14 ms·

Establishing secure connection

472 points by eloisius 14y ago

tptacek 14y ago
Exactly the security I'd expect from a "CEO Portal". :)
- Justsignedup 14y ago
  Bwahahahahahaha!
- jneal 14y ago
  Very true, but for those that don't know in this case CEO is "Commercial Electronic Office"
hfs 14y ago
I know someone who does web development internally at Wells Fargo. It's surprising how much stuff is exactly like this with the sole intent of making the user feel more secure and/or high-tech.
obilgic 14y ago
It closes the tab when I click "inspect element". How does it detect that?
- deleted 14y ago
  [deleted]
- eccp 14y ago
  it's the window.onblur handler. If you select "inspect element" the browser opens a new window for the developer tools and the previous window loses the focus, triggering the handler. It also happens if you load the page then open a new tab. The previous tab will lose focus and close itself.
deleted 14y ago
[deleted]
arjn 14y ago
Wow! I can't decide if this is hilarious or scandalous.
ante_annum 14y ago
So, it's actually possible to update a dynamically served gif to provide real progress updates. If that's what they were doing, I'd wonder why they did that rather than use js hooks. But this is just a silly static image. What if the server takes longer than the image to load?
- Mahn 14y ago
  Then it'll just get stuck at 100% until it's done. It's not like users have never experienced this, progress bars have never been that accurate. Probably thanks to Windows, which did a pretty good job at educating users not to expect an accurate progress bar at all.
- nwh 14y ago
  The Adobe Flash installer has this issue. The progress bar is just an animation, so you the installer usually finishes way before the bar does.
rgbrenner 14y ago
this page doesn't actually do anything. It loads two animated gifs from Akamai (one for the text, and one for the bar), and then uses some javascript to close the window. If I had to guess, there's a login page. When you submit your login, this page pops up and displays while the login is processed. source: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <title>Loading....</title> </head> <body> <p align="center"> <img src="https://a248.e.akamai.net/6/248/3583/000/wellsoffice.wellsfargo.com/ceoportal/DocumentumRepository/content/images/signon/messaging.gif" width="300" height="30" border="0" alt="Loading Status" /><br /> <img src="https://a248.e.akamai.net/6/248/3583/000/wellsoffice.wellsfargo.com/ceoportal/DocumentumRepository/content/images/signon/statusbar.gif" width="300" height="30" border="0" alt="Loading Status Bar" /> </p> <script type="text/javascript"> var selfClose = function() { self.close(); }; window.onload = function() { setTimeout(selfClose, 10000); }; window.onblur = function() { selfClose(); }; </script> </body> </html>
- thorum 14y ago
  My favorite part is the onblur function.
seldo 14y ago
This sort of fake-loader animated GIF is pretty common; it's just a slightly more advanced version of a spinner GIF. I don't think it's really that bad. What would be bad is if this page would accept a parameter to redirect you to somewhere, but it appears it doesn't do that -- it just closes itself. Presumably this page appears in an overlay that then closes itself.
- brown9-2 14y ago
  With spinner gifs, you generally tell them to stop spinning after some event; this just closes the window after a hard-coded 10 seconds.
  - path411 14y ago
    With most of the spinner gifs I use, the gif will just be in the element that I put the dynamic content into. Then when I load the content into the element, the gif is replaced and disappears.
- obviouslygreen 14y ago
  It's not "bad" in the sense of actually hurting people, but it is dishonest... it's a meaningless progress bar (not so terrible, Windows has us used to these), but the series of lies flitting on and off the page definitely isn't good. We all know banks aren't trustworthy, but that's what they should be, and their goal should be actual trustworthiness and not false, theatrical crap like this.
  - bonaldi 14y ago
    Or false, theatrical crap like building themselves massive stone buildings more suited for courthouses than branches and decking their interiors out with dark wood and brass? Banks are all about theatrics in the service of image. They depend upon it, in fact. A bank that loses trust is a bank in danger of a run.
    - Dylan16807 14y ago
jmandzik 14y ago
Somewhere, deep within Wells Fargo HQ, there was a depressed developer in a windowless office that died a little inside when asked to make this.
- Justsignedup 14y ago
  Or he was asked "please make this site feel secure"
- nym 14y ago
  I worked with the dev who wrote this at Wells Fargo. To be fair, they do have windows in their office.
  - thebigshane 14y ago
    I worked with the dev who wrote this at Wells Fargo You can't say that and not provide more details.... You are obligated now.
    - ISL 14y ago
      Nope, he's not.
      - dasil003 14y ago
        Now you're on The Big Shane's list as well.
    - nuclear_eclipse 14y ago
      He's probably obligated to not provide more details...
      - nym 14y ago
        Ding ding.
  - christopheraden 14y ago
manaskarekar 14y ago
Reminds me of this interesting reddit discussion: http://www.reddit.com/r/AskReddit/comments/uc6qy/reddit_today_i_was_reading_about_bose_thanks_to/c4u50kr http://www.reddit.com/r/AskReddit/comments/uc6qy/reddit_toda... And the corresponding HN discussion that followed: (Apple's iOS is "deceptively fast") http://news.ycombinator.com/item?id=4047032 http://news.ycombinator.com/item?id=4047032 In this case, we have security instead of speed. That's not to say it isn't secure anyway.
MattRogish 14y ago
This is one of those things that is done by people going "We need our customers to 'feel secure'". I get the rationale, but is there actually any data that suggests this gives that actual feeling? That users "feel" more secure? Or are more trusting of the site? Or is this just cargo-cult UX? edit: I've seen this on too many financial apps to think it's an isolated incident. It's clearly a "thing" in financial apps (TurboTax.com does it all the time; I see it on my Bank app, lots of mobile apps, etc.) There's gotta be a reason, even if it's wrong.
- Mahn 14y ago
  If I had to throw a guess, I'd say there was a random non technical manager in the company who saw the page was loading too fast and didn't like it; "it should show there is a heavy process in the background, otherwise our customers will think it is too simple!". Either way I doubt an UX genius is behind this.
  - courtewing 14y ago
    It could be the opposite. Wells Fargo has a lot of different apps that need to authenticate and integrate with their identity management/sso system. It is near-trivial to implement this sort of thing, but it isn't necessarily trivial to make it fast. I wouldn't be surprised if the authentication process was taking long enough that a decision was made to add some sort of "loader" like this to make it appear like the extra time was absolutely necessary from a security standpoint. It's a bit of a lazy decision from a UX standpoint, but it isn't entirely uncommon either: when you notice some action is slow, slap an animation in front of it.
  - syassami 14y ago
    Ah, The good old Thread.sleeep(10000) to make it feel extra secure
  - rgbrenner 14y ago
    If I had to guess, I would say it was the opposite. The page was loading too slowly, so users would click submit a second time. So the popup was added so the users know their first click was received and the page is loading. Seriously, users will resubmit forms if the next page doesn't respond in a 1000ms - 1500ms.
gfalcao 14y ago
This is ridiculous
phpnode 14y ago
hfs - your account has been dead for > 200 days
jlarocco 14y ago
That's kind of silly. But as a Wells Fargo customer, I've never seen it while using their website, and I use the site to check my accounts and transfer money between accounts once or twice a week.
- jeff18 14y ago
  It is for their commercial portal: https://www.wellsfargo.com/com/ https://www.wellsfargo.com/com/
salman89 14y ago
Likely is security theater, but in all fairness they might actually be doing all those things and wanted a UI element to let users know what is taking so long.
DrewHintz 14y ago
> ceoportal Sounds about right.
- mtrn 14y ago
  My thoughts exactly.
dumyCredentials 14y ago
You can see this in action by trying to login using dummy credentials here: https://wellsoffice.wellsfargo.com/ceoportal/ https://wellsoffice.wellsfargo.com/ceoportal/ :-)
- thebigshane 14y ago
  That makes this even sillier... The popup stays open claiming to be authenticating, while the main page has already returned with the error message "Your sign on was unsuccessful. Please try again..."
  - shivaas 14y ago
    yep.. its a theatre all right
gesman 14y ago
I envy consulting company that was tasked $100k to build such a "secure solution" :)
jseip 14y ago
We need a progress bar! ~Brilliant MBA
- rozap 14y ago
  That's why they get paid the big bucks. Genius!
unsignedint 14y ago
This reminds me of a story I heard about those ATMs. What I heard is that there are technologies out there that can make a machine to count/validate cash almost instantaneous while not sacrificing accuracy. But apparently, that makes some customers worry that their money is not being processed right, and thus, every time you deposit money to those ATMs, they make that grinding noise, appears to be doing something useful.
- jdechko 14y ago
  Which pisses me off because I'm wondering what the heck is taking so long. If the vending machine can count a dollar instantly, why can't the ATM do it. On the other hand, whatever algorithm they're using for the handwriting recognition on checks is pretty amazing. I've deposited 100's of checks and I've only had to type an amount once.
  - encoderer 14y ago
    A state of the art surely advanced by the USPS. Every time I scribble out an address in my awful handwriting I pause for a second to appreciate the USPS software that reads this and turns it into a barcode. Though to be fair I think all it has to do is decipher the zip code.
    - shiflett 14y ago
      It's more complicated than that. The last line has to match two out of three (for example, city and ZIP), and then it can try to do some reverse analysis on what you've written for the address line. (Even that's an oversimplification; it's pretty darn impressive.) The USPS also has the additional challenge of matching what you think is your address with what is actually your address. Very, very few people know their address. If that's not bad enough, if you've ever had something arrive successfully, you expect the address that was used to work forever.
      - kd0amg 14y ago
