1
00:00:00,000 --> 00:00:06,920
So, hi, welcome. I'm David Huerta. This is the talk that I'm doing. It's called Alice and Bob are Slightly Less Confused.

2
00:00:07,820 --> 00:00:11,060
Just to kind of go off of the kind of biography, like, who is this?

3
00:00:11,660 --> 00:00:16,900
So, I'm Digital Security Fellow at Freedom Press Foundation. I also organize scripted parties in New York City and Phoenix.

4
00:00:17,520 --> 00:00:26,780
A lot of the kind of experiences that I've had with, like, user frustrations and things come from kind of the front lines of, like, showing people how to, quote-unquote, use Signal, use Tor.

5
00:00:27,380 --> 00:00:31,300
And then before that, I come from kind of a weird mix of a developer and design background.

6
00:00:31,460 --> 00:00:35,160
I work in an AI lab that did mostly data visualization for really complicated things.

7
00:00:36,380 --> 00:00:40,580
There's my Twitter. It's mostly just me yelling at the F train nonstop.

8
00:00:42,140 --> 00:00:47,740
And then this is actually SQL. So, this is a talk, like, the continuation of a talk that I did in 2015.

9
00:00:48,660 --> 00:00:49,700
So, let's talk about that.

10
00:00:49,860 --> 00:00:56,760
So, 24 months ago, actually 24 months ago, I did a talk on kind of usability, privacy, and just, like,

11
00:00:56,780 --> 00:00:58,960
these are the issues that people ran into at crypto parties.

12
00:00:59,140 --> 00:01:04,120
And here's some suggestions on, like, what to do based on things like human interface guidelines,

13
00:01:04,360 --> 00:01:09,940
which are kind of the rules that different platforms have for, like, making things feel more like the platform that they were designed for,

14
00:01:10,500 --> 00:01:12,140
among other kind of design concepts.

15
00:01:13,560 --> 00:01:19,680
So, these, I'm just going to, like, recap kind of, like, the very, like, the very kind of cliff notes just of what that talk was about.

16
00:01:20,900 --> 00:01:25,200
The new Mac interface guidelines that are online leave out all the UX fundamentals.

17
00:01:25,400 --> 00:01:26,540
So, they'll just be, like...

18
00:01:26,780 --> 00:01:30,220
You know, put an arrow here instead of a hamburger menu or whatever.

19
00:01:31,100 --> 00:01:36,540
But if you find this, like, really old 1983 copy of the Macintosh human interface guidelines,

20
00:01:37,000 --> 00:01:42,540
it goes through kind of the baseline fundamentals of user experience, which apply to, like, everything.

21
00:01:42,680 --> 00:01:46,520
This is kind of at the forefront of, like, people doing things with, like, graphical user interfaces

22
00:01:46,520 --> 00:01:48,880
before, of course, there was a command line at the beginning.

23
00:01:50,440 --> 00:01:54,780
And this is, like, kind of the way to, like, deal with user interfaces that are based inside screens.

24
00:01:56,780 --> 00:02:00,880
And so, just kind of the recap of what that basically talks about

25
00:02:00,880 --> 00:02:03,680
if you don't want to spend, like, $4 at a used bookstore on it.

26
00:02:05,140 --> 00:02:07,720
So, there's these concepts that we think about in UX.

27
00:02:08,460 --> 00:02:08,860
Modelessness.

28
00:02:08,980 --> 00:02:16,140
So, the idea of, like, having to depend on human memory to remember what state you can do certain things in versus others.

29
00:02:16,800 --> 00:02:21,280
This is a lot of, like, a lot of Emacs people are, like, this is why you don't like them.

30
00:02:21,800 --> 00:02:25,740
Because you have to remember what state you're in, whether you're in write or whether you're, like, in a commands.

31
00:02:26,300 --> 00:02:26,700
Entry.

32
00:02:28,620 --> 00:02:32,900
And the problem that is kind of specific to a lot of cryptography software

33
00:02:32,900 --> 00:02:36,120
is it's usually kind of, like, bolted on top of some other insecure protocol.

34
00:02:36,620 --> 00:02:40,980
This is especially the case of, like, PGP, for example, where it's, like, people generally, not generally,

35
00:02:41,020 --> 00:02:42,740
but, like, some people use it for email.

