7 ms·
A common one is fake consent popups for system notifications. Websites need to ask for consent before sending system notifications via the Notifications API. I
by bogwog 6y ago
A common one is fake consent popups for system notifications.
Websites need to ask for consent before sending system notifications via the Notifications API. If a user declines, that website is blocked from asking again (for obvious reasons)
But many websites cheat this by showing a fake consent popup designed to mimic what the browser would show. If a user clicks "Decline" on the fake popup, the website won't show the real one to avoid being blocked. So the next time you visit the site, they'll be able to show you that popup again as many times as they want.
If a user finally clicks "Accept" on the fake popup (out of frustration probably) then they'll show the real popup. To most people, seeing two popups might seem like a glitch, and will just mindlessly click "Accept" twice.
The only way to circumvent this is to click "Accept" on the fake popup, and then click "Decline" on the real one. 99% of people aren't going to know how to do that.
...I'd post this myself as a comment, but I don't like that it's asking for so much personal information (full name, email, state, city, phone, etc)
- suifbwish 6y agoI found that a lot of those have commonly named elements you can create rules for in noscript so you never see them. Not sure if it would effect the dark pattern ones though.
- Stratoscope 6y agoI get these all the time on mobile websites, and arrived at the same solution you did: tap Accept on the fake popup and then Block on the real consent box. I suppose a site could trick me by making their fake popup look exactly like the real one. But in that case I would tap Block and be no worse off, other than seeing the same notification again the next time, at which point I would probably figure out their trick. I thought of explaining this to some friends to help spare them some needless popups, but decided it was too complicated and would likely just confuse them. This is not an insult toward my friends, just a reminder that something that seems simple to you or me may be very puzzling for most people, no matter how intelligent they are.
- enedil 6y agoThe real popup in Chrome and Firefox exceeds the website frame, so you can easily distinguish it.
- la_fayette 6y agoI am convinced, by many real world observations, that the average joe user cannot distinguish fake html/css/js popups from OS popups.
- wazoox 6y agoCase in point, countless relatives calling "I have a virus on my computer!" because they have a Windows-XP popup on a website "you have a virus" (they are on Windows 10, or Mac OS).
- r_singh 6y agoI was not aware about this but stackoverflow shows me their consent box (and on every stack exchange site) everyday
- coddle-hark 6y agoThis was driving me crazy too, turns out that my adblocker was breaking the consent box. Clicking “Accept” didn’t do anything.
- llacb47 6y agoWhich adblocker?
- busymom0 6y agoI am having the same issue too on Mac Safari with AdGuard.
- reificator 6y agoThe trick there is to use your adblocker to pick the consent box and hide it, and then edit the custom rule to apply to every site.
- inopinatus 6y agoif that's μblock Origin, then ##.js-consent-banner ##.js-dismissable-hero in your filter config does it.
- chrismorgan 6y agoThere are actually cosmetic filter lists for removing such elements from the page. For uBlock Origin, go to the Dashboard, Filter lists tab, and look at the Annoyances lists. Both Fanboy’s Annoyances and EasyList Cookie include ##.js-consent-banner, which deals with Stack Overflow’s huge obnoxious banner.
- bmuon 6y agoIs this really a dark pattern? There's tons of truly deceptive practices but this is one where websites are plainly asking for permissions.
- tmpz22 6y agoYes - they're circumventing the intent of the permissions restrictions implementation to the clear detriment of the user.
- bmuon 6y agoHighly debatable. In fact, trying to classify it as a dark pattern may derail the very valid discussion that the FTC is trying to have. There are significantly worse patterns out there. See [1]. What the push notification pattern is, is annoying. And it is specially annoying because of a prevalence of confirmation dialogs all over the Web with GDPR/CCPA, paid subscriptions, etc. But does it cause harm or monetary loss as the sneak into basket pattern? Or the opt-out unnecessary "insurance" that airlines continue to put in the checkout flow? We do a disservice to ourselves littering the web with these constant asks. But it's not what needs regulation and enforcement. [1] https://www.darkpatterns.org/types-of-dark-pattern https://www.darkpatterns.org/types-of-dark-pattern
- ryandrake 6y agoThe pattern tries to avoid an outcome desired by the user: permanently revoking consent for some permission. Only asking when you are confident the answer is Yes goes against the intent of the platform functionality, and I’d argue that’s a major dark pattern. Similar to how apps used to ask “how do you like app?” And then only prompt to review the app if you responded favorably. Goes entirely against the app store’s intent to uniformly sample users, and I’m glad Apple at least has cracked down on this practice. Just honestly make a product and stop trying to fool the user!