        The USPS also has the additional challenge of matching what you think is your address with what is actually your address. Very, very few people know their address. What parts of their addresses do people typically get wrong? Where can one go to find one's actual address?
aqme28 14y ago
If you were going to inspect to see if it was actually doing anything, let me save you the trouble. It just plays these two gifs ontop of eachother. https://a248.e.akamai.net/6/248/3583/000/wellsoffice.wellsfargo.com/ceoportal/DocumentumRepository/content/images/signon/messaging.gif https://a248.e.akamai.net/6/248/3583/000/wellsoffice.wellsfa... https://a248.e.akamai.net/6/248/3583/000/wellsoffice.wellsfargo.com/ceoportal/DocumentumRepository/content/images/signon/statusbar.gif https://a248.e.akamai.net/6/248/3583/000/wellsoffice.wellsfa...
mattdeboard 14y ago
TurboTax has something that struck me today as similar (in spirit) to this, though TurboTax's is a skeuomorphic thing. It's the "Save & Exit" button TurboTax has. I'm sure that they are saving all info as it is entered, but users of QuickBooks, Excel, etc., I'm sure are used to having to save their data manually then exit. I think all the guffawing at this progress bar is a little overblown. If a question or concern comes up in user testing multiple times -- "How do I know my connection is secure?" -- then why not put something in there that makes the user feel safer? What's the problem with that? Sure maybe it's a little overblown graphically but, c'mon, when you're a bank you need your customers to feel secure, in addition to actually being secure.
- emilv 14y ago
  I think it is a terrible idea to put fake security symbols on the screen. It makes people trust those fake symbols instead of learning what they should look for. Since the symbols are just fake it is very easy to stage a MITM attack. A much better security indicator would be something saying "This site is secure if there's a green area in the address bar [picture of what it should look like]. Click it to verify our identity.".
- eric_the_read 14y ago
  I'm pretty sure Turbo Tax is not saving as you go. I had just finished entering my income a couple of weeks ago, and just as I started on my deductions, it crashed. None of the work I had done up to that point was saved.
daigoba66 14y ago
"reticulating splines"
ripberge 14y ago
I use this tool everyday and it has always made me laugh. The security of the CEO portal is actually legit though. In order to do anything you must login with: company name, username & password. Once inside in order to do anything important you must use your pin number + a random number from a security dongle like this: http://en.wikipedia.org/wiki/Security_token http://en.wikipedia.org/wiki/Security_token Then someone else from within your company must repeat a similar process to approve your action. So you always need at least two people within your company to perform any action. Typically the CEO portal is used for wire transfers where security is pretty damn important--once the money is gone--its really, really gone.
ben1040 14y ago
This reminds me of something we had at my office about 15 years ago because people were complaining their workstations were slow. In reality, their workstations were just slow machines; standard issue box for most people was a 70MHz Sun SS-5. So we wrote a perl script that printed out a bunch of platitudes like these, while printing out an ASCII "progress bar." It had some randomly determined sleep() calls in there to make it seem like it was doing something. Optimizing priority queues... Recalculating scheduler lookup tables... Terminating unused system processes... Recovering memory leaks... Flushing network buffers... Then it'd randomly pick a number X and report to the user "System reports X% faster." We called it "speed" and deployed it to the app server. Some folks started getting into the habit of running it every morning and swore by it.
- nathan_long 14y ago
  That is both brilliant and evil.
- greenfrog 14y ago
  Reticulating splines
  - derefr 14y ago
    Other ways to reticulate splines: - Like a documentary: http://www.youtube.com/watch?v=XZlWmYe8HM4 http://www.youtube.com/watch?v=XZlWmYe8HM4 - Extremely dramatically: http://www.youtube.com/watch?v=bT2gfHU6yCU http://www.youtube.com/watch?v=bT2gfHU6yCU
- hysterix 14y ago
  My father was an audio engineer/mixer and worked with some big names. He told me a similar story that happened to him later in life when he finally owned his own studio. There were clients that would always insist on making audio adjustments, for no good reason at all. They were paying to have their music professionally mixed, yet still insisted on making adjustments and changes. Finally my dad and his friend came up with a great solution. Mind you this was prior to everything being digital, so what they did was they had a massive 24 track. (a really big machine where you can individually adjust the sound of each track) Well what they did was installed a knob that looked just like the other ones in the track, but placed it a bit lower and near to where the client would be sitting. The client was then told they can adjust the "openness", or the "richness" by adjusting this rotating knob to a particular setting (remember, the knob does nothing, and isn't connected anywhere). My dad said clients would spend hours adjusting this knob until they got it "just right", and would make sure to let everyone know in the studio that knob was dialed in and to not touch it. It's amazing how many silly things people have to do in all walks of life to placate the ignorant.
