Slashdot Log In
Popup Study Confirms Most Users Are Idiots
Posted by
CmdrTaco
on Tue Sep 23, 2008 04:40 PM
from the at-my-office-they-all-are dept.
from the at-my-office-they-all-are dept.
danieltdp writes "Testing students at a University, psychologists made many of them click on a dialog box that in effect said: 'You are about to install some malware. Malware is bad. By clicking yes you are failing the Windows Darwin Test.' Nearly half of them said all they cared about was getting rid of these dialogs."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Summary is WRONG (Score:5, Informative)
"You are about to submit a bad summary. The summary is bad. By clicking yes you are failing at Slashdot Darwin Test."
Doh!
For those of you just joining us, the article says nothing of the sort. The article actually says that they created fake "Application Error" dialogs with various numbers of "fake" aspects. e.g. The cursor turning to a hand over the "Ok" button, reverse colored text, browser borders, etc. Basically, stuff that should have made it obvious that these were malware windows. Nearly half of those tested "accepted" the dialogs to get them out of the way. Some of them simply minimized them for later.
The text referred to in the summary is an image created by Ars Technica with the caption, "Even this warning might not have helped".
The actual text (Score:5, Informative)
The actual text was "The instruction at '0x77f41d24 referenced memory at '0x595c2a4c.' The memory could not be 'read.' Click OK to terminate program." You're right, this is not "basically" (or even remotely close to) the text in Ars's little joke screenshot or what was posted in the summary.
Parent
Re:The actual text (Score:5, Funny)
Parent
Re:The actual text (Score:5, Funny)
To be 'fair', the dialog box they were going for does have those quotes.
Parent
Re:The actual text (Score:5, Informative)
Parent
Re:The actual text (Score:5, Informative)
That's typical for these error messages in Windows. The error message is legit, this is something that a regular Windows user might see (I don't want to use the word "commonly", but it's relatively common as far as Windows error messages go). From look at the error message it looks to me like it's a basic Windows error message where the OS fills in the quoted strings (source address, target address, IO operation). All of them are double-quoted. The actual error in Windows would be printed exactly like this:
The instruction at "0x77f41d24" referenced memory at "0x595c2a4c". The memory could not be "read". Click OK to terminate program.
Even though I assume that's a template for several error scenarios, I've never seen one during my own usage that didn't specify "read". The actual text is a regular Windows error though, the display of the text was what was supposed to alert users (browser status bar, borders, close/minimize buttons, colors, etc). So it's not the error message that was supposed to be suspicious, just the context that it's shown in.
Parent
Re:The actual text (Score:5, Insightful)
The "read" version is definitely more common, though, for some reason.
Most computers spend more time reading than writing. I know this is insanely simple, but that is why you see more read errors.
Parent
Re:The actual text (Score:5, Funny)
Did "read" really have those single quotes around it? That would have been pretty 'suspicious' to me. Wink, wink, nudge, nudge.
No, but the word 'Cancel' in the dialog box was replaced with the phrase 'Say No More'....
Parent
Re:The actual text (Score:5, Interesting)
And how is this supposed to show that users are ID10Ts? With the exception of the quotes that is pretty much the same crap folks are used to getting in error boxes since the days of Win95. As a PC repairman I have seen some dumb users in my time(the video.exe pr0n bug comes to mind) but I would never blame a customer for falling for that.
And let's face it,the simple fact of the matter is the user doesn't have to be an ID10T anymore,thanks to the way browsers and the Internet have conditioned most folks that the occasional download will be necessary to get through the day. The "you need a codec" dialog,the "Your flash is too old,here is the update" dialog,and don't even get me started on JavaScript and driveby malware.IMHO we are pushing this script heavy "Web 2.0" crap too fast without taking the time to worry about the average user and security.