- yuliyp 6y agoSome apps use it reasonably: they'll remember if you said no, but do want to provide more messaging around why they're asking.
- jeremy_wiebe 6y agoThis is commonly referred to as a “soft ask.” The reasons for it are not always nefarious. On some platforms you cannot provide any commentary on why you want to send push notifications and so the soft ask provides a way to give more context on the next (real) permission dialog. I’m not saying this isn’t abused all over, but when used effectively it can provide the user with more information to decide if they want to accept or not as well as allow the website to request it again at a future time possibly for a different reason.
- shkkmo 6y agoAn informative prompt explaining why permissions are needed with a single continue button is not a dark pattern. If you have a "decline" button that bypasses the browser, then you are using a dark pattern.
- anoncake 6y agoAs long as it doesn't mimic the browser. (Another reason why user agent strings and other ways websites can identify the user's browser are a bad idea).
- shkkmo 6y agoIt doesn't matter if it mimics the browser. If you are trying to stop the browser from protecting the user as intended, it is a dark pattern, regardless of how well you camoflage the attempt.
- anoncake 6y agoIn principle yes. But why would you imitate the browser if not to mislead the user? And who wants to mislead the user but has qualms imitating the browser?
- shkkmo 6y agoPeople do all kinds of mental gymnastics to justify doing stuff they know is wrong. I would be unsuprised that people use the lack of camoflage as an excuse to justify using a dark pattern.
- busymom0 6y agoApp developers do this in their apps too when asking to rate the app in the App Store. They first show you a fake popup asking if you are enjoying the app OR want to send feedback. They will only show you the real iOS popup for reviewing the app if you tap "Yes" to the enjoying app.
- Nextgrid 6y agoCan’t believe this isn’t against App Store rules.
- busymom0 6y agoIt sort of is against the rules (disallow custom review prompts) but it doesn't seem to get enforced as far as I can tell. Even top apps like YouTube do this. https://developer.apple.com/app-store/review/guidelines/ https://developer.apple.com/app-store/review/guidelines/ > Use the provided API to prompt users to review your app; this functionality allows customers to provide an App Store rating and review without the inconvenience of leaving your app, and we will disallow custom review prompts.
- matham 6y agoThank you! This is something that has been annoying the hell out of me on instagram using desktop Firefox. Every time I login it prompts to show notifications; I always decline so it shows it again next time I log in. This time I accepted, but blocked it from within firefox. I get it's not a dark pattern because it's clear it's not the browser asking, but still it's very annoying.
- inetknght 6y ago> I get it's not a dark pattern because it's clear it's not the browser asking I disagree... that does make it rather a dark pattern.
- drexlspivey 6y agoA similar one is asking you to rate the app via the native modal (which does nothing) and if you rate with 5 stars they redirect you to the app store to vote there (where it counts). If you rate them with 1-3 stars they prompt you to leave feedback instead.
- jclulow 6y agoI recall experiencing at least one application that would crash if you declined to rate it in the app store. I'm sure it was just shoddy implementation, not handling some condition correctly, but it was hard not to feel like it was intentional.
- hn_throwaway_99 6y agoIIRC didn't Apple or Google start banning apps that did this?
- dnsbty 6y agoOn a related note, Google Maps has on occasion deleted reviews from businesses that used software that employed this tactic for requesting reviews. I’ve seen several businesses lose hundreds of five star reviews because of it.
- tsjq 6y agoThat's clever
- throwaway3699 6y agoTo a certain extent I can't blame apps for doing this. It would be much better for Android and iOS to have a better experience for leaving feedback or giving reviews.
- yoz-y 6y agoDunno about android but on iOS it really is quite trivial if you use the native dialog.
- 6y ago
- Bellamy 6y agoIf a site does something like this, a) You know that site is malicious. b) Choose another site. c) As users get more sophisticated these kind of tricks won't work.
- ImPostingOnHN 6y agoHave you seen any data on whether or not user sophistication does indeed outpace dishonest tactics? In my humble experience, the opposite is true, and the gap ever widens
- Tabular-Iceberg 6y agoI even saw one with a “prove you’re not a robot by clicking ‘accept’” on a notification consent form. I guess I’m a robot, then.
- hambast 6y agoI’ve done this for an app but not for nefarious reasons. A huge part of the app is location based and users would deny location permissions and then not be able to turn it back on (you can go through settings but an awful lot of people don’t know how). The soft ask is one time when your start the app (with an explanation as to why) and if you deny access there it’ll only ever ask again if you tap something like the ‘use my location’ button.
- derivagral 6y agoI took the risk and posted the (relevant) text of this comment and one of the replies. Someone's gotta at least try to bring this to the official sources, right?
- bogwog 6y agoMVP right here