joshwayne 14y ago
I see a lot of comments condemning this feature and saying it's ridiculous. However, you have to understand that people outside of the tech industry have a very different mental model of how computers work than the rest of us. One example of this is shown in a usability study by the Baymard Institute on top ecommerce checkout processes [1]. The goal of the study was to determine best practices for checkout usability by testing the top 15 ecommerce sites. One of the more fascinating finds they made was that during the checkout process, users perceived certain fields as being more secure than others. Even though the fields were all part of the same form and on the same page, users still believed fields with a little lock icon were more secure than the rest of the fields! It didn't matter if the entire page was encrypted. Users would abandon the checkout process because the credit card fields didn't "feel secure" compared to the rest of the page. To most of us, this looks like a frivolous feature suggested by a "UX monkey" (as one commenter put it) but don't underestimate the power of making users feel safe. For all we know, this stupid gif could have cut support calls 20%. [1] http://baymard.com/checkout-usability http://baymard.com/checkout-usability
bestest 14y ago
This felt uncanny. Like I was violated in some strangely wonderful peculiar way.
borgchick 14y ago
security theatre much? face palm
adev 14y ago
Been there done that. Software development is sometimes Social development as well.
hy3lxs 14y ago
"Locksmith gets less tips and more price complaints for being faster" http://news.ycombinator.com/item?id=2007385 http://news.ycombinator.com/item?id=2007385 (807 days ago)
bmle 14y ago
I used to work for a major online tax software provider. I won't name them but I'm sure you can guess. Not sure if it's still there but right after you log in, there are some redirects that take you to the app servers hosting the product and you get the same type of loading image though no secure connections were being established.
- bmle 14y ago
  I should emphasize that the connection was already secure, but creating a user session on the server side took a long time so this graphic was displayed to users. So don't worry!
bbq123 14y ago
As a customer of Wells Fargo CEO Portal I no longer feel safe using it. Fun aside this portal uses two factor authentication with RSA tokens (that were promptly replaced after RSA token vulnerability was found).
Rashmi123 14y ago
hmm its nice :P i want to give you some information related to Major effect of extra marital affairs: http://goo.gl/wVkAm http://goo.gl/wVkAm
noblethrasher 14y ago
Don Norman discusses why you would want to do something like that here http://businessofsoftware.org/video_09_dnorman.aspx http://businessofsoftware.org/video_09_dnorman.aspx (50:30).
eclipticplane 14y ago
We added progress bars and silly status messages to our 500 error pages in our web app. Things like a 15 second count down to "recalibrate" or "attempting automatic system correction". It, at minimum, stopped users from constantly clicking a button or link that was having server issues (and thus spamming our error queue). Instead, they'd wait the 15 seconds and then go try again. If the issue was transient, like a dropped connection to the database or memcached or some obscure deadlock, the "automatic" fixes worked as expected from the user's perspective. We, of course, still got the full error report to diagnose the issue. I even have a few gems in our user feedback system where the users outright praise the "automatic error fixer" and they wish every website/app had a tool like ours.
JadeNB 14y ago
The Mac OS X.4 PBE would display the estimated boot time on startup; I thought it was using sophisticated logic, but was later told that it just averaged the last, say, 10 boot times (which is probably at least as reliable). I seem to remember that you could even execute `/usr/bin/loginwindow` (or some such path) from the command line and watch it pretend to boot at any time. I forget when this 'feature' went—maybe as early as Leopard?—but it's not in Mountain Lion.
maxhe 14y ago
I noticed something similar on TurboTax: https://turbotax.intuit.com/tto/alias/dncanimation https://turbotax.intuit.com/tto/alias/dncanimation
mikegirouard 14y ago
As a fan of UX patterns I'm curious: what would this one be called?
yoho 14y ago
yoho
malacka 14y ago
nyugalom
jloughry 14y ago
It happens in chemistry too. In his book The Green Flame, Dequasie told the following story: "The salesman had been selling hydrochloric acid, sometimes known as muriatic acid. The industrial grade usually had a green tint caused by contamination with iron. The company that the salesman worked for improved its equipment at considerable expense and proudly began putting out water-white muriatic acid. The salesman immediately began getting complaints from customers who did not want that weak white stuff. They insisted that they wanted that strong green stuff that they used to get. So, for those customers, the salesman arranged to have a small nail dissolved in each jug shipped to them. Result: happiness."

