Slashdot Mirror
Kazaa Usability Study
Anonymous Coward writes "We have just finished a study that shows how user interface design flaws allow users on Kazaa to share their personal files without their knowledge. In a laboratory user study, only 2 out of 12 subjects were able to correctly determine that Kazaa was sharing their entire hard drive. We looked at the current Kazaa network and discovered that many users are sharing personal information such as email and data for financial programs such as Microsoft Money. To see if other users on Kazaa were aware of this and taking advantage of users ignorance, we ran a Kazaa client for 24 hours with dummy personal files. During this time, files named "Inbox.dbx" and "Credit Cards.xls" were downloaded from our client by several unique users. The tech report is online, or see our lab web page."
why do you think napster grew? people didn't know they were automatically sharing their files, and even if they did, they didn't want to turn it off or figure out how to stop people from getting their files because they wanted to use it to get other peoples files.
if during install there was an option "DO YOU WANT TO SHARE YOUR FILES" 90% would say no... then no network.
P2P RELIES on ignorance of its user base, and the good will of a small fraction of its tech savvy users.
MARIJUANA, SHROOMS, X: ONLINE?! - E
Well, it's not like I don't receive everyone elses personal files through email, courtesy of the Sircam worm.
Since Kazaa is spyware in the first place, what personal information is there to hide?
Also, in a related topic, piloting planes is reserved for those who know what they are doing.
If the average user is too ignorant to know what their program is doing (or could do) to their system, they should leave it alone. This same argument is used for ignorant users running open relay servers.
If KaZaA users don't understand how to know what they are sharing, they deserve the consequences.
Adversive
My cat's breath smells like cat food.
Gives a whole new meaning to the term spy-ware...don't you think?
-Pete
Soccer Goal Plans
why do you think napster grew? people didn't know they were automatically sharing their files, and even if they did, they didn't want to turn it off or figure out how to stop people from getting their files because they wanted to use it to get other peoples files.
Napster restricted users to sharing ".mp3" files only unless you applied a third-party patch.
On the other hand, most people accept the default directory of "My Shared Folder" or whatnot. If you are sharing your entire drive (which you need to go out of your way to do) then I'm sorry, you're an idiot.
My favorite part of the article:
The word "folder" is singular, implying one folder, and does not hint that all folders below it will be recursively selected to be shared with others.
So it's sharing the stuff in it, but it's not? Riiiight.
People like you usually repeat two lines ad-nauseum:
.. thats not fair.
1) Haha! What an idiot! They deserved to get taken advantage of!
2) Mother fucking asshole, he took advantage of my mom/sister/father/brother/friend/etc
It's rare to find someone brave enough (or forthright enough) to apply the 'buyer beware' scenario to people he/she cares about. Usually people tend to seperate the kinds of situations their social circle falls into and the kind of situations 'idiots' fall into, into two seperate classes of situations. Really, they are the same, so if you care about anybody enough to not think they are a moron for falling into any given trap, its not really justified to call other people idiots for doing so.
"Old man yells at systemd"
Sorry Judge, I didn't realize I was sharing all those ripped DVD's with the world... whoops!
Most people are idiots when it comes to technology, that isn't a surprise. Look back when cable modems first started to take off and you'll see lots of stories of people running PC Anywhere without a password, or using Windows File Sharing and sharing their entire drive.
Computers are complicated devices. Unless they are stripped down to do only one or two functions, like a play-only VCR, the majority of the public will not understand. Many of them don't WANT to understand -- they just want their e-mail, IM, MP3s and pr0n.
Case in point -- KaZaA. It is KNOWN spyware, and has an embedded secondary network (Britewave?) yet despite this being well publicized (CNN, FoxNews, regular geek news like Slashdot) it is wildly popular.
Why? It is *very* convenient, and people will put up with a ton of shit for convenience.
What would be a real interesting study, is get this one publicized as all get out then do it again in 1 year. I bet the stats would be about the same.
Learning HOW to think is more important than learning WHAT to think.
Using financial tracking software is stupid?
Budgets are for dummies too, right?
Robots are everywhere, and they eat old people's medicine for fuel.
thanks for the laugh. i needed that.
