6 ms·

Rather, information can always be sent. I think it's safe to say that collecting information from a form that was not submitted is a dark pattern. Of course, br

Rather, information can always be sent. I think it's safe to say that collecting information from a form that was not submitted is a dark pattern. Of course, browsers should keep doing what they can to prevent things like this but it's challenging without blocking legitimate use cases.

harry8 6y ago
Can we get a better name than "dark pattern" please? Something like "fraudulent practise" or "criminal process" seems to capture the essence of the thing more accurately. I'm sure we can do better than those too.
- chrismcb 6y ago
  Why? Dark pattern expresses the issue fairly well. It encompass things that aren't necessarily criminal or fraudulent.
- TheRealPomax 6y ago
  Except this kind of behaviour is neither fraudulent or criminal. Plus, unlike "dark pattern", those words have legal-repercussive meaning, so wanting to subvert those to mean something they don't is arguably much worse than not liking "dark pattern".
  - techlaw 6y ago
    ... well, it is not consensual (which is not to say that a court might find otherwise) because consent requires, among other things, an understanding by the grantor of what the granted permission entails. Here, it is unlikely that a user who has yet to click 'submit' understands that merely entering data (but not submitting it) is actually submitting that data. WHAT IF for the sake of argument, a user typed (but did not submit) data which could get them in trouble if shared? (defamatory or trade secret info are just two examples) And again -- a court might find otherwise -- but this behavior as presented is absolutely not consensual.
    - TheRealPomax 6y ago
      No it doesn't, there are tons of countries, and plenty of US states, with single-party-consent laws. Just like everything about a phone call can be recorded if a single part to the call consents (which is true by default because the recording party counts as a consenting party), everything about website interaction can be recorded for as long as someone is "doing things" on that website if whoever owns the website is okay with that (which we can be pretty sure of they are). That might sound horrible, and it is, but it's also entirely legal in many, many jurisdictions.
      - harry8 6y ago
        Absoultely it should not be legal. Now tell me how something that sounds like a colour scheme conveys the awfulness and ethical bankruptcy of the party who ordered it and the engineers who programmed it. "Eh someone else would take money for doing something unspeakable if I didn't." Actually there's what you can live with and what you can't. Names kind of matter to convey meaning. Dark pattern is an abysmal failure.
      - techlaw 6y ago
        > Just like everything about a phone call can be recorded if a single part to the call consents (which is true by default because the recording party counts as a consenting party), everything about website interaction can be recorded for as long as someone is "doing things" on that website if whoever owns the website is okay with that (which we can be pretty sure of they are). Good point, but an important distinction here is that when two people are having a phone conversation both parties are knowingly participating. If both people in a conversation know that the things that they are saying are being perceived by at least one other person their expectation of privacy regarding the things they say is necessarily limited. In some jurisdictions a person's belief that the conversation is strictly private and limited to just the two of them is a reasonable expectation but other jurisdictions disagree. Those other jurisdictions instead believe that there is no reasonable expectation of privacy by one party that the conversation will not be recorded by another party to that conversation. And so - although a reasonable belief forms the outlines of the permission granted, not all jurisdictions