472 points by eloisius 14y ago

tptacek 14y ago

Exactly the security I'd expect from a "CEO Portal". :)

Justsignedup 14y ago
Bwahahahahahaha!
jneal 14y ago
Very true, but for those that don't know in this case CEO is "Commercial Electronic Office"

hfs 14y ago

I know someone who does web development internally at Wells Fargo. It's surprising how much stuff is exactly like this with the sole intent of making the user feel more secure and/or high-tech.

obilgic 14y ago

It closes the tab when I click "inspect element". How does it detect that?

deleted 14y ago
[deleted]
eccp 14y ago
it's the window.onblur handler. If you select "inspect element" the browser opens a new window for the developer tools and the previous window loses the focus, triggering the handler. It also happens if you load the page then open a new tab. The previous tab will lose focus and close itself.

deleted 14y ago

[deleted]

arjn 14y ago

Wow! I can't decide if this is hilarious or scandalous.

ante_annum 14y ago

So, it's actually possible to update a dynamically served gif to provide real progress updates. If that's what they were doing, I'd wonder why they did that rather than use js hooks. But this is just a silly static image. What if the server takes longer than the image to load?

Mahn 14y ago
Then it'll just get stuck at 100% until it's done. It's not like users have never experienced this, progress bars have never been that accurate. Probably thanks to Windows, which did a pretty good job at educating users not to expect an accurate progress bar at all.
nwh 14y ago
The Adobe Flash installer has this issue. The progress bar is just an animation, so you the installer usually finishes way before the bar does.

rgbrenner 14y ago

this page doesn't actually do anything. It loads two animated gifs from Akamai (one for the text, and one for the bar), and then uses some javascript to close the window. If I had to guess, there's a login page. When you submit your login, this page pops up and displays while the login is processed. source: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <title>Loading....</title> </head> <body> <p align="center"> <img src="https://a248.e.akamai.net/6/248/3583/000/wellsoffice.wellsfargo.com/ceoportal/DocumentumRepository/content/images/signon/messaging.gif" width="300" height="30" border="0" alt="Loading Status" /><br /> <img src="https://a248.e.akamai.net/6/248/3583/000/wellsoffice.wellsfargo.com/ceoportal/DocumentumRepository/content/images/signon/statusbar.gif" width="300" height="30" border="0" alt="Loading Status Bar" /> </p> <script type="text/javascript"> var selfClose = function() { self.close(); }; window.onload = function() { setTimeout(selfClose, 10000); }; window.onblur = function() { selfClose(); }; </script> </body> </html>

thorum 14y ago
My favorite part is the onblur function.

seldo 14y ago

This sort of fake-loader animated GIF is pretty common; it's just a slightly more advanced version of a spinner GIF. I don't think it's really that bad. What would be bad is if this page would accept a parameter to redirect you to somewhere, but it appears it doesn't do that -- it just closes itself. Presumably this page appears in an overlay that then closes itself.

brown9-2 14y ago
With spinner gifs, you generally tell them to stop spinning after some event; this just closes the window after a hard-coded 10 seconds.
- path411 14y ago
  With most of the spinner gifs I use, the gif will just be in the element that I put the dynamic content into. Then when I load the content into the element, the gif is replaced and disappears.
obviouslygreen 14y ago
It's not "bad" in the sense of actually hurting people, but it is dishonest... it's a meaningless progress bar (not so terrible, Windows has us used to these), but the series of lies flitting on and off the page definitely isn't good. We all know banks aren't trustworthy, but that's what they should be, and their goal should be actual trustworthiness and not false, theatrical crap like this.
- bonaldi 14y ago
  Or false, theatrical crap like building themselves massive stone buildings more suited for courthouses than branches and decking their interiors out with dark wood and brass? Banks are all about theatrics in the service of image. They depend upon it, in fact. A bank that loses trust is a bank in danger of a run.
  - Dylan16807 14y ago

jmandzik 14y ago

Somewhere, deep within Wells Fargo HQ, there was a depressed developer in a windowless office that died a little inside when asked to make this.