36
00:02:42,920 --> 00:02:47,700
So, in this case, email is just not designed to be, by modern standards, a secure protocol.

37
00:02:49,620 --> 00:02:53,320
And you have to remember to, like, do things in a certain way to have it be in an encrypted.

38
00:02:53,600 --> 00:02:56,360
But there's, like, an unsecure mode and a secure mode that gets, like,

39
00:02:56,360 --> 00:02:57,800
mentally modeled on top of that.

40
00:02:58,020 --> 00:03:01,200
And having to remember that is a problem.

41
00:03:02,940 --> 00:03:03,380
Perceivability.

42
00:03:03,740 --> 00:03:10,560
So, this is, like, the idea of the UI kind of reflecting what's actually going on behind the scenes.

43
00:03:11,380 --> 00:03:14,900
Mostly, a lot of the points that it was making in 1993 were mostly about, like,

44
00:03:15,360 --> 00:03:19,080
making sure that if something is working really well behind the background,

45
00:03:19,180 --> 00:03:22,720
that the front end reflects that so that people don't automatically assume that, like,

46
00:03:22,760 --> 00:03:24,480
you know, oh, no, there's an error.

47
00:03:24,480 --> 00:03:27,360
Where it, that, because in, especially in, like, security software,

48
00:03:27,800 --> 00:03:32,220
a lot of users' assumption won't be, like, you know, computers are garbage, code is garbage,

49
00:03:32,320 --> 00:03:36,140
nobody did tests on it, but mostly, oh, no, something went wrong, I must have been hacked.

50
00:03:36,520 --> 00:03:39,940
So, you really don't want to, like, cause anxiety, you don't want to freak users out.

51
00:03:40,040 --> 00:03:43,560
Another book that I recommend actually kind of speaking on anxiety and design is called,

52
00:03:44,440 --> 00:03:45,040
oh, yeah, sorry.

53
00:03:45,460 --> 00:03:48,860
Another book that is not mentioned, aside, thank you,

54
00:03:49,340 --> 00:03:52,700
from, aside from the fact that, aside from the original Mac Higg,

55
00:03:53,160 --> 00:03:54,360
is also, uh,

56
00:03:54,480 --> 00:03:58,280
I think, a list apart, publishes something called the, uh,

57
00:03:58,540 --> 00:04:01,820
Designing for Motion, which is another good book, which is really good, highly recommended.

58
00:04:02,160 --> 00:04:07,340
Mostly talks about web design, but kind of applies to a lot of other, uh, applications as well.

59
00:04:09,120 --> 00:04:15,080
So, we have, uh, user testing, and that is basically exactly what it sounds like.

60
00:04:15,220 --> 00:04:19,300
In this case, like, what you make will make sense to you because you built it,

61
00:04:19,320 --> 00:04:20,340
if you're a developer, for example,

62
00:04:20,920 --> 00:04:23,780
but you want to put it in front of people that are not like you, in a sense,

63
00:04:24,480 --> 00:04:28,100
so they use it to see whether the same assumptions that you have about how this works

64
00:04:28,100 --> 00:04:33,220
are the same assumptions that they have, uh, and that is why user testing is super important.

65
00:04:33,440 --> 00:04:36,520
This is actually pretty well established, as far as, like, the methodologies for this.

66
00:04:36,860 --> 00:04:42,360
Uh, Katie Smith did a talk, I think, two hopes ago, about user testing that I recommend checking out.

67
00:04:43,500 --> 00:04:46,460
Uh, metaphors, it's also just, like, as far as, like, describing what a thing does,

68
00:04:46,580 --> 00:04:52,860
like, having a analog kind of equivalent of that to compare it to is a good way for people to understand what it is.

69
00:04:52,860 --> 00:04:58,020
Uh, so, you know, you have, like, your notepad, for example, this is, like, you write down notes in, or text, or whatever,

70
00:04:58,820 --> 00:05:04,880
and, uh, that is a common, like, thing that gets used a lot.

71
00:05:05,000 --> 00:05:06,280
I'm just gonna move this mic around.

72
00:05:09,720 --> 00:05:14,560
So, there's, uh, user testing, metaphors, uh, the problem is that, like, in cryptography, like,

73
00:05:15,780 --> 00:05:22,840
public key cryptography is weird, and it's hard to describe, um, and, you know, back in the day, we had keys and cryptography,

74
00:05:22,860 --> 00:05:27,720
and a public key is, like, a cryptography key, but it really works more like a lock with a private key as a key.