agree as to what constitutes "reasonable". Some states have held that they don't think the permission granted protection against single-party-recording (because those states held that this specific expectation of privacy to not be reasonable) while other states think it does (because those other states thought this specific expectation of privacy was reasonable). But this disagreement among jurisdictions is primarily about what constitutes one's "reasonable expectations of privacy" and highlights how the "reasonable" aspect changes based on context (for example, given the ubiquity of recording devices and their use by private parties you should expect that the two-party consent requirement for phone conversations will eventually go away; at some point it is no longer "reasonable" for somebody to think that the other party will not record the conversation --- and yes there are enormous implications here w/r/t government surveillance of its citizens; Kyllo is a good example: the govt used a thermal imaging device to identify a possible marijuana grow house and then get a warrant -- but because this thermal imaging device was not in general public use SCOTUS agreed that Kyllo had a reasonable expectation of privacy and the govt's actions constituted an unreasonable search, saying that "[t]o withdraw protection of this minimum expectation would be to permit police technology to erode the privacy guaranteed by the Fourth Amendment"(1)). Importantly though these distinctions do not change how consent and its interplay with permission-granting operates. Which brings us to the issue at hand: What is the reasonable expectation of privacy that the general public has when typing info into a website form but never pressing 'submit'? It is reasonable for a user to believe that if they do not press 'submit' then that info was never submitted (otherwise why have a 'submit' button?). If the user believes the unsubmitted-info remains private and if that user's expectation is considered reasonable then that means the website lacks permission to access the unsubmitted-info. If the website then retrieves that unsubmitted-info it does so without the user's consent. If we allow otherwise then the users' otherwise "reasonable" expectation becomes unreasonable over time. (1)https://caselaw.findlaw.com/us-supreme-court/533/27.html https://caselaw.findlaw.com/us-supreme-court/533/27.html
  - harry8 6y ago
    Ok you pick a name that conveys the full force of the dishonesty going on. How about "scumbag site technique". Or "Shyster Design" Or viciously dishonest intent. Arguing the semantics of whether it's /sometimes/ not actually fruadulent according to law or /sometimes/ not criminal because the law isn't there yet does not alter one itoa of the wild and deliberate dishonesty going on. The intent is to deceive. Make excuses for it all you like knowing it doesn't change what this is but reveals something else. So what is a beter name than "Dark Pattern" for this kind of intentionally dishonest and deceptive program? I still vote criminal. I want the law to catch up with reality. if your corner store behaved like that they'd go to jail when caught for most of this vile crap.
    - TheRealPomax 6y ago
      I'd rather stick with "dark pattern", which on its own literally means nothing (abstract notions don't have physical colors or brightness), and so can be safely assigned a specific meaning in a specific context without risk of ambiguity or even deception.
      - harry8 6y ago
        Has the nuance of a choice of color-scheme. Needs to have the nuance of being a totally dick-move that should be utterly illegal and turn your stomach. But I guess a lot of people love those dark patterns for every silicon valley company to be using them. Probably grates to think of them for what they actually are.
        hunter2_ 6y ago
        See also: https://www.zdnet.com/article/uk-ncsc-to-stop-using-whitelist-and-blacklist-due-to-racial-stereotyping/ https://www.zdnet.com/article/uk-ncsc-to-stop-using-whitelis...

