providing a link to a study or something that isn't based on a cherry-picked strawman version of what I've suggested? Surely someone's already looked into this kind of an approach and what you're saying isn't just pure speculation?
      - icebraining 9y ago
        The issue is not whether they are capable of understanding it, it's that they don't currently, and browsers have to be designed with that fact in mind. Showing them a message like you suggested only works if they already understood it.