Justsignedup 14y ago
Or he was asked "please make this site feel secure"
nym 14y ago
I worked with the dev who wrote this at Wells Fargo. To be fair, they do have windows in their office.
- thebigshane 14y ago
  I worked with the dev who wrote this at Wells Fargo You can't say that and not provide more details.... You are obligated now.
  - ISL 14y ago
    Nope, he's not.
    - dasil003 14y ago
      Now you're on The Big Shane's list as well.
  - nuclear_eclipse 14y ago
    He's probably obligated to not provide more details...
    - nym 14y ago
      Ding ding.
- christopheraden 14y ago

manaskarekar 14y ago

Reminds me of this interesting reddit discussion: http://www.reddit.com/r/AskReddit/comments/uc6qy/reddit_today_i_was_reading_about_bose_thanks_to/c4u50kr http://www.reddit.com/r/AskReddit/comments/uc6qy/reddit_toda... And the corresponding HN discussion that followed: (Apple's iOS is "deceptively fast") http://news.ycombinator.com/item?id=4047032 http://news.ycombinator.com/item?id=4047032 In this case, we have security instead of speed. That's not to say it isn't secure anyway.

MattRogish 14y ago

This is one of those things that is done by people going "We need our customers to 'feel secure'". I get the rationale, but is there actually any data that suggests this gives that actual feeling? That users "feel" more secure? Or are more trusting of the site? Or is this just cargo-cult UX? edit: I've seen this on too many financial apps to think it's an isolated incident. It's clearly a "thing" in financial apps (TurboTax.com does it all the time; I see it on my Bank app, lots of mobile apps, etc.) There's gotta be a reason, even if it's wrong.

Mahn 14y ago
If I had to throw a guess, I'd say there was a random non technical manager in the company who saw the page was loading too fast and didn't like it; "it should show there is a heavy process in the background, otherwise our customers will think it is too simple!". Either way I doubt an UX genius is behind this.
- courtewing 14y ago
  It could be the opposite. Wells Fargo has a lot of different apps that need to authenticate and integrate with their identity management/sso system. It is near-trivial to implement this sort of thing, but it isn't necessarily trivial to make it fast. I wouldn't be surprised if the authentication process was taking long enough that a decision was made to add some sort of "loader" like this to make it appear like the extra time was absolutely necessary from a security standpoint. It's a bit of a lazy decision from a UX standpoint, but it isn't entirely uncommon either: when you notice some action is slow, slap an animation in front of it.
- syassami 14y ago
  Ah, The good old Thread.sleeep(10000) to make it feel extra secure
- rgbrenner 14y ago
  If I had to guess, I would say it was the opposite. The page was loading too slowly, so users would click submit a second time. So the popup was added so the users know their first click was received and the page is loading. Seriously, users will resubmit forms if the next page doesn't respond in a 1000ms - 1500ms.

gfalcao 14y ago

This is ridiculous

phpnode 14y ago

hfs - your account has been dead for > 200 days

jlarocco 14y ago

That's kind of silly. But as a Wells Fargo customer, I've never seen it while using their website, and I use the site to check my accounts and transfer money between accounts once or twice a week.

jeff18 14y ago
It is for their commercial portal: https://www.wellsfargo.com/com/ https://www.wellsfargo.com/com/

salman89 14y ago

Likely is security theater, but in all fairness they might actually be doing all those things and wanted a UI element to let users know what is taking so long.

DrewHintz 14y ago

> ceoportal Sounds about right.

mtrn 14y ago
My thoughts exactly.

dumyCredentials 14y ago

You can see this in action by trying to login using dummy credentials here: https://wellsoffice.wellsfargo.com/ceoportal/ https://wellsoffice.wellsfargo.com/ceoportal/ :-)

thebigshane 14y ago
That makes this even sillier... The popup stays open claiming to be authenticating, while the main page has already returned with the error message "Your sign on was unsuccessful. Please try again..."
- shivaas 14y ago
  yep.. its a theatre all right

gesman 14y ago

I envy consulting company that was tasked $100k to build such a "secure solution" :)

jseip 14y ago

We need a progress bar! ~Brilliant MBA

rozap 14y ago
That's why they get paid the big bucks. Genius!

unsignedint 14y ago

This reminds me of a story I heard about those ATMs. What I heard is that there are technologies out there that can make a machine to count/validate cash almost instantaneous while not sacrificing accuracy. But apparently, that makes some customers worry that their money is not being processed right, and thus, every time you deposit money to those ATMs, they make that grinding noise, appears to be doing something useful.

jdechko 14y ago
Which pisses me off because I'm wondering what the heck is taking so long. If the vending machine can count a dollar instantly, why can't the ATM do it. On the other hand, whatever algorithm they're using for the handwriting recognition on checks is pretty amazing. I've deposited 100's of checks and I've only had to type an amount once.
- encoderer 14y ago
  A state of the art surely advanced by the USPS. Every time I scribble out an address in my awful handwriting I pause for a second to appreciate the USPS software that reads this and turns it into a barcode. Though to be fair I think all it has to do is decipher the zip code.
  - shiflett 14y ago
    It's more complicated than that. The last line has to match two out of three (for example, city and ZIP), and then it can try to do some reverse analysis on what you've written for the address line. (Even that's an oversimplification; it's pretty darn impressive.) The USPS also has the additional challenge of matching what you think is your address with what is actually your address. Very, very few people know their address. If that's not bad enough, if you've ever had something arrive successfully, you expect the address that was used to work forever.
    - kd0amg 14y ago
      The USPS also has the additional challenge of matching what you think is your address with what is actually your address. Very, very few people know their address. What parts of their addresses do people typically get wrong? Where can one go to find one's actual address?

