Slashdot Mirror
Popup Study Confirms Most Users Are Idiots
danieltdp writes "Testing students at a University, psychologists made many of them click on a dialog box that in effect said: 'You are about to install some malware. Malware is bad. By clicking yes you are failing the Windows Darwin Test.' Nearly half of them said all they cared about was getting rid of these dialogs."
"You are about to submit a bad summary. The summary is bad. By clicking yes you are failing at Slashdot Darwin Test."
Doh!
For those of you just joining us, the article says nothing of the sort. The article actually says that they created fake "Application Error" dialogs with various numbers of "fake" aspects. e.g. The cursor turning to a hand over the "Ok" button, reverse colored text, browser borders, etc. Basically, stuff that should have made it obvious that these were malware windows. Nearly half of those tested "accepted" the dialogs to get them out of the way. Some of them simply minimized them for later.
The text referred to in the summary is an image created by Ars Technica with the caption, "Even this warning might not have helped".
Javascript + Nintendo DSi = DSiCade
The actual text was "The instruction at '0x77f41d24 referenced memory at '0x595c2a4c.' The memory could not be 'read.' Click OK to terminate program." You're right, this is not "basically" (or even remotely close to) the text in Ars's little joke screenshot or what was posted in the summary.
The bottom of the article has the actual conclusion that the article was trying to make:
Follow-up questions revealed that the students seemed to find any dialog box a distraction from their assigned task; nearly half said that all they cared about was getting rid of these dialogs. The results suggest that a familiarity with Windows dialogs have bred a degree of contempt and that users simply don't care what the boxes say anymore.
The authors suggest that user training might help more people recognize the risks involved with fake popups and the diagnostic signs of genuine Windows dialogs, but the fact that the students didn't appear to spend any more time evaluating the fake dialogs raises questions as to whether education is enough.
"All great wisdom is contained in .signature files"
the people writing the dialog boxes assume clicking no just shuts down the dialog box.
You could easily have events fire on the No as you do on the yes.
It takes a little work, but it is doable.
The Kruger Dunning explains most post on
Incorrect... Diffusion is a flow of material from high concentration to low concentration. Osmosis is the diffusion of water across a membrane.
Yes it's an anecdote! Were you expecting original research in a Slashdot comment?
Windows already has most of your suggestions implemented, the problem is that third-party developers generally ignore it.
There's:
* The Application Error Reporter tool thing for reporting crashes (without making the user click through to a website, as in your example.)
* The Error Console, a place for applications to record the technical nitty-gritty of the error without bothering the user with it.
* Some amount of different "levels" of reporting, for example, the notification tray can be used to report non-fatal errors that never-the-less need reporting.
There's no real way to make a window type that "only" the OS can use. The malware authors would just open one up, take a screenshot and change the text. If you removed the ability to take screenshots, they'd just start up VNC first and do it.
Displaying something only the OS should know is an interesting idea... like let the users customize a window border by splattering paint and then it might be blatantly obvious which windows were their personal design, and which were fakes (different splatter pattern and different colors.) Has anybody seen anything like that implemented?
Of course I'm actually overthinking this; most people would still click malicious popups even if they only remotely looked like real windows at all.
Yup.
Comment of the year
Our geekland propensity for dismissing users as stupid because they can't navigate cryptic interfaces just makes me laugh.
I would be interested to see what would happen in the experiment if users were given an application that used pop-ups to request that users make understandable choices, with understandable consequences.
Shouldn't that be what we are aiming for?
don't mess with those geekgrrls
Popups should reveal the cryptic stuff only when a debug flag is set, which defaults to off in end-user builds of the software. In all other cases there should be something like "$APPNAME has crashed due to a bug. Please report the contents of $APP_DATADIR/crashlogs/$DATE.txt to us as http://domain/crashes [domain]. [OK]". The user should always know what the thing that just happened means for him, not what exactly happened. If someone really wants to know the details he can take the config file and add a line saying "Errors = verbose" or something like that.
The errors I got did that, when Firefox crashed a popup popped up in OS X telling me Firefox suffered an error and asked if I wanted to report it to Apple and the Firefox developers. It could then send a log of what happened.
Falcon
Should there be a Law?
Don't use dialog boxes to allow or reject a dangerous action.
Dialog boxes only require passive action of clicking somewhere on the screen to dismiss, or pressing a single key; this is not safe.
Reject by default, unless you have proof the user specifically asked it.
Provide the user a subtle prompt. Force the user to take explicit action; a dialog box is only used to confirm a change.
Never use a dialog box to display an error or any non-fatal caution.
If the action is severe enough; make the user type out a few words to confirm it.
It's a lot easier to have a popup browser window which links to a site with arbitrary nasty scripts, than to embed said nasty script on the original site.
I don't know what the clueless nerd squad did, but very many people pointed out the real problem: the brower's UI equated "encrypted connection" with "authenticated site." The correct behavior is to treat encrypted sites with self-signed certs the same way as unencrypted sites.
Are you adequate?
Almost every machine I've ever used gives money followed by cash.
Er...money followed by *card*.
Epic fail on my part, please be gentle oh mods of destiny.
Calling people idiots is just a cop out.
Not with computers it isn't. I work in end-user support, and, while I see people genuinely confused by shitty software sometimes (it does happen), many, many people who can't use a computer effectively are in that boat because they won't try. They've convinced themselves that the computer is a magic black box, and they can't learn to use it no matter what they do. These people are truly idiots, and it's a waste of time to try to hold their hand. Save your effort for the people who try to work with you.
"16MB (fuck off, MiB fascists)" - The Mighty Buzzard