4 ms·

It is not "better than nothing," it is the minimum that is technically and legally required. The UI is intentionally deceptive. The text is deceptive. The big

It is not "better than nothing," it is the minimum that is technically and legally required. The UI is intentionally deceptive. The text is deceptive. The big text says "Text anyone in your phone," which sounds great, but doesn't actually say anything about data sharing. The small low contrast text, describes what they're doing. They know that by putting it small and grey, most people wont read it. The buttons are deceptive. It looks like there's only one button. Even by putting all the permission stuff in a row on first startup is push ploy. Everyone knows, people just keep clicking OK until they get to actual app. People don't read the pages. People don't read the user agreements. They just want to get through the roadblocks as fast as possible so they can get to what they want. None of this is by accident. All of these elements are chosen to push people towards the desired outcome, to upload your contacts, SMS, and call history as quickly as possible.

zodiac 9y ago
> People don't read the pages. People don't read the user agreements. Then maybe "people" shouldn't act completely outraged when they find out that their call history was uploaded?
- jonathankoren 9y ago
  No one chose anything. The best description I recently heard of these types push questions is "exploiting a bug in human behavior. And when the bug is in the brain, there is no patch."
  - stefanmm 9y ago
    this.
  - zodiac 9y ago
    So how do we solve this? What is the general framework we use to agree to transactions of this kind where users allow access for some data in return for something?
    - cyphar 9y ago
      Effectively, what GDPR requires. You must inform users what the data will be used for when asking for opt-in permission to use it, as well as offering opt-out and right-to-deletion.
- dredmorbius 9y ago
  The ToS and other conditions attached to various services and relationships are literally far too long and complex for anyone to read, understand, and recall in full detail. This point has been the subject of numerour articles and documentaries. Hoback states that if one was to read everything in these user/service agreements, it would take one full month, that’s 180 hours every year” and that according to The Wall Street Journal “consumers lose over $250 million dollars due to what’s hidden in these agreements.” https://en.m.wikipedia.org/wiki/Terms_and_Conditions_May_Apply https://en.m.wikipedia.org/wiki/Terms_and_Conditions_May_App...
  - zodiac 9y ago
    I totally agree! But first of all, the prompt shown in the article's screenshot was not hidden in a long ToS. Second of all, I agree that we should work towards solving the problem that overly-long ToSs represent. What I do not agree with is the assertion that, in the presence of an overlong-ToS, we allow people to click-through, then get outraged at the company for doing something they were allowed to do by the ToS. If it really is far too long and complex for you to read, don't use the product.
    - dredmorbius 9y ago
      Tools which become ubiquitous or prerequisites for other services are not discretionary. Facebook is the Internet for many people, is required for authenticating by numerous services, and is how numerous groups and communities organise. As such, its terms and services as those of numerous other services, should be defined in a standard set of obligations, rights, and responsibilities, by law.
      - zodiac 9y ago
        > Tools which become ubiquitous or prerequisites for other services are not discretionary...As such, its terms and services as those of numerous other services, should be defined in a standard set of obligations, rights, and responsibilities, by law. I see this sentiment in some form a lot. Is there a name for this principle? Where does it come from? I don't in general agree with it - speaking generally, I think enforcing this principle is a way to solve some problems, but not the best way - and would be interested in discussions about the principle itself.
stefanmm 9y ago
it appears to be a result of extensive A/B/C ... XY testing. In a way, the users themselves have chosen it.
- jonathankoren 9y ago
  That's an incredibly delusional way of framing it. What do you think the A/B test was set up to optimize, privacy or number of uploads? This permission screen is a push poll.[0] [0] https://en.wikipedia.org/wiki/Push_poll https://en.wikipedia.org/wiki/Push_poll
  - stefanmm 9y ago
    number of uploads, obviously. Hacking the human lazyness.
    - jonathankoren 9y ago
      Well then it isn’t really much of choice is it? It’s a false choice. The product manager will apply as much pressure as needed to get the desired effect. To quote Captain Ramsey in Crimson Tide, “[Y]ou can get a horse to deal cards. It’s just a matter of voltage.”
- smueller1234 9y ago
  I know this might come across as a nitpick, but A/B testing and similar techniques aren't at all about what users choose. They are about constructing a statistically correct test between two alternatives measured in some predetermined way (eg. transactions/users but equally well consenting users/total users) with the least amount of bias. The bit about minimizing bias means that you couldn't possibly give users the A/B variants to choose from but instead must assert the best you can that no user is exposed to different variants of the same experiment. You would typically do this by giving the client a cookie with a random seed which you can then hash with a secret and the id of the experiment to get a randomly distributed but sticky/consistent variant assignment that doesn't scale client storage with the number of experiments. Where things get more interesting is how to change behavior when a user logs into a new device. Do you switch to the users set of variant assignments or keep the experience on this device consistent? This being said, yeah, I'm pretty sure this is the result of optimization on "what fraction of users give consent" while keeping an eye on uninstall rate as a health metric. Source: Redesigned/rewrote A/B testing (and general optimization) framework for large e-commerce company many years ago.