aqme28 14y ago

If you were going to inspect to see if it was actually doing anything, let me save you the trouble. It just plays these two gifs ontop of eachother. https://a248.e.akamai.net/6/248/3583/000/wellsoffice.wellsfargo.com/ceoportal/DocumentumRepository/content/images/signon/messaging.gif https://a248.e.akamai.net/6/248/3583/000/wellsoffice.wellsfa... https://a248.e.akamai.net/6/248/3583/000/wellsoffice.wellsfargo.com/ceoportal/DocumentumRepository/content/images/signon/statusbar.gif https://a248.e.akamai.net/6/248/3583/000/wellsoffice.wellsfa...

mattdeboard 14y ago

TurboTax has something that struck me today as similar (in spirit) to this, though TurboTax's is a skeuomorphic thing. It's the "Save & Exit" button TurboTax has. I'm sure that they are saving all info as it is entered, but users of QuickBooks, Excel, etc., I'm sure are used to having to save their data manually then exit. I think all the guffawing at this progress bar is a little overblown. If a question or concern comes up in user testing multiple times -- "How do I know my connection is secure?" -- then why not put something in there that makes the user feel safer? What's the problem with that? Sure maybe it's a little overblown graphically but, c'mon, when you're a bank you need your customers to feel secure, in addition to actually being secure.

emilv 14y ago
I think it is a terrible idea to put fake security symbols on the screen. It makes people trust those fake symbols instead of learning what they should look for. Since the symbols are just fake it is very easy to stage a MITM attack. A much better security indicator would be something saying "This site is secure if there's a green area in the address bar [picture of what it should look like]. Click it to verify our identity.".
eric_the_read 14y ago
I'm pretty sure Turbo Tax is not saving as you go. I had just finished entering my income a couple of weeks ago, and just as I started on my deductions, it crashed. None of the work I had done up to that point was saved.

daigoba66 14y ago

"reticulating splines"

ripberge 14y ago

I use this tool everyday and it has always made me laugh. The security of the CEO portal is actually legit though. In order to do anything you must login with: company name, username & password. Once inside in order to do anything important you must use your pin number + a random number from a security dongle like this: http://en.wikipedia.org/wiki/Security_token http://en.wikipedia.org/wiki/Security_token Then someone else from within your company must repeat a similar process to approve your action. So you always need at least two people within your company to perform any action. Typically the CEO portal is used for wire transfers where security is pretty damn important--once the money is gone--its really, really gone.

ben1040 14y ago

This reminds me of something we had at my office about 15 years ago because people were complaining their workstations were slow. In reality, their workstations were just slow machines; standard issue box for most people was a 70MHz Sun SS-5. So we wrote a perl script that printed out a bunch of platitudes like these, while printing out an ASCII "progress bar." It had some randomly determined sleep() calls in there to make it seem like it was doing something. Optimizing priority queues... Recalculating scheduler lookup tables... Terminating unused system processes... Recovering memory leaks... Flushing network buffers... Then it'd randomly pick a number X and report to the user "System reports X% faster." We called it "speed" and deployed it to the app server. Some folks started getting into the habit of running it every morning and swore by it.

nathan_long 14y ago
That is both brilliant and evil.
greenfrog 14y ago
Reticulating splines
- derefr 14y ago
  Other ways to reticulate splines: - Like a documentary: http://www.youtube.com/watch?v=XZlWmYe8HM4 http://www.youtube.com/watch?v=XZlWmYe8HM4 - Extremely dramatically: http://www.youtube.com/watch?v=bT2gfHU6yCU http://www.youtube.com/watch?v=bT2gfHU6yCU
hysterix 14y ago
My father was an audio engineer/mixer and worked with some big names. He told me a similar story that happened to him later in life when he finally owned his own studio. There were clients that would always insist on making audio adjustments, for no good reason at all. They were paying to have their music professionally mixed, yet still insisted on making adjustments and changes. Finally my dad and his friend came up with a great solution. Mind you this was prior to everything being digital, so what they did was they had a massive 24 track. (a really big machine where you can individually adjust the sound of each track) Well what they did was installed a knob that looked just like the other ones in the track, but placed it a bit lower and near to where the client would be sitting. The client was then told they can adjust the "openness", or the "richness" by adjusting this rotating knob to a particular setting (remember, the knob does nothing, and isn't connected anywhere). My dad said clients would spend hours adjusting this knob until they got it "just right", and would make sure to let everyone know in the studio that knob was dialed in and to not touch it. It's amazing how many silly things people have to do in all walks of life to placate the ignorant.

