Dialog boxes and security - mike's web log/comments

New comments for this entry are disabled.

January 27, 2004 | Dialog boxes and security | 79717 hit(s)

Eric Lippert with another insightful, um, insight into the use of dialog boxes. From a comment in a blog entry about the spread of the Bagle virus:

It's not that users are morons or that they "forget" to think. Its that users are trained to not think. Users very quickly learn from experience that:

dialog boxes are modal. But users do not think of them as "modal", they think of them as "preventing me from getting any work done until I get rid of them."
dialog boxes almost always go away when you click the leftmost or rightmost button
dialog boxes usually say "If you want to tech the tech, you need to tech the tech with the teching tech tech. Tech the tech? Yes / No"
If you press one of those buttons, something happens. If you press the other one, nothing happens. Very few users want nothing to happen -- in the majority of cases, whatever happens is what the user wanted to happen. Only in rare cases does something bad happen.

In short, from a user perspective, dialog boxes are impediments to productivity which provide no information. It's like giving shocks or food pellets to monkeys when they press buttons -- primates very quickly learn what gives them the good stuff and avoids the bad.

Modal dialog boxes are in general, badness -- and you'll see that more and more products rely less and less upon them. But they are particularly heinous when security is on the line. Security questions cannot be asked on a "retail" basis. The way users make security decisions is to set their policies appropriately and then let the security system enforce their wishes "wholesale".

[Mike here again] I find the third point particularly interesting, speaking as a guy who's had many opportunities to turn:

If you want to tech the tech, you need to tech the tech with the teching tech tech. Tech the tech?

into

If you want to friendly tech the slightly less tech, you need to gently tech the happy tech with the helpful, teching tech soft tech. Would madame care to tech the nice tech?

Attachment Security, Part Deux (KC on Exchange and Outlook)

Here's Part One. OK this isn't really a continuation of the history, but rather some more rambling...

Seth 28 Jan 04 - 9:10 AM

>In short, from a user perspective, dialog boxes are impediments >to productivity which provide no information.

You've totally nailed it w/that description...

Two folks I am well-acquainted with _insist_ on just clicking "OK" when confronted by dialog boxes, despite my warnings/cajolings/etc to the contrary that their computers might be trying to tell them something.

Obviously, they are not 'techies' by any stretch of the imagination. Nonetheless, they are computer users (and consumers) and one hopes the wizards of Windows keep even these humble folks in mind.

(One of them even had the temerity to say they had no particular impetus to change, because, in effect, they'd done it in the past with no discernable issue resulting....as long as email and websurfing keep working, people seem to think their computers are fine....)

Mike 28 Jan 04 - 9:23 AM

Well, Eric's the guy who nailed it, but I take your point. :-)

Eric Lippert 28 Jan 04 - 4:10 PM

Users like that are the rule, not the exception. You should see some of the tape we have of ordinary users in the usability labs. Scary!

There's a lot more to say on the subject of dialog boxes, both from the general perspective of usability and the specific details of how to write a good security dialog (ie, don't, but if you must, do it right.) I'll blog more on it later.

Eric Lippert 28 Jan 04 - 4:29 PM

> I find the third point particularly interesting

You're not alone. You could write for Star Trek!

http://talk.trekweb.com/articles/2001/10/09/1002677233.html

"I was the guy at Star Trek who, when I was writing their really technical scenes, filled in a lot of it with just blanks. It was like "Mr. La Forge, tech the tech 15 percent." And Geordi would say, "Captain the tech is overloading." "Well, tech the tech." "Captain, we can't tech the tech anymore or the warp drive will overload." I hated that stuff.