75
00:05:28,780 --> 00:05:31,920
So, it's one of those things where we have to think about, like, metaphors that make sense,

76
00:05:31,940 --> 00:05:35,340
to really describe the function of what different things within a system do.

77
00:05:36,600 --> 00:05:41,580
Uh, and then there's key lesson from 2015, so this is also from my own talk, of just, like, things that were not covered in 1993,

78
00:05:41,780 --> 00:05:48,540
but, like, the idea of, uh, undoing, for example, uh, we usually want to have, like, in software development,

79
00:05:48,600 --> 00:05:49,740
a way to do that really easily.

80
00:05:50,260 --> 00:05:52,840
But in cryptography, like, if, as far as, like, privacy in hand is concerned,

81
00:05:52,860 --> 00:05:56,240
as far as the technology goes, like, for example, if you're in the old version of mail below,

82
00:05:56,300 --> 00:06:00,240
you start typing a message, you go and encrypt it, but too late, it's already saved this draft in your Google draft.

83
00:06:00,440 --> 00:06:05,060
So, uh, it's one of those things that, like, it's harder to pull off and more of a challenge,

84
00:06:05,340 --> 00:06:07,460
more of a design challenge than it would be in other apps.

85
00:06:08,240 --> 00:06:13,260
Uh, there's also the idea of just, like, you have too many tools and too many things and moving parts that a user has to manually deal with.

86
00:06:14,980 --> 00:06:20,460
So, in, like, crypto parties, for example, you will have to go through, like, oh, well, if you want to, like,

87
00:06:20,520 --> 00:06:22,820
say you want to do the standard kind of cross-platform setup,

88
00:06:22,860 --> 00:06:28,940
of Thunderbird, Enigmail, uh, GPG tools, or GPG for when, like, you're installing three different things,

89
00:06:29,080 --> 00:06:32,200
you're doing, you're downloading three different things, you're doing checksums on three different things,

90
00:06:32,240 --> 00:06:35,580
looking for checksums, researching how you actually use checksums,

91
00:06:35,600 --> 00:06:39,560
because literally no place that offers a download for these things actually mentions how to use them.

92
00:06:40,080 --> 00:06:45,040
Uh, and then going from there, as far as, like, making sure that everything's installed correctly

93
00:06:45,040 --> 00:06:46,600
and knowing what order to install things in.

94
00:06:47,220 --> 00:06:50,680
Uh, there's also just kind of a, I don't know, there's probably a better name for this, uh,

95
00:06:50,740 --> 00:06:52,840
like, more experienced designers have for this,

96
00:06:54,120 --> 00:06:55,720
like, I'm going to do a thing, I'm going to do a thing.

97
00:06:55,800 --> 00:06:56,900
Oh, by the way, I can't do a thing.

98
00:06:57,080 --> 00:06:59,640
Like, at the very last step of this long process that I've just gone through,

99
00:06:59,720 --> 00:07:00,800
it realized that this is actually impossible.

100
00:07:02,860 --> 00:07:07,540
Uh, this is a problem with, like, the YubiKey support in, like, OpenPGP, for example,

101
00:07:07,660 --> 00:07:11,220
where, like, the way it reads the card, like, if you start typing a...

102
00:07:13,680 --> 00:07:17,540
Okay, cool. I am going to have it right in front of my face.

103
00:07:17,700 --> 00:07:18,440
Does that work for everybody?

104
00:07:19,620 --> 00:07:21,320
It's noticeably better. I can tell. Thank you.

105
00:07:22,080 --> 00:07:26,800
Cool. And honestly, like, up until this point, this was basically my talk from 2015,

106
00:07:27,060 --> 00:07:28,420
so you didn't miss out on anything new yet.

107
00:07:29,700 --> 00:07:34,520
Alright. So, uh, yeah, let users know. So GPTools is kind of notorious for this.

108
00:07:34,600 --> 00:07:37,620
There's, like, a specific thing where, like, oh, I'll start writing a thing in Thunderbird,

109
00:07:37,680 --> 00:07:40,620
but then I plug in my YubiKey, and then it's like, oh, I don't recognize it.