"Thank you for your credit card number, 'l33tp3t3'."
Well, I could find out what I was sharing ok Kazaa when I used it. Yes, we all know that if it was designed better the users would have more control - but, one of Kazaa's better features is it's ease of use. That's why it's popular. The fact of the matter is that the people just don't care enough to change anything. For the people that have sensitive data on their computers, they should be responsible enough to guard it, just like not keeping your credit cards on your front porch.
Get Firefox!
This is exactly why these P2P apps are banned at my office....that and the illegality of most of the downloads. It's just too big of a risk for a user to share out their whole drive with all sorts of documents on it.
I like the way computer geeks think anyone who doesn't know as much about computers as they do are idiots. I freely admit that some people are idiots, but others are just ignorant. Can you repair your own car? Build your own house? Hell, can you cook your own food? Then why are these people dumb because they aren't computer experts? I have worked helpdesk and user support for years and have run into more people who are perfectly normal nice people, who are afraid of their computers than people who are just morons. They can turn them on and (hopefully) get their job done, but thats about it.
using microsoft financial tracking software is...
it just lets bill know how much money you have so he knows how much he can charge for windows 2003 professional and have you be able to just barely afford it.
MARIJUANA, SHROOMS, X: ONLINE?! - E
I shared videos of me dancing and nobody wanted to download them. It makes me cry every day when I look at the results of my scientific study.
Just out of curiosity, I ran the install myself, and I observed that while the sharing scheme isn't 100% clear or too concerned about the user's privacy, it's still not nearly as bad as the outright installation of spyware, which Kazaa does anyway. I also asked a small group of novice users to try it out, and found that:
1) The default shared folder is C:\Program Files\Kazaa\My Shared Folder. A vanilla user with a vanilla install would not have had that directory, and would not have any private files in here to begin with. Most novice users I polled understood that this was the folder which the public would access, and that private files should never be placed there. So... simply clicking "Next" on the install repeatedly doesn't endanger the person's privacy. (well, spyware is still installed, but you get my point)
2) When selecting another folder to share, I found that all of the novice users I polled stored their music in a directory strictly for music, and that subdirectories would contain nothing but music. So, if someone is sharing C:\My Documents\My Music\, they would not be sharing files in the parent directory, where private documents are stored. Realistically, I can't think of too many cases where someone would store private files in a directory made specifically for music. Granted, the user could still accidentally put files there, or accidentally share C:\My Documents, but at that point, it's user error.
3) When selecting an entire drive to share and download music, eg, C:\, all (yes, all) of the users were unwilling to proceed, as they didn't want files piling up in the root directory, and they didn't like the idea of sharing the entire drive. (though this was never specified in the software)
So... what I'm saying is: Common sense and "install: next, next, next" seemed to prevail in the small group of novice users I polled... While I agree wholeheartedly that Kazaa does *NOTHING* to discourage or warn users of sharing their entire drives, I guess this shouldn't come as a surprise considering the company's history.
Just thought I'd share...
Now we can all get on Kazaa and grab credit card numbers so we can buy porn and cds and dvds and software and computer games and books and even computer games about porn........cause all these things still have to be bought right? its not like i can just get them free through some program......
The only difference is I don't tell my friends they are morons. I think it, but I don't tell them.
In fact I'm unlikely to tell not-friends they are idiots either especially if they are anywhere within striking distance.
Find an inbox and do search from the same user.
No wonder the Kazaa search is so slow.
You search through a lot of uninteresting crap to find what you need. Of course it could be to your advantage if you are Peeping Tom or a ignorant maniac who wants to steal credit card numbers.
I think the fact that these people are using Microsoft Money...
. . .along with the ineptly-named Microsft Works. . .
!#@%*)anks for hanging up the phone, dear.
...compared to Napster and Limewire. I don't know about the particular issue being discussed, as I never had a problem with it (I hope). But in general, I find Kazaa to be kind of byzantine, and a pain to use. Napster and Limewire are still the champs in this department, and it's probably one reason for their initial success. If you want to design a good app, just copy them, at least for a start.
What we need is for people to understand is that most of the current crop of P2P software was designed either in a slipshod and dangerous manner, or intentionally maliciously.