harry8 6y ago

Can we get a better name than "dark pattern" please? Something like "fraudulent practise" or "criminal process" seems to capture the essence of the thing more accurately. I'm sure we can do better than those too.

chrismcb 6y ago
Why? Dark pattern expresses the issue fairly well. It encompass things that aren't necessarily criminal or fraudulent.
TheRealPomax 6y ago
Except this kind of behaviour is neither fraudulent or criminal. Plus, unlike "dark pattern", those words have legal-repercussive meaning, so wanting to subvert those to mean something they don't is arguably much worse than not liking "dark pattern".
- techlaw 6y ago
  ... well, it is not consensual (which is not to say that a court might find otherwise) because consent requires, among other things, an understanding by the grantor of what the granted permission entails. Here, it is unlikely that a user who has yet to click 'submit' understands that merely entering data (but not submitting it) is actually submitting that data. WHAT IF for the sake of argument, a user typed (but did not submit) data which could get them in trouble if shared? (defamatory or trade secret info are just two examples) And again -- a court might find otherwise -- but this behavior as presented is absolutely not consensual.
  - TheRealPomax 6y ago
    No it doesn't, there are tons of countries, and plenty of US states, with single-party-consent laws. Just like everything about a phone call can be recorded if a single part to the call consents (which is true by default because the recording party counts as a consenting party), everything about website interaction can be recorded for as long as someone is "doing things" on that website if whoever owns the website is okay with that (which we can be pretty sure of they are). That might sound horrible, and it is, but it's also entirely legal in many, many jurisdictions.
    - harry8 6y ago
      Absoultely it should not be legal. Now tell me how something that sounds like a colour scheme conveys the awfulness and ethical bankruptcy of the party who ordered it and the engineers who programmed it. "Eh someone else would take money for doing something unspeakable if I didn't." Actually there's what you can live with and what you can't. Names kind of matter to convey meaning. Dark pattern is an abysmal failure.
    - techlaw 6y ago
      > Just like everything about a phone call can be recorded if a single part to the call consents (which is true by default because the recording party counts as a consenting party), everything about website interaction can be recorded for as long as someone is "doing things" on that website if whoever owns the website is okay with that (which we can be pretty sure of they are). Good point, but an important distinction here is that when two people are having a phone conversation both parties are knowingly participating. If both people in a conversation know that the things that they are saying are being perceived by at least one other person their expectation of privacy regarding the things they say is necessarily limited. In some jurisdictions a person's belief that the conversation is strictly private and limited to just the two of them is a reasonable expectation but other jurisdictions disagree. Those other jurisdictions instead believe that there is no reasonable expectation of privacy by one party that the conversation will not be recorded by another party to that conversation. And so - although a reasonable belief forms the outlines of the permission granted, not all jurisdictions agree as to what constitutes "reasonable". Some states have held that they don't think the permission granted protection against single-party-recording (because those states held that this specific expectation of privacy to not be reasonable) while other states think it does (because those other states thought this specific expectation of privacy was reasonable). But this disagreement among jurisdictions is primarily about what constitutes one's "reasonable expectations of privacy" and highlights how the "reasonable" aspect changes based on context (for example, given the ubiquity of recording devices and their use by private parties you should expect that the two-party consent requirement for phone conversations will eventually go away; at some point it is no longer "reasonable" for somebody to think that the other party will not record the conversation --- and yes there are enormous implications here w/r/t government surveillance of its citizens; Kyllo is a good example: the govt used a thermal imaging device to identify a possible marijuana grow house and then get a warrant -- but because this thermal imaging device was not in general public use SCOTUS agreed that Kyllo had a reasonable expectation of privacy and the govt's actions constituted an unreasonable search, saying that "[t]o withdraw protection of this minimum expectation would be to permit police technology to erode the privacy guaranteed by the Fourth Amendment"(1)). Importantly though these distinctions do not change how consent and its interplay with permission-granting operates. Which brings us to the issue at hand: What is the reasonable expectation of privacy that the general public has when typing info into a website form but never pressing 'submit'? It is reasonable for a user to believe that if they do not press 'submit' then that info was never submitted (otherwise why have a 'submit' button?). If the user believes the unsubmitted-info remains private and if that user's expectation is considered reasonable then that means the website lacks permission to access the unsubmitted-info. If the website then retrieves that unsubmitted-info it does so without the user's consent. If we allow otherwise then the users' otherwise "reasonable" expectation becomes unreasonable over time. (1)https://caselaw.findlaw.com/us-supreme-court/533/27.html https://caselaw.findlaw.com/us-supreme-court/533/27.html
- harry8 6y ago
  Ok you pick a name that conveys the full force of the dishonesty going on. How about "scumbag site technique". Or "Shyster Design" Or viciously dishonest intent. Arguing the semantics of whether it's /sometimes/ not actually fruadulent according to law or /sometimes/ not criminal because the law isn't there yet does not alter one itoa of the wild and deliberate dishonesty going on. The intent is to deceive. Make excuses for it all you like knowing it doesn't change what this is but reveals something else. So what is a beter name than "Dark Pattern" for this kind of intentionally dishonest and deceptive program? I still vote criminal. I want the law to catch up with reality. if your corner store behaved like that they'd go to jail when caught for most of this vile crap.
  - TheRealPomax 6y ago
    I'd rather stick with "dark pattern", which on its own literally means nothing (abstract notions don't have physical colors or brightness), and so can be safely assigned a specific meaning in a specific context without risk of ambiguity or even deception.
    - harry8 6y ago
      Has the nuance of a choice of color-scheme. Needs to have the nuance of being a totally dick-move that should be utterly illegal and turn your stomach. But I guess a lot of people love those dark patterns for every silicon valley company to be using them. Probably grates to think of them for what they actually are.
      - hunter2_ 6y ago
        See also: https://www.zdnet.com/article/uk-ncsc-to-stop-using-whitelist-and-blacklist-due-to-racial-stereotyping/ https://www.zdnet.com/article/uk-ncsc-to-stop-using-whitelis...