For example,the browser should be set up with the major vendors addresses so that if you need a new version of flash,it will refuse any web links and take you straight to Adobe. And IMHO we need to really rethink JScript,perhaps with a no execute "penalty box" that can be scanned for malware before being allowed to run. Because as it is I'm giving my customers Noscript and teaching them to use it just to cut down on the malware. But the time of "blame the user" is mostly past(although I still laugh at how many fall for video.exe looking for pr0n).With so many online now,and that number going nowhere but up,we really need to work on it so the average Joe won't need a degree just to use the web. But as always this is my 02c,YMMV
Parent
Even more importantly... (Score:5, Informative)
The bottom of the article has the actual conclusion that the article was trying to make:
Follow-up questions revealed that the students seemed to find any dialog box a distraction from their assigned task; nearly half said that all they cared about was getting rid of these dialogs. The results suggest that a familiarity with Windows dialogs have bred a degree of contempt and that users simply don't care what the boxes say anymore.
The authors suggest that user training might help more people recognize the risks involved with fake popups and the diagnostic signs of genuine Windows dialogs, but the fact that the students didn't appear to spend any more time evaluating the fake dialogs raises questions as to whether education is enough.
Parent
Study confirms most popups are idiotic (Score:5, Insightful)
It isn't just Windows either. Apps in Gnome, KDE and OpenOffice also open up stupid dialogs.
It is unreasonable to consider training users to be driven by popups. What would make more sense is for programmers to design their pop up use better so that it is more meaningful for the user.
Parent
Re:Study confirms most popups are idiotic (Score:5, Interesting)
Programmers continue to use them because they effectively move responsibility. Yes, they fail, but when they fail it's suddenly the user's fault, so the programmer is happy with the result.
Of course this is bad UI and the failure is ultimately that of the programmer, but this is not how it's perceived now, so programmers will continue to use them even if they know full well that they don't do the job.
Parent
Re:Study confirms most popups are idiotic (Score:4, Insightful)
Of course this is bad UI and the failure is ultimately that of the programmer."
I wonder what percentage of programmers double as UI designers. I be it's less than 25%. The reality is that by the time most programmers get their requirements, error scenarios often don't meet up with UI designers' assumptions. So then you're stuck with either popping a dialog, designing a different ham-fisted solution or going back to the designer and adding a lot of time to the development.
I'm not defending bad modal dialogues, but in complex software with heavy deadline pressure, programmers often have to make decisions they'd rather not. It's not a bad programmer, it's a bad process.
Parent
Re:Study confirms most popups are idiotic (Score:5, Insightful)
In any way I think that the desktop environment can help, too. There should be defined popup styles for various events (crash, error, generic etc.), which should be impossible to recreate using simple images. GNOME/KDE kind of do this by allowing a multitude of styles, although users using something popular like the default Ubuntu look would still be possible targets. Vista-style blur effects might help, but are either too subtle or people simply don't notice. Maybe there could be some kind of authenticity indicator - a special mouse cursor used only for these popups (and inaccessible everywhere else) or an animation that plays when you mouse into the window. Of course those can be recreates using Flash...
Maybe the dialog should simply display something only the OS can know. The user could be asked to enter a certain phrase upon first boot (of a given profile) and that phrase is incorporated into the dialog - and of course completely inaccessible from everywhere else.
Of course I'm actually overthinking this; most people would still click malicious popups even if they only remotely looked like real windows at all.
Parent
Re:Study confirms most popups are idiotic (Score:5, Interesting)
Displaying something only the OS should know is an interesting idea... like let the users customize a window border by splattering paint and then it might be blatantly obvious which windows were their personal design, and which were fakes (different splatter pattern and different colors.) Has anybody seen anything like that implemented?
Not with window dialogs, but I've seen several browser & email plugins that use user-defined images to guard against phishing. The idea is that you assign your image to www.yourbanksite.example, then the browser will show that image whenever you visit that page... but if you end up visiting www.yourbankslte.com instead, it won't show the image, and you'll be able to notice that more clearly than the fact that the spelling is off.
It's also kind of similar to the icon that Yahoo lets you set on your login form.
