Zdziarski’s Blog of Things has an article about possible enhancements to iOS security, in the wake of the Apple vs FBI affair.
Another idea is one I’ve mentioned before: Duress Passwords
If you are asked to unlock your phone, you could use a different finger, the duress finger, and the fingerprint sensor could appear to accept it, but erase the phone. If you enter the duress password, the phone could erase itself or, perhaps, just start recording what is going on and uploading it to the cloud.
Another idea are Landmine Passwords. These are passcodes whose purpose is to defeat brute force searches. If you avoid landmines within hamming distance one or two of the correct passcode you would have litle chance of hitting one while trying to enter the correct code, but any searcher would be very likely to hit one before hitting the correct passcode.
Month: February 2016
The obvious missing feature
I think there are great opportunities for sensible people to make money doing usability analyses of web based systems.
Let me give some examples of well intentioned systems with the obvious feature left out.
Email addresses
I have a Capitol One credit card, and in my user profile, there a place to enter an email address so they can send me stuff. (In another post I will rant about email addresses further) Recently I happened to log in to set up alerts for spending and so forth. The email notifications were disabled because, they said, the email address I had entered had been refused. Yet the address was actually correct.
This is not unknown. We had a crash a while back of our cloud email server, and we didn’t notice for hours, so it is possible mail was bounced.
There was no way to tell the Capitol One system “test it now please”. Instead, I had to change the address to a different one. This made them happy even without a test. I suppose I could then change it back, but how much time do I have to spend working around a bad design?
Phone numbers
Many sites require phone numbers. They have no uniform way of entry. Some have free form fields, but limited to exactly 10 characters. Some forbid hyphens. Some require hyphens. Some have exactly three fields, for area code, exchange, and number. Is it really that hard to parse a variety of formats? Do they really think making me keypunch my number is helping their image?
Notifications
I have my bank account and credit cards set up to send my text notifications when there is activity. One bank only allows notifications for amounts above $100. Why does that even make sense? They can handle small deposits, but they can’t handle sending a text for a $10 charge? At least the text on the page explains the limit.
A credit card company has the same feature, but allows texts for any transaction amount, except $0! If I want notificications on all transactions, what limit value should I use? I telephoned, and the agent suggested $0.01.
I’m getting to be a curmudgeon when things like this offend me.
Notifications – unclear on the concept
Tthis is a post about organizations trying communicating with their customers but getting it wrong.
I have signed up for various notifications, typically by text or email. Tragically, sometimes organizations manage to use these in a way that makes me think they are idiots.
- I just received a text from my local library that a book I’ve had on hold forever has come in. The problem is that I picked it up last night.
- I got an email from my Honda dealer that my minivan is due for service – two days after the service was done, by them.
- I get both emails and texts from Target that my store credit card payment due date is coming up — even though my balance is zero.
To me these seem like violations of a simple and obvious design principle: don’t send a notification that is moot. All it does it point out to your customer that your systems are broken. And that means that your organization is clueless and really should not be trusted with my business.
Delay is also important. I have my Bank of America profile set so that I get texts notifying me of ATM withdrawls. I should get them when I do a withdrawl, but never at other times. Often, these arrive within minutes, but sometimes, they take 6 hours or so to arrive. The immediate feedback ratchets up my confidence that I would find out immediately if fraudulent activity were to occur. The delayed feedback? They are having the opposite effect. I obviously cannot trust BofA systems to notify me of activity in a timely way. Should I trust them for anything else?
Baking Bread
Cathy has been experimenting with gluten free bread recipes. She has all manner of different flours and ingredients now: rice, potato, tapioca, corn, amaranth, sorghum, xanthan gum, etc.
Yesterday the power went off here in Wayland, probably because a tree branch fell on the lines due to the heavy, wet snow. We got about 8 inches of the stuff, and I broke the drive belt on the snowblower again.
Anyway, the power goes off, and Cathy says “The bread has finished rising. We need to bake it now.” Well, the oven is not on one of the transfer switch circuits, so we can’t run it off the generator.
Not a problem! We recently got a new oven at the Boston Building Resource Center, and we saved the old one, because, well, you never know. I already took the front trim glass off the old one to replace the glass of the new one, which shattered one day. (The Gaggenau EB984 is an awesome oven, but they don’t make them any more, and parts are getting expensive.)
I wired the old oven onto the generator output and we baked the bread with the oven on the floor of the mudroom. Yes I know the generator should be more outside than shown below. I had to move the car first, which I did a few minutes after this photo.
Win says “That’s sort of crazy, you know.”
I will get an extra L14-30 plug so this will be easier next time.