zodiac 9y ago

> People don't read the pages. People don't read the user agreements. Then maybe "people" shouldn't act completely outraged when they find out that their call history was uploaded?

jonathankoren 9y ago
No one chose anything. The best description I recently heard of these types push questions is "exploiting a bug in human behavior. And when the bug is in the brain, there is no patch."
- stefanmm 9y ago
  this.
- zodiac 9y ago
  So how do we solve this? What is the general framework we use to agree to transactions of this kind where users allow access for some data in return for something?
  - cyphar 9y ago
    Effectively, what GDPR requires. You must inform users what the data will be used for when asking for opt-in permission to use it, as well as offering opt-out and right-to-deletion.
dredmorbius 9y ago
The ToS and other conditions attached to various services and relationships are literally far too long and complex for anyone to read, understand, and recall in full detail. This point has been the subject of numerour articles and documentaries. Hoback states that if one was to read everything in these user/service agreements, it would take one full month, that’s 180 hours every year” and that according to The Wall Street Journal “consumers lose over $250 million dollars due to what’s hidden in these agreements.” https://en.m.wikipedia.org/wiki/Terms_and_Conditions_May_Apply https://en.m.wikipedia.org/wiki/Terms_and_Conditions_May_App...
- zodiac 9y ago
  I totally agree! But first of all, the prompt shown in the article's screenshot was not hidden in a long ToS. Second of all, I agree that we should work towards solving the problem that overly-long ToSs represent. What I do not agree with is the assertion that, in the presence of an overlong-ToS, we allow people to click-through, then get outraged at the company for doing something they were allowed to do by the ToS. If it really is far too long and complex for you to read, don't use the product.
  - dredmorbius 9y ago
    Tools which become ubiquitous or prerequisites for other services are not discretionary. Facebook is the Internet for many people, is required for authenticating by numerous services, and is how numerous groups and communities organise. As such, its terms and services as those of numerous other services, should be defined in a standard set of obligations, rights, and responsibilities, by law.
    - zodiac 9y ago
      > Tools which become ubiquitous or prerequisites for other services are not discretionary...As such, its terms and services as those of numerous other services, should be defined in a standard set of obligations, rights, and responsibilities, by law. I see this sentiment in some form a lot. Is there a name for this principle? Where does it come from? I don't in general agree with it - speaking generally, I think enforcing this principle is a way to solve some problems, but not the best way - and would be interested in discussions about the principle itself.

stefanmm 9y ago

it appears to be a result of extensive A/B/C ... XY testing. In a way, the users themselves have chosen it.

jonathankoren 9y ago
That's an incredibly delusional way of framing it. What do you think the A/B test was set up to optimize, privacy or number of uploads? This permission screen is a push poll.[0] [0] https://en.wikipedia.org/wiki/Push_poll https://en.wikipedia.org/wiki/Push_poll
- stefanmm 9y ago
  number of uploads, obviously. Hacking the human lazyness.
  - jonathankoren 9y ago
    Well then it isn’t really much of choice is it? It’s a false choice. The product manager will apply as much pressure as needed to get the desired effect. To quote Captain Ramsey in Crimson Tide, “[Y]ou can get a horse to deal cards. It’s just a matter of voltage.”
smueller1234 9y ago
I know this might come across as a nitpick, but A/B testing and similar techniques aren't at all about what users choose. They are about constructing a statistically correct test between two alternatives measured in some predetermined way (eg. transactions/users but equally well consenting users/total users) with the least amount of bias. The bit about minimizing bias means that you couldn't possibly give users the A/B variants to choose from but instead must assert the best you can that no user is exposed to different variants of the same experiment. You would typically do this by giving the client a cookie with a random seed which you can then hash with a secret and the id of the experiment to get a randomly distributed but sticky/consistent variant assignment that doesn't scale client storage with the number of experiments. Where things get more interesting is how to change behavior when a user logs into a new device. Do you switch to the users set of variant assignments or keep the experience on this device consistent? This being said, yeah, I'm pretty sure this is the result of optimization on "what fraction of users give consent" while keeping an eye on uninstall rate as a health metric. Source: Redesigned/rewrote A/B testing (and general optimization) framework for large e-commerce company many years ago.