Security design: Stop trying to fix the user

On the tendency of security approaches to rely on somehow educating users on this complex problem.

I’ve read dozens of studies about how to get people to pay attention to security warnings. We can tweak their wording, highlight them in red, and jiggle them on the screen, but nothing works because users know the warnings are invariably meaningless. They don’t see “the certificate has expired; are you sure you want to go to this webpage?” They see, “I’m an annoying message preventing you from reading a webpage. Click here to get rid of me.”…

We must stop trying to fix the user to achieve security. We’ll never get there, and research toward those goals just obscures the real problems. Usable security does not mean “getting people to do what we want.” It means creating security that works, given (or despite) what people do.

The same could be said for usability of any kind — but it seems especially vital in this case.

Via Khürt Williams.

How good is “good”?

YouGov asked people to rate how positive and negative certain expressions are.

Warning: Contains pretty charts.

As it turns out, “good” and “bad” are not exactly mirrors of one another on the scale. Bad has an average score of 2.60, meaning its mirror equivalent on the scale ought to score 7.40. “Good”, by contrast, scores a 6.92.

This situation remains the case for the other examples where “good” and “bad” are used: “pretty good”, “really good” and “very good” are seen less positively than they should be to truly mirror “pretty bad”, “really bad” and “very bad”.

From the collection: Blissymbolics

The story of a utopian attempt to introduce a universal pictographic writing system, Blissymbolics.

It is a noble but unrealistic idea that seems typically mid-century, and it’s unimaginable that it would fly today. Not that Blissymbolics flew either. It reminds me of Esperanto.

Even in this brief article that contains a few examples of Blissymbolics, many of the explanations seem rather tenuous. My favourite is stick (“linear thing + tree”). Or perhaps branch, which is a division symbol next to the tree symbol (“part (of) + tree”).

I also wonder how skewed by western culture Blissymbolics is, and if it could genuinely be said to be universal.

Somehow we missed it

More on the hard work designers need to do to ensure they have a positive impact on society.

To create a platform designed to connect millions of people and not imagine its potential misuses is wilful blindness. When we imagine and design and build tools and technologies and platforms and services it’s as important, perhaps more important to ask ‘how might this be misused’ as it is to ask ‘how might this be used’.

How computer software can make policy, explained by family separation at the border

How bad software design decisions can have a more devastating impact than bad policies.

At a time when Silicon Valley and the larger public are waking up to the government’s reliance on software to carry out its agenda, it’s more important than ever for tech workers to be thoughtful about how they can be a force for good.

6 mistakes that prevent UX teams from having boardroom influence

A good list of don’ts when you’re trying to set up an effective user experience function.

In particular, the pitfalls of “cargo cult usability” could do with being more widely understood. But I also enjoyed this point about being too insular.

Newly formed UX teams have a tendency to quickly turn inwards and focus heavily on their own practices, tools and methods: heads down, working in a vacuum, doing great work that doesn’t actually influence anything. As a result, we hear frustrated stakeholders say things like: “I don’t involve the UX team because they always seem too busy”. We’ve even heard UX team members themselves complain that, “We’re so busy and so mired in the day-to-day that we don’t have time to work alongside the development team.”

This reminds me of the (hilarious but true) story of the Staffordshire UK bus company. In 1976 it was reported that the buses on the Hanley to Bagnall route were not stopping to pick up passengers. People complained that buses would drive right by long lines of waiting passengers. The complaints prompted Councillor Arthur Cholerton to make transport history by stating that if the buses stopped to pick up passengers it would disrupt the timetable!

Facebook is giving advertisers access to your shadow contact information

Facebook is not content to use the contact information you willingly put into your Facebook profile for advertising. It is also using contact information you handed over for security purposes and contact information you didn’t hand over at all, but that was collected from other people’s contact books, a hidden layer of details Facebook has about you that I’ve come to call “shadow contact information.”

The hunt for missing expectations

Jared Spool tells the story of a bookkeeper who became frustrated using Google Sheets because it didn’t have a double underline function.

To keep [usability] testing simple and under control, we often define the outcomes we want. For example, in testing Google Spreadsheet, we might have a profit and loss statement we’d want participants to make. To make it clear what we were expecting, we might show the final report we’d like them to make.

Since we never thought about the importance of double underlines, our sample final report wouldn’t have them. Our participant, wanting to do what we’ve asked of her, would unlikely add double underlines in. Our bias is reflected in the test results and we won’t uncover the missing expectation.

He suggests interview-based task design as a way of finding these missing expectations. Start a session with an interview to discover these expectations. Then construct a usability test task based on that.

I recently ran hybrid interviews and usability tests. That was for expediency. I didn’t base tasks on what I’d found in the interview. But it’s good to know I wasn’t completely barking up the wrong tree. I plan to use this approach in future.

Does benchmarking really save companies from failure?

Why comparing yourself against your competitors often leads to mediocrity.

Best practice and benchmarking are often just a race to be first at being average. The chances of someone else’s best practice working in a different environment is unlikely.

Not only is it unlikely but the very act of best practice and benchmarking can drive standards down. It encourages all organisations to think alike. At sector level it creates groupthink, and we all know groupthink is the avowed enemy of innovation.