Whenever I find anyone I know running P2P software, I recommend that they uninstall it completely (and if possible wipe and reinstall the hard drive, the gods knows what some of these "commercial" ones do to you) or failing that, I'll recommend that they strictly limit all sharing activity to a single folder, and to move all downloaded items out of it after they've finished, and to make sure that the software actually closes when you quit (many keep running I've found), and to quit immediately after you've finished.
I'd rather these people be seen as leeches than fall vitcim to any back doors that may have been programmed into them. Gnutella may be open source, but it's crap. Everything else I don't trust one single bit.
Dammit.. if there was one thing that teachers taught it was to reduce your fractions!
1 out of 6
Least that's the way they were with me.
I noticed back in november of last year that most of my friends had kazaa set up to share everything on their hard drives. At the time I was working on a project on the Reformation movement. I was stuck so I typed in 'Reformation' under Documents and I got a couple reports. I got some good facts and I think I got a 90% on the project. I used it for a couple more project and found it helpful on bigger subjects. Why buy Clifs Notes if I can download projects?
So what? Everything is already shared via Echelon file sharing system...
A law that "gives some rights back to the user" creates new obligations for the developer. That's a very bad thing: If I can (realisticly) be sued for writing free software, I'll stop doing it -- because I know the interfaces I write are poorly designed, and without bringing someone else on board (and probably paying them) there's nothing I can do about it.
A word with regard to your perception of law, and government in general: No law gives the people more rights. All people have all their rights by default; what laws (and government) do is remove rights, or (at best) award priviliges to some and responsabilities to others. Is some removal of rights sometimes justified? Certainly -- an individual's right to free action can justly be restricted to exclude actions that do direct harm to nonconsenting third parties, for instance; as another example, limiting a business owner's right to select with whom he wishes to business (to prevent racial discrimination, for instance) is another justifiable action of government -- but like any governmental act, it removes rights rather than granting them, and so must be treated with care. Creating a law to give the people more rights (excluding those laws that limit the government itself) is counterproductive -- laws limit rights by their nature.
Coming back to the situation at hand: By default, KaZaa doesn't share all files on the hard drive; the folks who do share everything go out of their way to do so. Making developers liable because users are allowed to do something stupid is a Very Bad Thing.
It's a bit extreme to get someone to wipe their harddrive due to one of these programs, but other than that, I mostly agree.
Basically I subscribe to:
1) Pick a program to use (Last I used was Bearshare), install it.
2) Run Ad-Aware (www.lavasoft.com), a top little program that'll weed out any 'spyware' that is attempted to be installed as a result of the application.
3) Try running the program, if it won't run due to you removing something via AdAware, then you don't want the thing, uninstall it.
You should be ok using this method as Ad Aware has proved itself to be pretty thorough...
Absolutely have the one directory (With subdirectories is ok) for sharing... I always have a directory for music, with many subdirectories under that by album artist etc... I just share the music directory and subs, and that's it...
Have good protection software running (like Zone Alarm if you're a PC user) and a fine virus checker...
Take these precautions and don't download things that look suspicious in the first place and you're going to have a pretty trouble free existance.
Not that I'm defending KaZaa, I used to use it, and its wizard was ridiculous, it'd share any folder that had something it deemed to be a 'media file'... and that's a fairly broad term, and also you'd be surprised how many folders have an mp3, wav or avi file tucked away in them.
A good portion of it was permanently deleted. This included business and personal contact lists, his most prized data.
Cry me a river.
If he prized it that highly, why didn't he keep backups?
deus does not exist but if he does
I have often wondered how to inform non-techie people (let's call them 'normals', for the sake of the discussion) about these problems. Considering KaZaA's reputation, I always advise my normal (and sometimes even techie) friends and family not to use it. But I always seem to find that they either don't know about KaZaA's problems or don't appreciate the security risks.
As we can't rely on KaZaA's makers to fix these problems or to warn users, what can we do?