Parent
Re:Study confirms most popups are idiotic (Score:5, Funny)
Clearly popups don't work in an effective way, yet programmers continue to use them for the wrong purposes.... What would make more sense is for programmers to design their pop up use better so that it is more meaningful for the user.
You have 1024 infections on your computer!
Press REPAIR to fix these problems.
A friend of mine came for help because he couldn't open his drive C: I told him he probably had a virus. He said that he even used an antivirus program. Which one? Here's his answer:
One that said "Your computer is infected!"
Parent
Re:Even more importantly... (Score:5, Insightful)
Education is definitely not enough because people just don't care. They want to do what they want to do and the computer should magically understand that and play along. There's little respect for the complexity of general purpose computers and any possible learning curve needed to use them properly.
My wife has occasionally complained that her computer was acting "strange". After hearing the symptoms I've often asked, "Did any messages appear?". "Yes." "Well what did it say?" "I don't know. I just clicked OK." She simply doesn't care enough to deal with an issue when she's trying to browse a web site or send an email.
My favorite was the time she complained my laptop must be broken because it turned itself off. I got nervous thinking it was broken. I asked if a message had popped up before it turned off. She said no, then thought about it and remembered something popped up a few minutes earlier. She couldn't remember what it said. I told her it said to plug it in or it would turn itself off. Her response: "Oops".
Parent
Re:Even more importantly... (Score:5, Insightful)
"Education is definitely not enough because people just don't care. They want to do what they want to do and the computer should magically understand that and play along. There's little respect for the complexity of general purpose computers and any possible learning curve needed to use them properly."
There is absolutely nothing wrong with this expectation.
Until you have internalized this, you won't be able to design great software.
Parent
Re:Even more importantly... (Score:5, Insightful)
That kind of personality quirk is not necessarily a sign of genetic stupidity. It's just a sign of extreme disinterest.
There are people who treat their cars more or less the same way: they are not the least bit interested in what is going on, literally, "under the hood". Warning lights? Pffff. Unless it stops the car, interrupting their life, they don't give a crap.
Car dealers love them.
And frankly, while such people can be annoying, I find them infinitely preferable to type that treats people like inanimate objects.
Parent
Re:Even more importantly... (Score:5, Interesting)
My sister-in-law took her car into the shop, asking to have all the warning lights and buzzers deactivated, as they were bothering her.
The service manager was somewhat reluctant to do this, thinking, no doubt, that if he went ahead with the work, it would come back to haunt him. She insisted, reasoning that these things had never happened to her before in all the years she's been driving. Five years later, she's still happy at the thought that she "took charge" of the situation. She likes to tell this story because, to her, it proves that she was right all along.
Sure, I have to agree, at the core it's a matter of priorities. But I think it's one in which simple not-caring has eroded further into not-caring-to-understand. We can laugh a bit inasmuch as it applies to ordinary people, but I find myself alarmed as this almost Orwellian regression from critical thinking into reactivity becomes more fashionable.
That's because it's not just ordinary people but also many trusted individuals who are afflicted. I've lost count of the number of IT managers and network staff who reason anecdotally, who can't seem to distinguish between different subsystems or levels of abstraction, or who don't even consistently apply commonplace notions of causality. These people may be smart and successful, but I find them hard to have as colleagues.
Physicians and car mechanics, on the other hand, seem to have somehow avoided the worst of this erosion. At least, that's what I've observed. I can't explain what, if anything, might set them apart from other technical professionals.
Parent
Re:Even more importantly... (Score:5, Funny)
And you decided to spend the rest of your life with this woman, and mingle your genes with hers, and have her raise your children????
$5 says your wife asks the same question when you leave the toilet seat up.
Parent
Re:Even more importantly... (Score:5, Interesting)
Story time:
Early in my career, I worked with a helpdesk tech who was hired more or less because he had certifications out the ying yang. So one day, he comes to me and he says, "I'm having a problem with this computer. It just won't work and I can't figure out why."