joshwayne 14y ago

I see a lot of comments condemning this feature and saying it's ridiculous. However, you have to understand that people outside of the tech industry have a very different mental model of how computers work than the rest of us. One example of this is shown in a usability study by the Baymard Institute on top ecommerce checkout processes [1]. The goal of the study was to determine best practices for checkout usability by testing the top 15 ecommerce sites. One of the more fascinating finds they made was that during the checkout process, users perceived certain fields as being more secure than others. Even though the fields were all part of the same form and on the same page, users still believed fields with a little lock icon were more secure than the rest of the fields! It didn't matter if the entire page was encrypted. Users would abandon the checkout process because the credit card fields didn't "feel secure" compared to the rest of the page. To most of us, this looks like a frivolous feature suggested by a "UX monkey" (as one commenter put it) but don't underestimate the power of making users feel safe. For all we know, this stupid gif could have cut support calls 20%. [1] http://baymard.com/checkout-usability http://baymard.com/checkout-usability

bestest 14y ago

This felt uncanny. Like I was violated in some strangely wonderful peculiar way.

borgchick 14y ago

security theatre much? face palm

adev 14y ago

Been there done that. Software development is sometimes Social development as well.

hy3lxs 14y ago

"Locksmith gets less tips and more price complaints for being faster" http://news.ycombinator.com/item?id=2007385 http://news.ycombinator.com/item?id=2007385 (807 days ago)

bmle 14y ago

I used to work for a major online tax software provider. I won't name them but I'm sure you can guess. Not sure if it's still there but right after you log in, there are some redirects that take you to the app servers hosting the product and you get the same type of loading image though no secure connections were being established.

bmle 14y ago
I should emphasize that the connection was already secure, but creating a user session on the server side took a long time so this graphic was displayed to users. So don't worry!

bbq123 14y ago

As a customer of Wells Fargo CEO Portal I no longer feel safe using it. Fun aside this portal uses two factor authentication with RSA tokens (that were promptly replaced after RSA token vulnerability was found).

Rashmi123 14y ago

hmm its nice :P i want to give you some information related to Major effect of extra marital affairs: http://goo.gl/wVkAm http://goo.gl/wVkAm

noblethrasher 14y ago

Don Norman discusses why you would want to do something like that here http://businessofsoftware.org/video_09_dnorman.aspx http://businessofsoftware.org/video_09_dnorman.aspx (50:30).

eclipticplane 14y ago

We added progress bars and silly status messages to our 500 error pages in our web app. Things like a 15 second count down to "recalibrate" or "attempting automatic system correction". It, at minimum, stopped users from constantly clicking a button or link that was having server issues (and thus spamming our error queue). Instead, they'd wait the 15 seconds and then go try again. If the issue was transient, like a dropped connection to the database or memcached or some obscure deadlock, the "automatic" fixes worked as expected from the user's perspective. We, of course, still got the full error report to diagnose the issue. I even have a few gems in our user feedback system where the users outright praise the "automatic error fixer" and they wish every website/app had a tool like ours.

JadeNB 14y ago

The Mac OS X.4 PBE would display the estimated boot time on startup; I thought it was using sophisticated logic, but was later told that it just averaged the last, say, 10 boot times (which is probably at least as reliable). I seem to remember that you could even execute `/usr/bin/loginwindow` (or some such path) from the command line and watch it pretend to boot at any time. I forget when this 'feature' went—maybe as early as Leopard?—but it's not in Mountain Lion.

maxhe 14y ago

I noticed something similar on TurboTax: https://turbotax.intuit.com/tto/alias/dncanimation https://turbotax.intuit.com/tto/alias/dncanimation

mikegirouard 14y ago

As a fan of UX patterns I'm curious: what would this one be called?

yoho 14y ago

yoho

malacka 14y ago

nyugalom

jloughry 14y ago

It happens in chemistry too. In his book The Green Flame, Dequasie told the following story: "The salesman had been selling hydrochloric acid, sometimes known as muriatic acid. The industrial grade usually had a green tint caused by contamination with iron. The company that the salesman worked for improved its equipment at considerable expense and proudly began putting out water-white muriatic acid. The salesman immediately began getting complaints from customers who did not want that weak white stuff. They insisted that they wanted that strong green stuff that they used to get. So, for those customers, the salesman arranged to have a small nail dissolved in each jug shipped to them. Result: happiness."