If you think about the security and virus problems with Microsoft Windows and Email programs, most normals (at least the ones that I know) seem to only get warnings about these issues from those annoying group forwards or virus warnings sent by someone's father/brother/uncle/friend who works for IBM/Norton/Symantic/FBI/CIA/Government Agency. For better or for worse, normals do seem to believe these warnings, so perhaps this is the only way to inform people about KaZaA.
What does everyone think? Is this method too evil to be used for good purposes?
You break all the laws of physics and you seriously think there wouldn't be a price?
1) Computer software is COMPLICATED.
2) 90% of computer users are IDIOTS.
3) Spyware peddlers are UNETHICAL.
You needed to write a paper to investigate these completely unobvious claims?
Where do I get some of that action?
I want to get some academic funding to investigate whether hot strippers, on average, have big titties!
Somehow these people at HP convinced their boss to do a "Kazaa Usability Study". In other words they spent all day downloading MP3's, Bootleg videos, and whatever else they could find on the Kazaa network. Maybe their next project will be a "Porn Website Usability Study".
http://www.kubuntu.org/
I know it's extreme to wipe the drive. I distrust most P2P software that much. Call me paranoid (hell, I'll call myself paranoid) but I just don't trust that Ad Aware knows all and sees all just because it sees a lot. I use Ad Aware, and it's a great tool. However, there have been spyware applications that uninstall/disable Ad Aware in the past, and following with my "plan for the worst" policy, I generally assume that more than a few other spyware companies have figured out how to disable/evade/uninstall Ad Aware. P2P software is the prime offender these days wrt having spyware apps attatched to them in new and evil ways, and I personally consider installing it the equivalent of your Windows machine playing Russian roulette. Also, that these companies are willing to bundle this spyware with their products doesn't make me trust their good will in coding. Don't know what back doors have been put in, so better safe than sorry.
The only P2P app that I've spent any real time with is eDonkey2000, as they have released Linux and OS X command-line versions of their software as well as the ad supported version, and there are some people who only use eDonkey that I download needed files from occasionally. No, I don't really trust it, and I kill it as soon as my downloads are finished, but it's slimmed down enough that I feel much safer with it than any of the other wastes of bits...
Actually, as a case-in-point: :), and believe it or not, one of the files was a copy-and-pasted e-commerce order confirmation. The real kicker? This document listed FULL credit card information (name on card, card type, card number, expiry date, billing address, everything).
I just did a search in Kazaa Lite for ".doc", and came back with a whole pile of results. Downloaded a bunch just for kicks (I'm in the process of emailing the owners where possible... let's see how many get the hint.
Scary.
- Jester
> Or do you put all your groceries on top of the
;-)
> stove and hope for a gourmet meal?
I assumed that she was at the grocery store because she hoped for/planned a meal, but after she put the groceries on top of her car, got in, and then drove off; I am not so sure anymore.
It wasn't all that funny when it happened, just a mess of food spread over the parking lot, coke cans spewing brown foam, oranges bouncing and rolling towards the storm drain, eggs showing white and yellow in the sun, but after reading your post, I cracked up!
Thanks.
Good judgement comes from experience, and experience comes from bad judgement.
- W. Wriston, former Citibank CEO
is that the commercial entities (including a university), finance a study of something that should be patently clear in the first place. The people who petitioned for this study already knew the conclusion. I hate to complain, but the financiers involved in this study should be at least somewhat knowledgable of computers and the security risks involved when you put a monkey in front of one. The people who conducted this study took the easy way out; they didn't think of something worthwhile to research. They simply wanted their names on an 'official study', and it's in PDF format, so it must be official.
File sharing is a dubious business at best, and most of the companies involved in it will try to manipulate your machine in one way or another.
So...let them. Let them prat about with your machine to their heart's content. Let them install all the spyware in the world. Let them share every file that's ever been placed on it. Just one thing - make sure it's not a real machine.
In other words, make use of the virtual machine programs kicking about. VMWare for most, Virtual PC in my case. Use that machine for nothing but running your P2P clients. No email, no web browsing, nothing. Just run your clients and enjoy. Let them spy on everything happening within that machine, because the only thing happening on that machine is the running of their own software.
Cheers,
Ian
I found a document containing username, password and secret code for a customer account at a UK bank. I was nice and notified the bank and the customer though.