So I went with him back to the workbench and said, "Ok, show me what the problem is."
He booted up the machine and logged in. Everything looked fine. He navigated through the start menu, found the shortcut for Microsoft Word, and clicks on it. It takes a second before anything happens, and then a little window pops up with what looks like an error message. The tech immediately hits ok, and then sits there for another minute before turning to me and saying, "See. Word won't start."
I said, "Ok, well what did that error message say?"
He responds, "wha?"
I ask him to try running it again, he does, and when the error message comes up again, he again immediately hits the OK button. I say, "That! That error message. What did it say?" and he comes back again, "Huh?"
I get him to run it a third time, and ask him to take his hands off the mouse and put them in his lap until I tell him he can touch the mouse again. The third time, the error message pops up again and says, "Error: missing msvcrt.dll." (just making that up, but it was missing some DLL) I copy the DLL over from another machine and it works again.
True story. I'm not sure if there's a lesson in there somewhere, but it seemed like a relevant story.
Parent
Re:Summary is WRONG (Score:5, Funny)
I've learned to just click through to the article without reading the slashdot summary. It doesn't seem to have hurt my computer at all, but I -- Oh, wait. I just heard a bell. Gosh, I feel hungry right now.
Parent
Re:NOT: (was Re:Summary is WRONG) (Score:5, Insightful)
Parent
Re:NOT: (was Re:Summary is WRONG) (Score:5, Insightful)
Parent
Re:NOT: (was Re:Summary is WRONG) (Score:5, Insightful)
Here's a suggestion for everyone. Whenever you display an error message, don't just display the error message. The user (normally) doesn't particularly care what went wrong. They just want to know how to fix it.
Eg, I was trying to buy an AudioBook on iTunes the other day, when it said to me "Users in Australia cannot purchase tracks on the UK site". Now it didn't tell me "well, go to the Australian site, and here's a link to go to it" or say "would you like to go to the Australian site?". It just gave me a dumb error message. It took me ten minutes to find the link to the Australian site (scroll down to the bottom of the front page, dur. Seems so obvious now).
Dammit, be helpful to your users. Don't just display the error message. Display what to do about it. Even "please try again later" is better than nothing.
Parent
Re:NOT: (was Re:Summary is WRONG) (Score:5, Funny)
I've even gotten used to the slashdot editors not reading the articles. After all, there are a lot of submissions and it's not like it's their job. The queue is long, the day is short, etc etc. I understand all that.
But when I realized that even the submitters don't read the articles they summarize... that is when I cried. Something broke inside me.
Even that was a couple of years ago, though. I'm all better now, and life is wonderful now that things don't have to make sense anymore. I feel so free!
Parent
Re:Summary is WRONG (Score:5, Insightful)
The attitude that users who do something wrong are idiots is a large part of why computers, operating systems and applications are generally pretty shit. They're made by and for geeks, not normal people. If 1% of your users do the wrong thing they may well be idiots. If 50% of your users are doing the wrong thing, you are the idiot for designing your software so badly half the population can't use it.
(I mean "you" in the general sense, not the parent specifically)
Parent
Re:Summary is WRONG (Score:5, Insightful)
Computers are not for everybody!
Amen, brother.
Parent
The users aren't qualified to make these decisions (Score:4, Insightful)
And frankly they shouldn't have to be. I have no idea why developers seem to think they should/are. Fail safe and log it so someone who does understand what's happening can make an alternative choice.
Parent
People aren't idiots, people are people. (Score:5, Insightful)
If the tools aren't working well for people then the design of the tool is wrong.
If you build a ATM (cash dispenser) that spits out the money before it returns the card then you'll find that a not insignificant number of people leave the machine without retrieving their card. In their brains the task they are doing (getting money) is complete so they walk away.
Thus cash machines return the card first and then give you your money.
You have to design things to work the way real people work. Calling people idiots is just a cop out.
Parent
Newsflash! (Score:4, Interesting)
The average computer user is the same as average TV user, a.k.a. Joe Sixpack
<sarcasm>
*gasp*
</sarcasm>
We computer professionals stick around other computer professionals - and nonprofessionals around us absorb enough knowledge from us by osmosis. So of course it FEELS like everyone is computer literate -- but they're not. We develop software for the braindead zombies and the braindead zombies use it.
Re:Newsflash! (Score:4, Funny)
Osmosis? They gain knowledge from us through the diffusion of water?
Parent
Re:Newsflash! (Score:4, Informative)
Incorrect... Diffusion is a flow of material from high concentration to low concentration. Osmosis is the diffusion of water across a membrane.
Parent
Re:Newsflash! (Score:5, Funny)
Parent
or it could have been (Score:5, Interesting)
Re:or it could have been (Score:5, Insightful)
This was my thought too. Study participants were asked to give their opinion on a web site. If they close the offending window, they'd be unable to give their opinion on that website. If they just clicked through, they stand a chance of getting to the web site, and whatever happens to that terminal is none of their business. So these 'idiot' users were just following instructions.
Parent
Slashdot summary proves editors are idiots (Score:4, Funny)
From the article
More power to them (Score:5, Insightful)
Quit bugging me. Much more work needs to be done to eliminate "Are you sure?" requests. Working undo is always better than asking the user and making him regret the answer seconds later.
The fuunt thing is (Score:5, Informative)
the people writing the dialog boxes assume clicking no just shuts down the dialog box.
You could easily have events fire on the No as you do on the yes.
It takes a little work, but it is doable.
Too much interference (Score:5, Insightful)
This was not surprising and I don't place all the blame on the users.
There's a similar situation with semi experienced administrators. They may configure logging and monitoring on a system. Being security paranoid, they set the log level fairly low so they end up getting lots of alerts.
Somewhere along the line, however, the administrator stops paying as much attention. Maybe a CPU alert hits 100% every night. Then one day someone in Finance runs a half-assed join across a gateway and brings down a DB. The admin gets the alert but has gotten so used to them that it was ignored. This is worse than if he'd never gotten the alert at all.
The alerts that OSes put up (Vista, for example) and the host of browser and AV and IDE warnings get useless after a while. The system should do this transparently and not rely on the user to be the MAC layer.
Children (Score:5, Interesting)
My roommates' daughter, who isn't old enough to read yet, can navigate menus on the Nintendo Wii by using trial and error to determine which button "works" and which button "doesn't work" to get where she wants, then (with repetition) memorizing the position or appearance of the correct button. She has absolutely no idea what any of the text says if it isn't accompanied by pictures, but she only occasionally needs help navigating.
Shouldn't we expect better from adults using a computer?
Wrong conclusion (Score:5, Insightful)
I don't think this says as much about the users as it does the usability of our computers.
Computers are commodity items now, the days where nerds interested in technical details were the primary demographic are long gone. People just want to do their job and move on with life, they don't care about memory registers or malware they just want to not be interrupted.
It really illustrates how dialog boxes as a warning system are a flawed mechanic, we got this fancy computer with a fancy operating system, why can't it figure out the right thing to do when an application tries to access memory it's not supposed to?
Guess my point is if we put as much effort into error handling and/or malware detection as we do our whiz-bang graphics, it might not even be a problem anymore.
The benefit of simulated system errors? (Score:5, Insightful)
I don't really get why clicking OK on something that vaguely looks like a system error is a problem. If it is a script running inside a web browser, the script cannot do anything that it wouldn't be able to do without the script. If it is already a process running inside the OS, it means that you are already in trouble because it could also erase files or install programs without you clicking OK.
It would be more beneficial to malware if they could make a REAL Windows dialog ("Install new software, Allow?") look like a harmless message ("Print job finished."), but that would be pretty tough to do.
