4 ms·

The problem is how do you educate users on these prompts. On smartphones permissions are pretty obvious (Camera, Contacts, Location, Pictures) but even they so

The problem is how do you educate users on these prompts. On smartphones permissions are pretty obvious (Camera, Contacts, Location, Pictures) but even they sometimes have consequences beyond the obvious. How would would one even begin to word a certificate store permission so that the average person would understand the consequences of it?

maerF0x0 9y ago
The same way we taught them about the admin dialog ... > " Mom, just click OK whenever this box pops up"
SquareWheel 9y ago
That's a tricky one. I'd say it's more important to clarify the significance of the permission. For instance: > Do you trust this program to make security changes to your device? [More details]
- wvenable 9y ago
  "If I say no, will my app work? Because I'm installing this app so I want it to work. I'll probably just say "yes" because why would it ask me if it didn't need it?"
  - ryandrake 9y ago
    This is ultimately the problem. The dialog could say "This will trash your computer, empty your bank account, and kill your dog. Do you want to continue? YES/NO" and users will click YES if that's the only way to install whatever software they want to work.
    - spynxic 9y ago
      This issue is hosted by developers making apps unavailable for installation lest agreeing to every requirement. Developers get away with this because, 1) individually selecting permissions is growing rare and 2) there's no pressure to explain why a permission is needed, nor specific contracts to agree upon on how the general permission may be utilized.
- katastic 9y ago
  Android used to about a crappy Samsung app on my phone in the details view: - Using sys.whatever.whatever [redtext][Should only ever be used for debugging.] I can't remember what app it was but it had an insane amount of unnecessary permissions even though it was just a simple app. I used to tell people it was my NSA app.
tonmoy 9y ago
I consider myself tech savvy (by no means do I understand that much more than an average user). When I tried to enable my company’s mail on my personal iPhone, I was prompted to install a certificate. In my haste I thought it was just a certificate for *.my-company.com domains, but iPhone showed me a message in the likes of “the owner of the certificate would be able to read/modify all my network communication, monitor/install/uninstall all apps I have... “ and so on. That was enough to stop me in my tracks and now I’m waiting for a company phone instead.
- phkahler 9y ago
  Yeah, my company requires something like that if you want to access their stuff from your phone. By doing so you enable them to erase (non-company) stuff from your phone and monitor it. Most employees just say no at that point.
- fencepost 9y ago
  That's pretty common, and is one of the reasons for some of the third party exchange clients on Android devices. At least one of the early ones (Nitro?) maintained its own separate data store for email and possibly other things so that when policies were used to wipe data it could wipe only the data in that app instead of the entire device. The counter to that is that now I believe there are a bunch of Exchange clients on Android that will simply ignore server policy or where handling of policy can be controlled in the settings, which kind of defeats the point. The original point of all those policies was to be able to erase supposedly secure content if the device was lost or if someone left the company for whatever reason. Edit: the Exchange client I was thinking of is TouchDown, now owned (and EOLed) by Symantec but I believe originally from NitroDesk.
ReverseCold 9y ago
This app would like to take over and monitor your internet connection. If you don't understand what this means, press no.
- spynxic 9y ago
  Don't forget to notify the user the reason their service isn't working as expected (if the permission is required).
- pas 9y ago
  Doesn't X509 certs tell what they are used for? Such as binary signing versus TLS signing?
chongli 9y ago
The problem is how do you educate users on these prompts. Same way you educate people on how to vote: functional literacy [0]. If people are functionally illiterate, they are going to struggle in all sorts of ways. One of the big drawbacks of our society is that its complexity seems to be growing without bound. This places ever-higher demands on people's ability to read, interpret, and act upon important information in their daily lives. [0] https://en.wikipedia.org/wiki/Functional_illiteracy https://en.wikipedia.org/wiki/Functional_illiteracy

maerF0x0 9y ago

The same way we taught them about the admin dialog ... > " Mom, just click OK whenever this box pops up"

SquareWheel 9y ago

That's a tricky one. I'd say it's more important to clarify the significance of the permission. For instance: > Do you trust this program to make security changes to your device? [More details]

wvenable 9y ago
"If I say no, will my app work? Because I'm installing this app so I want it to work. I'll probably just say "yes" because why would it ask me if it didn't need it?"
- ryandrake 9y ago
  This is ultimately the problem. The dialog could say "This will trash your computer, empty your bank account, and kill your dog. Do you want to continue? YES/NO" and users will click YES if that's the only way to install whatever software they want to work.
  - spynxic 9y ago
    This issue is hosted by developers making apps unavailable for installation lest agreeing to every requirement. Developers get away with this because, 1) individually selecting permissions is growing rare and 2) there's no pressure to explain why a permission is needed, nor specific contracts to agree upon on how the general permission may be utilized.
katastic 9y ago
Android used to about a crappy Samsung app on my phone in the details view: - Using sys.whatever.whatever [redtext][Should only ever be used for debugging.] I can't remember what app it was but it had an insane amount of unnecessary permissions even though it was just a simple app. I used to tell people it was my NSA app.

tonmoy 9y ago

I consider myself tech savvy (by no means do I understand that much more than an average user). When I tried to enable my company’s mail on my personal iPhone, I was prompted to install a certificate. In my haste I thought it was just a certificate for *.my-company.com domains, but iPhone showed me a message in the likes of “the owner of the certificate would be able to read/modify all my network communication, monitor/install/uninstall all apps I have... “ and so on. That was enough to stop me in my tracks and now I’m waiting for a company phone instead.

phkahler 9y ago
Yeah, my company requires something like that if you want to access their stuff from your phone. By doing so you enable them to erase (non-company) stuff from your phone and monitor it. Most employees just say no at that point.
fencepost 9y ago
That's pretty common, and is one of the reasons for some of the third party exchange clients on Android devices. At least one of the early ones (Nitro?) maintained its own separate data store for email and possibly other things so that when policies were used to wipe data it could wipe only the data in that app instead of the entire device. The counter to that is that now I believe there are a bunch of Exchange clients on Android that will simply ignore server policy or where handling of policy can be controlled in the settings, which kind of defeats the point. The original point of all those policies was to be able to erase supposedly secure content if the device was lost or if someone left the company for whatever reason. Edit: the Exchange client I was thinking of is TouchDown, now owned (and EOLed) by Symantec but I believe originally from NitroDesk.

ReverseCold 9y ago

This app would like to take over and monitor your internet connection. If you don't understand what this means, press no.

spynxic 9y ago
Don't forget to notify the user the reason their service isn't working as expected (if the permission is required).
pas 9y ago
Doesn't X509 certs tell what they are used for? Such as binary signing versus TLS signing?

chongli 9y ago

The problem is how do you educate users on these prompts. Same way you educate people on how to vote: functional literacy [0]. If people are functionally illiterate, they are going to struggle in all sorts of ways. One of the big drawbacks of our society is that its complexity seems to be growing without bound. This places ever-higher demands on people's ability to read, interpret, and act upon important information in their daily lives. [0] https://en.wikipedia.org/wiki/Functional_illiteracy https://en.wikipedia.org/wiki/Functional_illiteracy