10 ms·

Yeah it seems pretty clear that this was a 1Password flaw and didn't really have anything to do with Substack's UI. And yes, the first paragraph notes that no m

Yeah it seems pretty clear that this was a 1Password flaw and didn't really have anything to do with Substack's UI. And yes, the first paragraph notes that no money was spent, so not really sure why multiple people have downvoted your comment.

merb 6y ago
because it would've probably failed with other password managers and probably browers (if there are people who save their card details to a browser) and it would probably also fail with tab.
- jojobas 6y ago
  If all the password managers in the world fail at this site, it's still a problem with the password managers. The fact that the field was looking as non-editable from the start has nothing to do with the fact that it filled the wrong field. The user also had a chance to see how it filled the form and didn't bother checking.
  - happytoexplain 6y ago
    >it filled the wrong field I agree, this is awful (I'd really like to know how on earth it decided that this field is where the expiration year belongs. It sounds like some extremely aggressive assumptions are being made). >The user also had a chance to see how it filled the form and didn't bother checking. It's impossible to overstate how wrongheaded, unproductive, and, frankly, lazy this sentiment is.
    - deleted 6y ago
      [deleted]
  - Ensorceled 6y ago
    > The user also had a chance to see how it filled the form and didn't bother checking. So ... you're saying it's the their own fault and Substack should keep the money?
    - jojobas 6y ago
      It's definitely not Substack's fault. They presented the user a form to fill, the user used some tool to fill it and it failed. Whether Substack should keep the money is a matter of goodwill, it's no different from the user fat-fingering an extra zero.
holistio 6y ago
I think the end of the article clearly admits that it's a little bit of both and actually gives really good advice to keep in mind while designing checkout flows.
beckingz 6y ago
They were charged, but were able to get a refund from the publisher they subscribed to.
oefrha 6y ago
If your UI can charge me $2023 instead of $250 without so much of a confirmation, your UI is just a minefield. Forget about auto fill, humans make typos in a free entry text box.
- mewse 6y ago
  Many many years ago I once made a $6900 payment on a $69 internet bill because of a misplaced decimal point, with no confirmation before the amount was debited from my bank account. Definitely partly my fault for missing it, but they also didn’t design that payment flow to stop it from happening or even to autofill the correct payment amount. (I was super unlucky that it happened when I’d just received a big performance bonus, or the bank would have simply declined the transaction outright due to me not having anything remotely like that much money in my accounts) It took a surprising number of customer service calls (and then weeks) to get that payment refunded. And more than once I had to explain to a service rep that no, I didn’t want to just leave my internet service account balance thousands of dollars in credit so I wouldn’t need to pay the monthly bill for the next decade. I mean, obviously. Making rent was kind of challenging that month.
- bellyfullofbac 6y ago
  From the user (donator)'s point of view, a confirmation is a good thing. From their point of view, asking someone to confirm if they really want to donate X is a chance to lose legitimately-entered X's. And obviously from their point of view, OP actually entered $ 2023 and was fully aware of what he was doing (they didn't know about the bug)
  - oefrha 6y ago
    If your business’s success depends on charging people money they’ll regret spending once they see a payment confirmation one second later, you should find a new business idea asap.
- benhurmarcel 6y ago
  In Germany, when paying at a restaurant, the machine often asks you to type the tip you want, before your card PIN. The (badly lit) screen also tells that to the user in German, which doesn't help if you don't speak it. It has happened quite often that I typed my PIN by habit and the machine just refused a tip amount that large, thankfully.
sellyme 6y ago
> Yeah it seems pretty clear that this was a 1Password flaw and didn't really have anything to do with Substack's UI The UI is styled to make it so that a form input is completely indistinguishable from surrounding text, to such an extent that even people who know it's a form input in this thread have incorrectly assumed that it's not manually editable. I can't comprehend how anyone could defend deliberately misleading UI design in a form that is asking for your credit card information. This is a problem with Substack. 1Password can definitely do better to guard against it happening, but the only reason it did happen is because Substack actively tried to hide important information from users in a payment screen.

merb 6y ago

because it would've probably failed with other password managers and probably browers (if there are people who save their card details to a browser) and it would probably also fail with tab.

jojobas 6y ago
If all the password managers in the world fail at this site, it's still a problem with the password managers. The fact that the field was looking as non-editable from the start has nothing to do with the fact that it filled the wrong field. The user also had a chance to see how it filled the form and didn't bother checking.
- happytoexplain 6y ago
  >it filled the wrong field I agree, this is awful (I'd really like to know how on earth it decided that this field is where the expiration year belongs. It sounds like some extremely aggressive assumptions are being made). >The user also had a chance to see how it filled the form and didn't bother checking. It's impossible to overstate how wrongheaded, unproductive, and, frankly, lazy this sentiment is.
  - deleted 6y ago
    [deleted]
- Ensorceled 6y ago
  > The user also had a chance to see how it filled the form and didn't bother checking. So ... you're saying it's the their own fault and Substack should keep the money?
  - jojobas 6y ago
    It's definitely not Substack's fault. They presented the user a form to fill, the user used some tool to fill it and it failed. Whether Substack should keep the money is a matter of goodwill, it's no different from the user fat-fingering an extra zero.

holistio 6y ago

I think the end of the article clearly admits that it's a little bit of both and actually gives really good advice to keep in mind while designing checkout flows.

beckingz 6y ago

They were charged, but were able to get a refund from the publisher they subscribed to.

oefrha 6y ago

If your UI can charge me $2023 instead of $250 without so much of a confirmation, your UI is just a minefield. Forget about auto fill, humans make typos in a free entry text box.

mewse 6y ago
Many many years ago I once made a $6900 payment on a $69 internet bill because of a misplaced decimal point, with no confirmation before the amount was debited from my bank account. Definitely partly my fault for missing it, but they also didn’t design that payment flow to stop it from happening or even to autofill the correct payment amount. (I was super unlucky that it happened when I’d just received a big performance bonus, or the bank would have simply declined the transaction outright due to me not having anything remotely like that much money in my accounts) It took a surprising number of customer service calls (and then weeks) to get that payment refunded. And more than once I had to explain to a service rep that no, I didn’t want to just leave my internet service account balance thousands of dollars in credit so I wouldn’t need to pay the monthly bill for the next decade. I mean, obviously. Making rent was kind of challenging that month.
bellyfullofbac 6y ago
From the user (donator)'s point of view, a confirmation is a good thing. From their point of view, asking someone to confirm if they really want to donate X is a chance to lose legitimately-entered X's. And obviously from their point of view, OP actually entered $ 2023 and was fully aware of what he was doing (they didn't know about the bug)
- oefrha 6y ago
  If your business’s success depends on charging people money they’ll regret spending once they see a payment confirmation one second later, you should find a new business idea asap.
benhurmarcel 6y ago
In Germany, when paying at a restaurant, the machine often asks you to type the tip you want, before your card PIN. The (badly lit) screen also tells that to the user in German, which doesn't help if you don't speak it. It has happened quite often that I typed my PIN by habit and the machine just refused a tip amount that large, thankfully.

sellyme 6y ago

> Yeah it seems pretty clear that this was a 1Password flaw and didn't really have anything to do with Substack's UI The UI is styled to make it so that a form input is completely indistinguishable from surrounding text, to such an extent that even people who know it's a form input in this thread have incorrectly assumed that it's not manually editable. I can't comprehend how anyone could defend deliberately misleading UI design in a form that is asking for your credit card information. This is a problem with Substack. 1Password can definitely do better to guard against it happening, but the only reason it did happen is because Substack actively tried to hide important information from users in a payment screen.