Testing criteria (Score:5, Insightful)
One thing worth noting is whether the students were using their own computers or computers on loan from the department. It's worth noting because most people care what happens to their own personal systems (because they're the ones who will be stuck fixing them) but care less if a school computer is infected for instance.
I'm not sure if this makes them idiots or just uncaring, either way it could be relevant.
Dialog boxes shut off critical thinking (Score:5, Insightful)
Working in support, I have seen so many times where if an unfamiliar dialog box pops up, people either click on the option they are used to clicking on, or call support without even reading the message on the dialog box. It is like they are unable to physically see the contents of the dialog anymore, it has been beaten out of them. Often all I have to do is make them read me the dialog over the phone, which makes them process the info mentally, and they know which button they need to press then, having actually read and comprehended what was asked.
It is a very interesting problem, I think the solution is to make the buttons themselves say what they do, rather than clicking Ok or Cancel, have the button say "Exit crashed program", or "Install new program" or what have you. Always being OK or Cancel conditions people to just blindly click.
Jumping to incorrect conclusions (Score:5, Insightful)
Maybe people should just realize they're using delicate instruments and should treat them as such. These aren't toys, but systems that cost hundreds, sometimes thousands of dollars to build. Its not the programmers' fault. Its the user's. If the user refuses to educate himself to not be a fool, there's really no way to try and make something foolproof.
Re:Jumping to incorrect conclusions (Score:5, Insightful)
As my girlfriend is a forth year vet student at one of the top 5 schools in the nation, I've got some experience with your customer (future) base and I'm the head developer for a small development firm. I feel I can help you out a little.
Most vets are idiots. Most of them have good memories and that gets them through vet school and past the boards. Very few of them actually have critical thinking skills and are people I would actually let touch my animal. Put them in front of a case that isn't in the text book and they have no clue what to do, even on simple stuff.
Example: They use IV Pumps to push certain fluids or drugs into the animals at times because you don't want to push the whole large dosage in at one time. Simply enough. So when they don't have a pump available, many of them never consider the fact that a gravity feed will accomplish the same thing, so they 'cant give the animal its medicine'. I'm not a doctor, but I've seen this happen and literally had to ask 'why don't you just let it drip in like before you had pumps'. After they get over themselves and have told me how utterly wrong I was, I've returned to see the animal on a IV drip. No ability to think on their own, just an ability to repeat something they've memorized. True story.
Not all of them are that way, I'd say about 10-15 out of her class of 75 can actually deal with a situation they haven't specifically been in before, the rest would be worthless in an emergancy situation with a problem they've never seen before.
This turned into more of a rant about vet students than intended, but for fucks sake for what is supposed to be the hardest branch of medicine, 'more difficult to get into the human medicine', at a top 5 school ... a lot of these students (AND professors) are really worthless.
So I say, your challenge is impossible to complete for the majority of people. Its not just Vets that are idiots, its all people. A small group of intelligent people carry the rest of the normal people forward.
Parent
Obviously... (Score:5, Funny)
Well, obviously, after clicking ok on a popup, another popup should open that contains a picture of the previous popup and a message "This is what you just clicked. Are you sure it's not malware?" That should take care of it. If enough of us send suggestions to Microsoft, there may be enough time to get it into Windows 7.
Microsoft has trained people to click "OK". (Score:5, Insightful)
Microsoft has trained people to click "OK", "Open", "Run", "Install", "Continue", or whatever button (wherever it is) that gets you past the idiot box.
Apple had until recently avoided this mistake. NOT (as some people have said) by making the buttons more meaningful, but by simply NOT trying to use warning dialogs in place of good design.
For example, Mac OS doesn't ask you if you want to move a file to the trash, and it doesn't ask you if you want to empty the trash, because these are common actions, and the dialog box becomes something you reflexively accept.
Recently, as I say, Apple has started to deviate from the path of virtue. I've caught my Mac in bed with promiscuous dialogs on many occasions.
But by comparison with Windows (particularly Vista)... my Mac's still pretty much a dialog virgin. Really.