Most Techs (not all, but many)are the real newbies. They barely understand people. They refuse to read any books on GUI design (not taking their own advice to RTFM). Many of them consider the field of usability to be a bullshit field dominated by the psuedo-science of cognitive psychology. And then when non-techs get really confused by the crap they program, the techs are too dumb to know why it's happening. They're simply too stupid to learn the protocol of the end user.
Read The Fine Manual or shut the hell up and go back your server closet where you belong.
Ergonomica Auctorita Illico!
As someone else pointed out, this might be considered a feature by the Kazaa crowd.
It does add network content.
Note, I do agree with you though. It should be something that the UI makes more explicit and defaults should be secure rather than unsecure to the extent possible.
Saying "you deserve it" is like saying "you should understand all the details of the lawyerese in any EULA before using the software". Who really does? Damn few. Even most technical people just click thru them because the choice is use the program (which might provide some key capability) or sit and spin. Does that make hiding nasty stuff in the EULA a good business practice or above board behaviour? I think not.
-- Mal: "Well they tell you: never hit a man with a closed fist. But it is, on occasion, hilarious."
> Users should not have to be "computer literate" to get e-mail. Or browse web pages. Or write documents. Or use an accounting program.
:)
Well, that's fine, but if they don't want to put forth the effort to get training before calling me, I'm gonna bill them for the full $75/hour I normally charge for more difficult problems. Their choice, I guess, if taking a class or opening a book is too much to ask. More money in my pocket for remedial shit!
Once upon a time, there was a thriving black market for arable credit card numbers. Then the FBI got hip to it, made some busts and things settled down.
Looks like the kids don't even need to go through all the trouble of phishing for cardz anymore; fire up Kazaa or Morpheus or Gnutella or... and search for *.doc or *.xls (or *.mdb, even) a few times a day. Done and done.
Brilliant! This will be even more fun for me to do than scanning people's hard drives and finding pictures of their dongs alongside resumes listing them as Young Republicans. Ha ha.
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
I know... I thought of this too when I saw the information content.
Firstly, the file was called "Document2.doc", with the same description. I wasn't going out of my way to download CC info.
Secondly, all e-commerce transactions record IP addresses. Obviously, I could (and probably WOULD) use a disposable dial-up account if I were going to do this, but they couldn't prove that it was me unless it came from my (more-or-less static) IP.
Thirdly, I contacted the owner of the card, informing them of the security breach. Enter "good samaritan" points.
Lastly, since the file is publically available on the FastTrack network, it could have been any one of a million or more people, anywhere in the world, who might have used the card.
Basically, in order to actually do anything, they would need to catch me, personally, in the act of using that information.
Agreed, the potential is still there, but I'm not too concerned at this point.
- Jester
Just out of curiosity, what were the bank's and customer's reactions when you told them? Were they simply grateful, or did they threaten legal action?
- Jester
Even better, now I can resell the tracks I've downloaded to other people. Finally! A reason to have Britney Spears resident on my hard drive! *shivers*
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i
The bank said "Thank You" and said they'd look into it. The customer didn't respond.
You haven't really offered a very compelling argument.
Endusers by and large prefer the a GUI. This was one of the secrets of the Macintosh.
So we essentially have to accept that as fact and move on from there. Otherwise you are simply arguing buggy whips are preferable to steering wheels despite the dominance of the automobile. Seems rather pointless and you certainly have no facts to back this position up.
Your other two counter arguments... "user choice" and "blind users" are limited examples. You are now arguing that Microsoft should make an OS which works well for 5% of the user population, but creates challenges for the remaining 95%.
And you do so by claiming an OS which works well for 95% of the population but challenges 5% is a dumb idea.
Again, you do not present a compelling argument.
I also noticed that when I could see a user's entire HD, there were invariably filenames using high ascii characters, apparently an Oriental character set (judging by the English-readable filenames present).
I don't think this was a "poor English skills" problem, because if it were, other non-English language users should also have been affected, but I only saw it on systems as described above.
BTW I only used the web search interface, I never installed the Kazaa client; these users' drives were visible in plain old Netscape.
~REZ~ #43301. Who'd fake being me anyway?