Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

See also "Never use a warning" (2007): https://alistapart.com/article/neveruseawarning/


Yes. Humans experience regret, "consent" is mostly a trick we use to get people who experience regret to blame themselves, not us, for what happened.

We should prefer (and in software this will almost always be possible) to undo the regrettable action instead of demanding consent.

In some cases we can do even better and prevent the regret itself with "Brick wall UI". Brick wall UI is a design where the thing that you definitely don't want to do isn't possible. As designers we have to put more effort in to ensure that this only arises where it's genuinely never what you wanted to do, otherwise it's just incredibly annoying.

The idea in Brick wall UI is that the user's experience is potentially, especially initially, the same frustration as if it was broken. Why won't the barrier open so I can drive my truck under the bridge? Why can't I use my login token to access this banking site and see my transfer details?

And maybe, eventually, sat at the Brick wall UI, the user realises why and is glad. "Oh! My truck won't actually fit under the bridge, I just avoided an expensive mistake" or "Wait, this isn't my bank it's fakebank.example, it's a bloody phishing scam". Or maybe they don't, for hours, or days, or weeks, but since it was never correct that's actually fine.


Why would a fake bank phishing scam site have a brick wall UI? Surely they’d want to make it as easy to enter your bank details as possible.


But the scammers don't control your UI, the UI belongs to the browser.

The Brick Wall I was particularly thinking about is WebAuthn. There could (but shouldn't) be a UI where I can say Oops, silly site has used the wrong URL, lets provide my real site credentials anyway. I can give the scammers my real credentials, they can steal all my money everybody is happy. Oh except me, I guess I'm miserable - but only after I realise what happened. Instead there's a brick wall here, WebAuthn can't authenticate to the bad guys. I'm sat there until I either realise that it's a scam or I give up and maybe phone the bank about their apparently atrocious UI (and then maybe realise it's a scam).


>I'm sat there until I either realise that it's a scam or I give up

Well, there are ways to do this (for an easy example, just edit your hosts file). But the barrier of entry is high enough that a non technical person will give up even if they're completely oblivious.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: