Bad UI is causing people to get scammed

https://ashlan.com/blog/bad-ui-is-causing-people-to-get-scammed/

by samemail88 • 4 years ago

325 173 4 years ago

I agree with this. The UI is moving more and more towards not showing URLs, emails, addresses, and other things that might clue a non-savvy user into being duped. But who do we complain to? They (FAANG, etc) are doing this to increase usage and profits, right?

lynndotpy• 4 years ago

This reminds me of the baffling decision when Windows started hiding file extensions by default.

Forge36• 4 years ago

What year was that?

jwilk2• 4 years ago

Out of interest, do they still do that?

svachalek• 4 years ago

Would a non-savvy user realize "venmoforward@gmail.com" is not a reasonable source address for a message that otherwise looks like it comes from Venmo?

I think the whole principle of "anyone who knows your email address / phone number can contact you" was already obsolete over 20 years ago. Access to my inbox and ringer should be by revocable invitation only.

mulmen4• 4 years ago

I hate how hard Slack makes it to copy a damn username. I get messages from people and try to look them up in the corporate directory but at some point it is just easier to type it in.

masswerk4• 4 years ago

I really doubt the basis of this argument. Arguably, there is something to be learned with any new technology and any expectation to the contrary may be rather illusionary. E.g., with the postal system, how do you know that Paris, Texas, is not Paris, France, when you ignore those "technical" bits like "Texas" and "France"? (But, when these were mentioned in conversation, you could infer this from context, but now, on the letter envelope, there's no such context provided at all!) Turns out, most people were able to cope with these "technical" challenges and some aspects of this were even taught in school (how to write an address). Most people are even able to memorize the ZIP codes most important to them.

Arguably, email addresses are (much) simpler to parse than postal addresses (including thing's like c/o, post boxes, etc.)

autoexec• 4 years ago

Would a non-savvy user realize "venmoforward@gmail.com" is not a reasonable source address for a message that otherwise looks like it comes from Venmo?

Email campaigns from companies are a mess. Even the company I work for sends official emails out from addresses at numerous 3rd party domains each using different mail servers. They often go out with verbiage nearly identical to what I see in phishing emails. They've contained links that point to URL shorteners or some other random 3rd party site that we don't own with URLs full of unintelligible tracking info.

I deal with phishing issues almost every day. Most of the time phishing emails are pretty obvious, but I've had customers ask me if an email claiming to come from the company I work for was legitimate and even after looking over the message and the headers I couldn't give a clear answer. I've had several talks with marketing about it, and I've managed to catch a few horrific communications before they went out, but they aren't willing to stop sending from or linking to third parties.

navjack272• 4 years ago

Was that the old principal? The one I've always ascribed to was "if you didn't initiate the communication then don't respond to it"

tsimionescu3• 4 years ago

Maybe, maybe not, but they still have a much better thane than when it comes from "Venmo Support".

donatzsky• 4 years ago

Would a non-savvy user realize "venmoforward@gmail.com" is not a reasonable source address for a message that otherwise looks like it comes from Venmo?

In many cases, no. They simply see that it has Venmo (or whatever) in it and assume it must be legit.

I've tried to explain this exact thing a few times. Not even sure I managed to get them to understand that a big company wouldn't use Gmail, but rather their own domain.

0xbadcafebee• 4 years ago

But who do we complain to?

I mean, you don't. You stop using their company, and you let them and everyone else know why. Vote with your dollars or with your feet.

masswerk4• 4 years ago

Especially in email, the clear name is rather a comment. Showing just the comment instead of the real data is negligent, at best.

(It's actually quite the opposite of what is going on with URLs, where everything is suppressed but the core domain name. Here, the originating domain and user is suppressed. It's more like showing the document title in the location field.)

masswerk4• 4 years ago

The preference for real names in email clients is actually quite annoying. E.g., some of my clients are using institutional email addresses, which are used and processed by multiple real-person users with associated clear names. Every time, I mail to one of these addresses (not addressing anyone in particular, but rather to whom these may concern, which is the expressed purpose of these addresses), I've to go back to the address and to discard the auto-filled, nonsensical clear name (which may be the person using that address, I received mail from last). In some email clients, this may involve multiple steps, as they really want to show a clear name and a clear name only.

dan-robertson2• 4 years ago

The URL move is more nuanced than that, no? If you look at how modern browsers decide what to show you in the address bar, they often try to show you the hard-to-fake bit instead of the whole url, so you see notreallygoogle.com instead of google.com.search.q.notreallygoogle.com or notreallygoogle.com/http://google.com and similarly you’ll see the punycode if the browser thinks the domain name may be trying to look like another one with confusables.

I agree the email situation isn’t great but it is also more complicated: lots of legitimate companies send emails via third parties or otherwise want to put a name quite different from the email (e.g. mail chimp but also google docs comments appear to come from the commenter rather than some big id email address), so it isn‘t as simple as showing the full address only and users may learn to ignore the full address if it is fully of random-looking letters/digits. And email protocols complicate it further because there are ways in which the from field may not even match the actual sender, though that isn’t such a problem with gmail. I definitely do hope things will improve, however.

XorNot• 4 years ago

Domain names are just fundamentally displayed wrong - the left to right reading order doesn't prioritise the right information.

"com.google" is what you need to see since it tells you who's really in charge of the content.

Particularly on mobile where I'm writing this I currently can see at most "news.ycombinator.co..." in the address bar. Could be a lot after that, how would I know at a glance?

Google and Mozilla could make substantial progress on this today by just showing an extra bit with the start of a domain name in right-to-left reading order.

darkerside2• 4 years ago

This is a good point. It's become typical for companies to use different email sending domains.

What we really should be doing is automating what I do when I get an email from a new domain that might be legit. Look up the DNS info so I can confirm it's the company they say they are.

donmcronald• 4 years ago

They (FAANG, etc) are doing this to increase usage and profits, right?

Yes. They're obfuscating the mechanisms that can be used to assess trustworthiness so they can sell it back to us as some kind of reputation or verification product.

Email is a perfect example. If the from address wasn't moved around, hidden, and obfuscated, it would be easy to tell people "make sure Venmo emails are from @venmo.com" and that's the thing everyone would look for. Instead, there's an entire generation of people that don't know how to identify a from address and it opens the door to a paid verification platform instead.

nirui• 4 years ago

To me, Gmail these days feels more and more like it's been designed by somebody who don't actually use email.

In this case, the top priority should be display name, (verified) source address and time of reception. The To and BCC line is not that important, thus can be folded under description such as "To you and another...".

I hear that product design in Google is data driven, I'm not really sure what UX data Gmail team has been consuming.

someweirdperson2• 4 years ago

The To and BCC line is not that important

bcc in inbound mails?

wildrhythms• 4 years ago

100%

We are so focused on "simplifying" everything... to what end? Maybe it's actually good for people to learn the thing they're using to some degree rather than hiding the functionality away because it "looks cleaner".

mulmen4• 4 years ago

Simplifying makes learning easier. But there is a limit. The problem starts when the simplification removes critical functionality.

foogazi• 4 years ago

Why not check your Venmo account instead of email ?

dawnerd• 4 years ago

Literally the first thing I did when selling stuff on ebay. Would verify that payment actually went through. I did have a couple people message saying they 'paid'. I'm sure it works just enough to be worth the trouble.

bombardier6789• 4 years ago

Indeed this is what I thought after reading the article. While there is a point to the article, it misses the basics entirely.

Internet makes a lot of things easier, losing money included.

alistairSH2• 4 years ago

This. Always check the app directly, never rely on email, SMS, of phone calls.

Though sadly, on some (most? all?) platforms, even that isn’t a guarantee, as some forms of payment can be rescinded. Or, the notice is communicated as “received” when it’s really more like “requested and processing” (much like banks crediting you for a deposited check, even though it takes weeks for a check to fully clear).

samemail88• 4 years ago

Some non techie users might not think to do that since they received what appears a legitimate email from Venmo.

jeff_vader• 4 years ago

My father avoided using any kind of computers until he was 68. The we got him an Android tablet. Not the best choice to be honest, but it's too late, he got used to it. He's now 77 and he still cannot distinguish what's part of Android OS, what's part of some application or what's just a web page in browser. All the popups confuse and overwhelm him. Somehow he still manages to take some photos of his plants and watches ton of YouTube. It's both fascinating and terrifying to watch him use his tablet. I do sometimes wonder how he'd adapt to UI like Windows 95/XP Classic.

nmilo• 4 years ago

That's the thing about people who aren't "into" tech, they have no idea what all this terminology is. What the hell is an OS, an app, a browser, a website? My grandma was completely shocked when I told her that some $100 phone she saw at the mall behaves exactly the same as her $1000 Samsung flagship whatever. To her, the whole phone is just run by Samsung. If you start telling people like her to always check the domain name in the email sender field, she won't even ask, "what's a domain name," she'll ask, "what's email? You mean the Yahoo button on my phone?"

karaterobot• 4 years ago

I am skeptical that showing the sender address would prevent scams like this, because I suspect that relatively few people who would get tricked by this scam are likely to figure it out based on noticing the full sender address.

I agree that more information is generally better, except that people often learn to ignore extraneous information in UIs, and in most cases the full address of the sender is not important.

And what makes these scams successful may not be lack of information in the UI, but something else. For example, users not recognizing the significance of the sender's address, or not paying attention to it at all. People have never been good at recognizing email scams, which is why detecting them before they get into the user's inbox is the best solution I know of.

The author may be right, but I would not take it for granted, and would want to see some research done to support this.

aetherspawn2• 4 years ago

I got scammed around $3000 because stripe sent me an email saying “payment received”, but it was actually processing, and it was eventually declined.

So I gave away the goods thinking everything was good to go.

When it bounced, I rang up and complained and they did nothing, just shrugged it off.

Story ends like this though: caught the thief with the Stripe IP audit log, police raided his house, found hundreds of other items but I never managed to recoup the loss, because mine was gone. I still think that it was Stripes fault because the UX on the email (even the green banner) made it seem like everything was good to go.

(I routinely tell everyone to avoid Stripe now and go with PayPal, someone from Stripe feel free to reach out and change my mind ..)

xwdv• 4 years ago

You have convinced me to never use Stripe and I will share this story to people in the future as to why.

bombcar• 4 years ago

Stripe has reinvented check clearing fraud, how wonderful :(

AussieWog93• 4 years ago

I also ran into issues with Stripe, as their automated systems flagged my business as fraudulent and there was no way to call them or get a fast response.

Ended up switching to these guys in Melbourne, never looked back: https://pinpayments.com

walrus012• 4 years ago

In this particular case, did the card billing address and shipping address match?

If you were selling high dollar electronic items or similar online, in my opinion it would be reckless to not implement that as a firm policy, which is fairly standard with high fraud risk vendors such as for photography equipment.

As a purchaser, I know that I've been on the customer side of this many times, ensuring that whatever small, high value electronic thing that I was purchasing from a certain vendor was being shipped to the address which is also set up for my bank and credit card bill.

tsimionescu3• 4 years ago

I have often purchased items online asking for them to be delivered to my parents' address, or the address of a friend, or my work address. If a site has not offered this option, I would have found another, no doubt about that. So, as a customer, I think it would be reckless to require me to have the same billing and shipping address.

wizofaus3• 4 years ago

There are plenty of reasons it might not be even possible to ship an item to a billing address! That's a rather absurd policy to enforce.

throwawaysleep2• 4 years ago

Isn’t PayPal pretty notorious for being a good fraud tool because it is so consumer friendly?

phito• 4 years ago

PayPal is absolutely 10000 times worse than Stripe, it's ridiculous to recommend them over basically any other payment processing service. They are the worst.

wolfgang42• 4 years ago

Obviously I don’t know the details of Stripe or your particular transaction, but in general payment systems tend to be extremely eventually consistent. (This is partly for historical reasons, and partly because they’re designed for robust interoperability and so fall back to resolving problems with phone calls between banks.)

Payment providers generally have heuristics to mark transactions as successful when there’s a high chance they’ve been finalized, but unfortunately this sometimes fails. In theory the final arbiter is the court system, but obviously that also has its limitations, as you encountered.

TLDR: It’s annoying, but I’m not sure any other provider would have actually done any better here.

ShroudedNight• 4 years ago

If a payment provider makes definitive statements about the status of a payment they should be required to carry full liability for correctness.

edwinwee2• 4 years ago

Hm, sorry about this. Could you email me at edwin@stripe.com? Would like figure out what went wrong here.

Aeolun• 4 years ago

Hmm, my biggest issue with Stripe was verifying my account while living in one country, while being a national of, and having a company registered in another. Their system just thinks that if your company is in one country, your home address must naturally be as well.

barbarbar• 4 years ago

Holy sh*t - that is horrible and a lot of money. Things like this should be advertised on the Payment company site with big red text. And describe each type of scam and a count of those.

deepspace2• 4 years ago

Stripe is a shitty company. They openly discriminate against LGBT-oriented businesses by describing such businesses as "adult services" and withdrawing service. A favourite hangout almost had to close its doors recently due to this crap.

edwinwee2• 4 years ago

Would you be able to email me at edwin@stripe.com about what happened here?

hackernewds2• 4 years ago

This seems like a tagging mistake by a model or human tbh than a widespread policy

janmarsal2• 4 years ago

Do they also discriminate against LGBT-oriented businesses that don't meddle with adult services such as porn and prostitution?

shikoba3• 4 years ago

What is a LGBT-oriented business? LGBT is about sexuality, hence...

hackernewds2• 4 years ago

It's mind blowing that the police responded to your complaint. May we ask how you managed this?

aetherspawn2• 4 years ago

Because I lodged it as site theft (due to them sending a courier to pick it up), and skipped the cyber division.

When I lodged the report (in person at the police station), I was able to find the courier job on Airtasker and provide the police with the phone number of an exec at Airtasker that I reached out to, and with the job ID and the IP address of the organiser who was using card fraud (from Stripe). They took the case straight away because there was a strong witness (the courier) and a strong lead on the organiser due to building IP trace from the telco (a young kid living in their parents basement).

It took them only about 2 weeks to get a permit to raid. The IP trace was essential because they had the courier deliver it to a fake address in a nearby suburb, where they impersonated the householder.

nikanj• 4 years ago

My basic assumption is that with online marketplaces, you inevitably get scammed. As a seller you get scammed out of your item, as a buyer you get scammed out of your money.

The platforms hide behind an EULA, the police are both disinterested and powerless. I've reverted back to good ol' "Meet me at $place, bring cash." Preferably picking a place like the police station lobby.

alistairSH2• 4 years ago

Yep. I use Facebook to sell things. Mostly by necessity - Craigslist seems to have dropped way off in popularity while also increased in amount of scam/spam. But, I use local groups. Might take a bit longer to sell, but cash in hand, no shipping shenanigans, etc. One benefit of living near a city vs a smaller town, I guess.

gerash• 4 years ago

I agree that the fix is not to display the full email header for the "tech savvy" people. The real fix is some kind of reliable trust mechanism where the real Venmo account gets some visual indicator (pad lock, blue check mark, etc.)

layer8• 4 years ago

That worked well for websites…

bvrmn• 4 years ago

And what did happen? Why EV is not used anymore?

solardev• 4 years ago

Gmail has this for PayPal but seemingly nothing else. Shrug.

userbinator9• 4 years ago

No. The less we rely on Big Tech to think for us, the better.

bentcorner2• 4 years ago

That requires all clients to agree to some kind of standard.

Better to teach people not to trust email and to check the source of truth themselves. In this case they should check their bank account and verify they received a transfer (or their venmo/zelle account etc).

krade2• 4 years ago

that's what BIMI certificates are for.

cloudking• 4 years ago

This is typically what happens when UX designers come up with a "beautiful" design, and test it in a small UX study with 5-10 people to get it approved. IMO, when you have a product with millions or billions of users, you have to assume that most users are not technically savvy and need to be hand held through your UX to avoid issues like OP shared.

meristem• 4 years ago

I'd say it is less about small tests and more about the cases and questions one is trying to cover during the usability tests.

drekipus• 4 years ago

Another bad UI/ux problem is advertising standards.

I had to go help my 70yo neighbour deal with Microsoft scammers after she clicked the "continue" button for her time scheduling form: https://ibb.co/CKCbRpf

Guess where the actual continue button is?

Computers are hell for normal people. There needs to be some sort of standards both on the appearance of ads ("can't look like the flow of a page, must be ""clearly"" an ad") and the positioning of ads (must be in margins, can't use absolute positioning).

After clicking this, it takes you to a Microsoft security product page looking website, forces itself to full screen, robotic voice blaring " your computer is insecure, please step away from computer" and a pop-up telling you what number to call to sort it out.

She came knocking on my door with the Microsoft tech support on the phone. Thankfully she had problems with the run prompt, and wanted me to help. I just hung up, closed the site. And installed an ad blocker.

And then people out there who support ads on the internet as they are right now

andrei_says_2• 4 years ago

I do weekly videocalls with my parents. My mother uses an android tablet. We've given up on zoom because the interface is too complicated for her. Currently using google duo.

Some things that stop her in her tracks:

- any control that requires a touch to activate and then disappears on a timeout - like all the controls for video apps. She takes 3-4 seconds to realize something changed and then 5 more more to start orienting herself. The controls usually disappear within 5-7 seconds.

- any surprising prompt from the os throws her into helplessness and panic - updates that need a restart, etc.

- anything that switches the focus away from the current activity. Why would android interrupt a live call with some BS, ever, is beyond me.

- communications apps show a screen with names but that's often the log of past calls or a chat. She wants to just click a name and make a call. On zoom, going to her contacts required 2 or 3 clicks which were not intuitive for her, and so she can never initiate a call.

- zoom audio needed active confirmation to connect to audio. On a tablet, where no options are available but the over-wifi audio.

- her having to slide a control in order to answer a call.

- anything that requires a reaction within 10-15 seconds

- anything that uses (even widely accepted) technical jargon.

She is not deaf or disabled nor visually impaired and yet the complexity of using this device presents serious obstacles.

These are just from the top of my head. She doesn't browse or use a computer and I'm happy for her. TV and newspaper are enough and I just don't feel good about having her navigate a world of malicious predatory dark patterns.

This makes me realize how used I am to not trusting anything online and presuming the worst by default - in order to protect myself.

I remember how about a decade ago my dad wanted me to help him with an important email. Someone had emailed him to tell him he won a lottery in Britain. It took me a lot of effort to explain to him that it is a scam, that they've emailed everyone, automatically, (to him a simple email takes half an hour so he can't imagine so much effort going into a scam) and that despite them knowing his name... they don't really know him.

The asymmetrical nature of malicious activity online is so... dishartening.

userbinator9• 4 years ago

She is not deaf or disabled nor visually impaired and yet the complexity of using this device presents serious obstacles.

I'm an experienced developer in the software industry and some of the stuff you mention still catches me off-guard --- especially the whole "disappearing controls" thing. https://news.ycombinator.com/item?id=24965293

Ruq• 4 years ago

Many of the things you describe, describe my mother to a tee.

She uses an iPad, but progressively Apple has complicated the interface to fit in more and more features, which has made it harder and harder for her to use the device simply.

---

One recent example is the Notes app, which today includes folders, tags, and many other fancy features. I only discovered recently that she had still been using the app as though she did the day she started using Notes, which must've been c. iOS 6. She didn't even notice the top-left "< Folders" button.

Apple's design language is "Clean" and "Modern", but often fails to convey to non-technical users that a even a button is...a button, since iOS/iPadOS use colored text with no background to convey that something is a button.

---

One other example was a mistake I made while configuring a web browser for her. I absent-mindedly turned on "Hide panels automatically", and it wasn't until I figured out what my mother meant when she complained "SOMETHING POPS OUT AND THEN JUST VANISHES" of what I had done wrong.

madars• 4 years ago

zoom audio needed active confirmation to connect to audio. On a tablet, where no options are available but the over-wifi audio.

It is annoying they ask it every time but there is, in fact, a different option: option to call your phone (which most people have) which could have lower latency and higher reliability. I have succesfully used it in places where internet is spotty but adding an extra step to join a call is too much.

margalabargala• 4 years ago

If Google Duo stops working out, we've had great experience using meet.jit.si with my wife's great-aunt. She's in her mid-80s, and English is her second language. We set up a room months ago and sent her the link, and each time we talk weekly she goes to the same place, clicks the same link, and the whole thing just works for her. It was simple enough that we were able to walk through setup over the phone (we're on the West Coast, the great aunt is in Germany).

No ads (just checked with an adblocker turned off), and the same link always dumps you in the same always-active room. As a bonus the whole thing is open source.

No, I don't work for them or have any interest whatsoever other than being a happy user.

amatecha• 4 years ago

Heck, I'm a lifelong-computer-obsessed software engineer in my 30's and almost all those bullet points have an adverse or frustrating effect for me as well. I am "purposely lazy" and spend as little effort as possible deciphering user interfaces. There's simply zero excuse for non-intuitive software anymore. I refuse to expend my valuable time and cognitive energy making up for the shortcomings of a software vendor, and it regularly surprises/disappoints me just how much effort people expend in that way.

In my opinion, it's practically an insult to provide software or a "service" that essentially demands the person interacting with it slog through countless arcane or obtuse interfaces which could have been totally simple, concise and straightforward. There have been literal decades of prior art on subtly nudging a user through the most obvious and "least surprising" ways to complete their intended task.

KORraN• 4 years ago

- zoom audio needed active confirmation to connect to audio.

I don't know if it's just me, but even as an "IT person", I never understood this "connect to audio" phrase, I just learnt that it is required for calls...

faebi• 4 years ago

I could add a lot more items and annoyances on my own. That makes me wonder, why don't we have some global list of iOS, Android, Macos, Windows and Browser usability issues?

raverbashing2• 4 years ago

That's what happens when IT companies hire people that know how to invert a binary tree but know jack crap about UI/UX and human interaction (or you know, about just what it takes to make a call)

Also Zoom on PC is usable, Zoom on phones is awful

js4ever• 4 years ago

"I am to not trusting anything online and presuming the worst by default" ... It's exactly the same IRL ...

cratermoon• 4 years ago

At least one AdTech company I know of has a policy against advertising assets that look like buttons or other UI elements, and require any ad image to include the branding of the business being advertised. That's just one of many AdTech brokers, and the biggest ones have no such scruples.

prawn• 4 years ago

That scheduling form example is just incredible. No ad network should allow this sort of trash. It really makes me want to walk away from computers and into a forest forever.

cube00• 4 years ago

I disabled the personalised advertising in my Google account and it's astounding how many ads that look to me like scams are permitted on YouTube/Google's ad network.

All using the same old over dubbed Musk videos from years ago to sell me trading software which they could easily detect with their own Content ID but they choose not to.

Vinnl• 4 years ago

This is why one of the first things I do when I get access to a less technical person's device is install an ad blocker. As a security measure.

EternalFury• 4 years ago

That's cute, but I am more concerned about losing my phone, which contains so many MFA means. If that happens, I'm not sure I will be able to prove I exist and that I am who I am. And even if you don't lose your phone, you should dread the near impossibility of ascertaining the authenticity of anyone sending you text messages, which are so often used as poor-man MFA devices.

projektfu• 4 years ago

Why not use something like Authy that's backed up and has a recovery password? I just download it on my next phone and am good to go.

throwawaysleep2• 4 years ago

With all the credulous idiots out there, I consider scams just bug bounties on stupidity at this point.

userbinator9• 4 years ago

Notice the ridiculous amount of whitespace in the UI? They clearly could have shown the full address but they don't. That's why I think stuff like this is entirely deliberate. They don't want you to think. They want you to live in a world where they make all the decisions for you --- and decide in the way that benefits them the most, not you. They want to filter out scam emails for you, they want to control your life. The phrase "don't make me think" is common in UX, but in reality, what they're aiming for is "don't let me think". Hiding everything and making it harder to discover the details is precisely to discourage it.

...or at least that's my theory, but there's plenty of evidence.

niceWokr8• 4 years ago

What was the technical excuse for people getting scammed before UI?

Has anyone considered the real scam is using people like monkeys pushing UI buttons for carrot sticks?

coding123• 4 years ago

This might be a slight aside but I can't STAND "toggles".

Weather it's green or red, it's often not even labelled what green means or what red means. Like when you see these COOKIE screens. If you don't click Accept All you click "Adjust Choices" And then you see a bunch of toggles that look either all on or all off. But they are simply labelled with "Targeted Cookies", "Personal Cookies"... But if it's ON does that mean YES Block such cookies. Or is ON mean "Allow these cookies".

Really confusing.

It's not like they're going to try to fix that either.

userbinator9• 4 years ago

In that example, I agree that it is probably deliberate.

I still do not understand why designers don't like checkboxes.

shultays• 4 years ago

I doubt seeing "onlinevenmoforwarderserver@gmail.com" would raise any red flags for your average non tech savy person that gets scammed, so making it more visible probably wont help that many people. And people that are able to tell if a mail adress is legit probably already knows how to expand that "sender's adress"

userbinator9• 4 years ago

No, on the contrary I think seeing it would be a red flag, especially if the user has been seeing what Venmo's real email address looks like and has become accustomed to it.

People notice things if you give them the chance to, and they will learn from it too. Removing things so they don't notice will only keep them ignorant. Here's an interesting comment tree related to that, around the similar subject of hiding URLs: https://news.ycombinator.com/item?id=23516774

LASR• 4 years ago

Google has been completely infuriating over the last few years.

It’s email. They hide the forward and reply all behind multiple clicks. Where is the Subject? CC? BCC?

I get that grandpa and grandma benefit from removing some extra functionality for usability.

The worst is that my Google Workspace account works the same. How can you ship this to serious enterprise users?

pkz• 4 years ago

A large email provider like Gmail could probably train a network to find emails that look similar to an official brand (start with payment providers). The client could warn the user that "Warning! This email looks a lot like it is trying to impersonate a different brand".

shswkna• 4 years ago

The paid-for “Google Workspace” does mark emails that look suspicious. It also uses the well known Gmail interface.

tsimionescu3• 4 years ago

That's exactly what spam filters are. Since they are relying on heuristics and ML, they aren't completely accurate, unfortunately.

It is fair to criticize some of the obvious misses though - these algorithms and heuristics are clearly pretty bad.

noAnswer• 4 years ago

Since a view years United Internet (mail.com, gmx.de, web.de) verifies some big players. So a email from Paypal, eBay or Postbank is visibly different from a standard email. (In the Web and App UI. Of course not if you use IMAP.) IIRC it has a individual icon and a green boarder.

(I don't know whether there is a standard behind it or if it is some kind of manual certificate pinning.)

epistasis• 4 years ago

Email UI is getting particularly bad. Trying to copy and paste email addresses is absolutely ridiculously hard. Oftentimes programs don't even understand the mailto: text that they insist on placing on clipboards.

