4 ms·

It's not a UI problem, it's a user problem. Users will always click "Yes, allow" to everything without even reading it, be the message in dialog box or notifica

• mquander 15y ago
  Wait a minute, what the hell do you think got them in the habit of compulsively clicking "yes"? It's interfaces like this, which offer a question for which the correct answer 95% of the time is to click "yes". I'm not saying that I have a better idea about how to do it, but this is UI designers reaping what they have sown.
  • thwarted 15y ago
    The correct answer isn't to click "yes", the correct answer is to click "no". The problem is that the correct answer doesn't give someone access to the content, and many, many sites are not in a position to do things correctly or don't understand what the correct thing to do is (I don't know why this is the case), so if the user wants to make any progress at all, even if they end up doing so insecurely, they have to answer in whatever way allows them to make progress.
    • mquander 15y ago
      Well, I'm not sure I agree. The correct answer is determined by how much they care about the risk that someone might be feeding them a malicious script. I think most users care more about the convenience of accessing their favorite site with full functionality than this security problem, as demonstrated by most people's totally lax regard for security in other ways. (Of course, I'm sure that most users have no idea what clicking 'yes' entails -- I'm just proposing that if they did, they would probably click 'yes' anyway.)
      • mtogo 15y ago
        No, you're wrong. If a site has users that don't care about security at all and are happy to have their accounts compromised, the site shouldn't even be using SSL in the first place.
        • mquander 15y ago
          Isn't it perfectly plausible that 80% of a site's users don't give a hoot about security, but 20% do? I don't see any reason not to give the minority SSL (hopefully compromised minimally by non-SSL resources) regardless of whether the majority cares.
          • mtogo 15y ago
            | SSL (hopefully compromised minimally by non-SSL resources) There's a reason browsers don't display a secure logo on HTTPS connections with non-HTTPS resources: it's not secure. It's not "minimally compromised", it's compromised. If my server has one service with one vulnerability, it's not "minimally vulnerable", it's vulnerable. | I don't see any reason not to give the minority SSL I was being sarcastic. | Isn't it perfectly plausible that 80% of a site's users don't give a hoot about security, but 20% do? It's not even about the users. The site should not ever be mixing HTTP with HTTPS on the same page.
            • mquander 15y ago
              Yeah, I agree with that. It's a stupid problem, but the problem exists, and until we are allowed to forcefully seize the servers of people who implement shitty software and fix the problems, it won't go away, so it's worth trying to do the best thing possible for users.
    • deleted 15y ago
      [deleted]
  • mtogo 15y ago
    | Wait a minute, what the hell do you think got them in the habit of compulsively clicking "yes"? The user is trying to do something (check email, save a note, play angry birds). Something is in their way, and there is an obvious way to get it out of their way. It has nothing to do with UI design or habits.
    • mquander 15y ago
      If you're using a computer, something usually "gets in your way" every ten minutes. If that wasn't the case, users might be less keen to get it out of their way, and try to figure it out or ask for help instead.
      • mtogo 15y ago
        Take the Xbox then. It only interrupts starting a game once in a while, when there's a game update. Yet, every one of my friends start mashing the A button as soon as the update window pops up. They just want to play black ops, not read some dialog.
        • mquander 15y ago
          Good point.
• beaumartinez 15y ago
  Interfaces should cater to users. It's not the users' fault your interface isn't intuitive—it's yours. In this case, "Load anyway" is a poor label. "Load potentially insecure script anyway" is better (if a bit long-winded).
  • deleted 15y ago
    [deleted]
  • mtogo 15y ago
    | Interfaces should cater to users. It's not the users' fault your interface isn't intuitive—it's yours. I did not design this interface.
• justincormack 15y ago
  Just word the question to "do you want to be sure you have a secure web experience" so the default yes is secure...
  • VMG 15y ago
    then the bug reports of stuff not working come flooding in
    • thwarted 15y ago
      Those bug reports should go to the site, not the browser. That's part of the problem.