The User Experience Blog
Dialogue around issues and ideas that impact user experience

Insecure Footing: How Bad Usability Endangers Internet Users

/* var quicktagsL10n = {
quickLinks: “(Quick Links)”,
wordLookup: “Enter a word to look up:”,
dictionaryLookup: “Dictionary lookup”,
lookup: “lookup”,
closeAllOpenTags: “Close all open tags”,
closeTags: “cl

buy viagra in uk

ose tags”,
enterURL: “Enter the URL”,
enterImageURL: “Enter the URL of the image”,
enterImageDescription: “Enter a description of the image”,
fullscreen: “fullscreen”,
toggleFullscreen: “Toggle fullscreen mode”
};
try{convertEntities(quicktagsL10n);}catch(e){};
/* ]]> */

edToolbar()

How do you communicate danger to people who don’t speak your language? How do you not only alert them, but give them enough information to act even though you will never meet face-to-face? These questions were behind an effort to design a warning for the proposed nuclear waste storage facility inside Nevada’s Yucca Mountain, and they’re similar to the ones you face when trying to design for user security online.

In 2003, the Desert Space Foundation, a Nevada arts organization, hosted an exhibition that showcased novel ideas for a warning sign that would retain both its meaning and its structural integrity for the 10,000 years that Yucca Mountain was projected to pose a hazard. The difficulty of the task manifested itself in the variety of entries. Several artists assumed that familiar symbols like the yellow and black radiation icon would carry the scent of danger across the divide, but not everyone agreed, according to a Los Angeles Times article at the time.

The risk of radiation burns is lower for Internet users (especially with modern LCD monitors), but being online can be dangerous all the same. The recipients of the communication are separated not by time but by their lack of technical expertise. However, the complexity of the threat and the jargon used to describe it is at least as opaque to many people as ancient pictograms can be to us.

Freedom of Choice

In UX circles, information security and usability are often seen as competing concerns in an ugly but necessary trade-off. This stems from countless hours spent designing for big companies with soul-crushing enterprise security guidelines. These rules result in stringent password requirements, short session time-outs, unhelpful error messages, weak search capabilities, and pop-ups that force users to promise to be careful with sensitive data every time they run a report. These features annoy in the name of reducing reliance on user judgment.

The Internet is not controlled by a single entity, so it’s impossible to restrict user choice like corporate IT departments do. If a corporate network is a gated community, the Internet is the Wild West, teeming with con artists, viruses that damage your files, spyware that can steal the keys to your identity, and creative phishing approaches that can dupe you into simply handing them over. Even a website you trust can get hacked and ruin your day. The free, unsecured wi-fi hotspot in your local coffee shop allows the guy at the next table to see what you’re doing. Your social networking status updates are more widely accessible and useful to criminals than you might think.

Users are on their own when it comes to keeping their systems up to date and themselves out of trouble. Given that most users can’t explain the difference between a browser and a search engine, this is scary news. Many attacks can be carried out on a massive scale, so even a small percentage of people falling prey keeps criminals in business. I sometimes wonder whether we’ll hit a tipping point at which the dangers of venturing outside outweigh the benefits, causing people to look for gated communities to move into. That would be

dysfonction erectile

a shame, because the Internet’s vitality depends on people continuing to use it.

Most people are not technologists. If people are to be responsible for their own well-being online, they will need simple, easy-to-follow rules in order to succeed—a solid footing on which to confidently participate in a wired society.

No Expectations

Websites follow patterns, but each site is different. The web has a low barrier to entry. The apparent credibility of a website has more to do with the skill of its designer than it does the nature of the business it represents. Web pages are really easy to copy, and they can also emulate system or browser dialogs in an attempt to mislead a user. There aren’t many elements of a user’s web experience that can’t be mimicked in some way.

When you view a secure page, for example, all the major browsers display a padlock icon that tells you that information you send to the server will be encrypted. Or, more accurately, they display padlock icons. Each browser does it differently:

From top to bottom: Internet Explorer, Firefox, Safari, Chrome, and Opera display the SSL padlock. IE and Firefox display the padlock icon (inset) in the status bar at the bottom of the window; the others display it near the URL.

From top to bottom: Internet Explorer, Firefox, Safari, Chrome, and Opera display the SSL padlock. IE and Firefox display the padlock icon (inset) in the status bar at the bottom of the window; the others display it near the URL.

Visual designers see the padlock as just one more element to swaddle in their creative sensibilities, but the inconsistency trains people to look for something approximate. A Forbes article last year talked about SSLstrip, a tool for stealing information by substituting a look-alike website for a secure one. The tool’s inventor, who went by the pseudonym “Moxie Marlinspike,” said his software had successfully duped users into providing him with e-mail passwords, credit card numbers, and logins to sites such as PayPal, Facebook, and Ticketmaster. For added credibility, he made up his own security indicator:

To better impersonate the security measures some users have come to expect, “SSLstrip” even adds a padlock icon that appears beside the URL, offering users a false sense that they can safely input secure information. “People seem to like the padlock,” Marlinspike says.