And then there's the challenging of displaying the actual email address rather than just the label, which is usually a name. It's ridiculously bad UI and any program manager that tries to hide the simple and necessary email addresses, that we type and use, and are the closest thing to "security" that is possible with an incredibly secure system... well those program managers are not doing their jobs and are causing great pain in the world.

butz• 4 years ago

I wonder how all those people building dark patterns today will be swindled in the future, when they get old themselves.

shreyshnaccount3• 4 years ago

google, for all its money, makes shitty shitty UI, and not only is it shitty, it feels like its made specifically to make your life worse. lemme explain: 1. Gmail on phones -not only are there tons of minor design inconsistencies, oversight like what this article shows, theres also no effective way to organise your messages. there's an option to open calendar on the bottom of the hamburger menu (also inconsistent, this menu got removed from some other Google apps) it only works with Google calendar.

shreyshnaccount3• 4 years ago

(cont'd, pressed send by mistake) ang i couldn't find the option to make or remove new labels in the app. alternative is TwoBird, much easier to use imo 2. phone - while this app is majorly okay, I am super annoyed by the giant list of ways to contact a person that hangs just under a contact.. (things like message with whatsapp, call with whatsapp, video call etc with all the different apps. its clutter, rather just have an option to open in app) doesn't really need an alternative tbh it's good enough

3. calendar. i hate this app. from the bottom of my heart. its impossible to delete all the instances of a recurring event, doesn't have a decent monthly view. clicking on an event in the view doesn't open it (why?), changing the time never works on all the instances of a recurring task, some reminders just appear twice? it's unusable. alternative-install an open source calendar from fdroid. those are better. and you can export your data easily.

4. calculator. it seems to think in stupid. big bold buttons (okay, should be optional tho) taking up most of the screen, can't do anything remotely complex. no way to plot stuff, theres lag on the UI. its just freaking dumb and no one asked for it.

5. photos. welp, promised me free storage forever. used all my data to train some AI models. then took back the storage. this one's on me I guess.

6. drive. slow and filled with needless animations no one asked for. really basic things are missing or hand to find. can't open a terminal to edit files. alternative sync thing, a self hosted server.

shreyshnaccount3• 4 years ago

oh yeah, and all the app icons look the same it's ridiculous and I don't want it. alternative- use a launcher, change your icons.

bsenftner• 4 years ago

Bad UI? Criminal UI! I often have to stop using any software other than my development tools because consumer UI design is so riddled with dark UI patterns I get far too emotional about the mass deception I see taking place.

Software UI design is a legal frontier waiting to be cracked, and many corporations-as-people are going to jail and/or be shut down when this train gets rolling. Back when Prohibition had bathtub gin making people blind is the same type of crap taking place today with fraudulent and simply stupidly designed user interfaces.

krade2• 4 years ago

Just FYI, but that email is faked. By default, gmail will only show logos for senders automatically for domains with verified BIMI certificates. Since that's obviously not the case here, the only other way is to add the gmail address to your contacts and manually set an image for that contact. Or I guess the logo could have been added to the screenshot. In any case, rather misleading.

Without that Venmo logo the whole scam is rather obvious. But hey, anything for clicks I guess.

Edit: Also obvious from the times of the screenshots. The email was received at 9:47am, the screenshot not showing the logo was taken at 9:49am. The screenshots showing the venmo logo however weren't taken until 2:23pm and 2:50pm.

wizofaus3• 4 years ago

The fact you are able to receive emails that look indistinguishable from legitimate ones sent by the apparent sender is surely a problem with the email protocol, not really a UI issue, though certainly hiding the sender address is a part of it. Why we still communicate using a channel that does nothing to verify sender legitimacy in this day and age baffles me somewhat, and it really shouldn't be a difficult problem to solve (e.g. who browses the web without using https these days?)

onelovetwo• 4 years ago

BTW, its exactly the same in Apple's mail app.

Bad UI is causing people to get scammed

Related Stories