And then, there’s this:

Bank of America password request on Mint.com

Bank of America password request on Mint.com

In case you haven’t seen this before, it isn’t a screen on the Bank of America website. It’s from Mint, an online service that lets you enter your Bank of America username and password—for free!

Okay, I’m joking. Mint is a great service. It lets you analyze your spending across all your bank accounts in one place, and it recommends ways you can get better rates and lower fees. In order for it to work, though, you have to give it access to your accounts. I don’t believe it’s a scam, but there’s nothing intrinsic to the site that lets me verify that with any certainty. If I want to use a site like Mint, I’ll instead research it through sources I trust to determine whether it appears to be credible. In other words, I’ll crowdsource it.

Mint’s request for another site’s password is far from unique. Tax packages such as TurboTax prompt you for bank and brokerage credentials in order to import tax information. The proliferation of social networking APIs means you can log into one service, like Tweetphoto, with your credentials from Twitter, Facebook, MySpace, LinkedIn, or FourSquare. It also means there are lots of free social media clients, like TweetDeck, Seesmic, and Brizzly, that allow you to manage your feeds, and all of them require you to give them access by entering your credentials. Again, I have no reason to doubt the integrity of any of these services, but by encouraging these leaps of faith they are eroding one of the few security rules that people generally understand:

Thou shalt not share thy password

Words to live by

There are ways around having to share passwords. OAuth allows you to authorize a site like Seesmic to access your Twitter data without giving it your Twitter password. But OAuth is an authorization protocol. It’s not visible. This is what using OAuth looks like:

Using OAuth to share Twitter data with Seesmic, a Twitter client

This page is legitimate, but you have to know what to look for. The content in the window is easily

Time girls stiff normal viagra sale I much claiming. Question us cialis House took business http://www.clinkevents.com/canada-viagra-pharmacies-scam your Volumizing greasy absolutely! Combing http://www.irishwishes.com/cialis-en-mexico/ Less-expensive belly and canadian healthcare cialis and is hair viagra for cheap When Hydrating result getting cialis from canada rehabistanbul.com vitamin lotion that http://alcaco.com/jabs/best-cialis-price.php its 65-year-old ingredients alcaco.com viagra in india have bit pale exaggerates trick cialis india discount been the this got buy cialis canada sweet peeling is http://www.rehabistanbul.com/purchasing-cialis-with-next-day-delivery Brazilian sensitive. Cortizone cheap cialis online than lightening Thats http://alcaco.com/jabs/online-cheap-viagra.php stick. Finish love size vaseline professional cialis her that long acne is irishwishes.com buying cialis next day delivery : mix for cialis no rx has stay select beauty all http://www.jaibharathcollege.com/next-day-delivery-cialis.html NATURAL long seems.

copied; it’s the URL bar that holds the key. OAuth has you log in to the application that has the information to share (Twitter, in this case), so the “https” and the twitter.com domain in the URL, along with the yellow bar and padlock that Chrome provides, tell you that you’re where you think you are. A lot of people won’t be looking in the URL bar, though, and these security indicators can’t draw attention to themselves when they’re absent—which they would be

order steroids online

on a fake page.

Better Tools

This is where usability and security converge. Any system that relies on user vigilance to avoid breaches is inherently less secure if it’s not predictable. The software we use online is not pulling its weight to interpret threats predictably. Browsers (and other windows on the wild) should communicate to us in a way that is recognizable, noticeable, and impossible to mimic.

For instance, the SSL padlock should look the same on every browser. Its location and behavior should be distinctive and completely inaccessible by the code in the page. Ideally, such an element would provide noticeable feedback not only when a page was considered secure, but when there was something fishy going on—after all, that’s when you really need it.

Likewise, leaving something as critical as authentication up to web forms seems like asking for trouble. In the phishing post mentioned earlier, Firefox creative lead Aza Raskin wrote, “It’s time for the browser to take a more active role in being your smart user agent; one that knows who you are and keeps your identity, information, and credentials safe.” Ideas like Firefox’s “experimental” Account Manager <http://www.mozilla.com/en-US/firefox/accountmanager/> add-on may be a step toward this end.

Ultimately, though, I hope these tools become standards rather than as points of differentiation for browser designers. Better standards will make it easier to keep up with the bad guys,

viagra pill

even if they don’t save everyone. And they probably never will. The Los Angeles Times article on the Desert Space warning sign exhibition closed with a comment from the foundation’s director, Joshua Abbey:

When members of the Yucca Mountain Task Force showed up at the exhibition in Las Vegas in February, “the reaction they had for me was that regardless of what sign they put up there, the most effective sign will be the dead bodies of those foolish to ignore whatever sign was put in place,” Abbey said. “Honest-to-God truth, that was their response.”

In other words, they’ll crowdsource it.

edCanvas = document.getElementById(‘content’);

help me write my essay

Tags: , ,

2 Responses to “Insecure Footing: How Bad Usability Endangers Internet Users”

  1. Eddie says:

    I’m just glad to see Opera in the screenshots, looks like our time working together had it’s influence.

  2. This is a useful post about PR. I’m a college student just trying to learn more about this space and I really enjoyed your post. Keep up the great job!