110
00:07:40,660 --> 00:07:43,360
You haven't entered your PIN, but it doesn't prompt for it because it only looks for that

111
00:07:43,360 --> 00:07:48,380
at the point before the mail client is opened when the, like, GPT daemon in the background runs it

112
00:07:48,380 --> 00:07:49,700
and, like, it's like, oh, okay, here it is.

113
00:07:49,700 --> 00:07:54,080
So you literally have to, like, put your laptop to sleep and then Mac OS X, it'll basically

114
00:07:54,080 --> 00:07:58,760
re-kick in the GPT background process and be like, okay, now you can prompt, get prompted for

115
00:07:58,760 --> 00:08:04,160
your key. Uh, so that's what, like, the concept for false hope. The other thing is also just,

116
00:08:04,200 --> 00:08:07,540
like, the internet is full of, like, garbage documentation. So, like, even if you, like,

117
00:08:07,540 --> 00:08:12,640
describe everything absolutely perfectly to your users or your audience or whoever it be,

118
00:08:13,320 --> 00:08:18,000
somebody on the internet will explain it really poorly, confuse them, and cause more of a

119
00:08:18,000 --> 00:08:23,460
problem. So you have to anticipate, like, what other people are using to describe things in

120
00:08:23,460 --> 00:08:27,340
order to explain why they're either wrong or why that might be confusing to explain it that way.

121
00:08:29,020 --> 00:08:34,520
Alright, so we kind of, in 2015, talked about a few different examples, uh, privacy enhancing

122
00:08:34,520 --> 00:08:39,700
technology and, like, some of the problems and then kind of some of the progress some of them

123
00:08:39,700 --> 00:08:44,880
made. So we're going to talk a little bit about that. Uh, we're, we're not going to talk about

124
00:08:44,880 --> 00:08:47,980
Pigeon, though. It's, Pigeon's a little busy surfing right now. And, uh, we're going to talk a

125
00:08:48,000 --> 00:08:50,340
little bit about, uh, there hasn't been much progress on that front. Neither has there really

126
00:08:50,340 --> 00:08:54,400
been on Thunderbird since it's still kind of EOL and they're not doing anything but bug fixes at

127
00:08:54,400 --> 00:09:00,000
this point. Uh, so we'll just, like, skip right over those. So going back into what I mentioned

128
00:09:00,000 --> 00:09:03,980
about modality of, like, thinking about, like, an insecure versus a secure mode and what that

129
00:09:03,980 --> 00:09:08,860
means. Uh, I kind of cited Chrome as a good example of this, where it was, like, well, here's

130
00:09:09,540 --> 00:09:13,760
incognito. Here's, like, within this window, within this frame, which is, like, differentiated

131
00:09:13,760 --> 00:09:17,980
from the way the other, like, insecure modes work. This is the way, like, it's like, like,

132
00:09:18,000 --> 00:09:21,360
it gives you just, like, the briefest amount of information but it's not in your way so you're not,

133
00:09:21,420 --> 00:09:25,900
like, clicking X buttons or OK buttons to, like, make something stop. It's there if you need it

134
00:09:25,900 --> 00:09:30,500
and then it's not in the way if you don't. Uh, different browsers, like, they've improved.

135
00:09:30,600 --> 00:09:33,980
They've, like, made it even more obvious that, like, this is different than the other windows,

136
00:09:34,620 --> 00:09:38,560
uh, which is cool. And it's, like, one of those things where I think the Chrome team has been

137
00:09:38,560 --> 00:09:44,280
doing a lot of user testing around that to see, like, how people make, avoid mistakes of, like,

138
00:09:44,300 --> 00:09:47,980
accidentally, um, doing embarrassing searches on their non-securing, you know, like,

139
00:09:48,000 --> 00:09:54,220
incognito modes. Uh, other browsers, of course, have this. Um, the, there's a bit of a problem,

140
00:09:54,320 --> 00:09:59,540
though, that was kind of discovered recently due to user testing, uh, which was, uh, basically

141
00:09:59,540 --> 00:10:03,420
discovered from this from a DuckDuckGo study is that a lot of people don't actually know what

142
00:10:03,420 --> 00:10:07,360
private mode does. So, like, people can tell when they're in private mode or not. But as far as,

143
00:10:07,440 --> 00:10:10,060
like, the mental models people have, the assumptions that people make around these things,

144
00:10:10,480 --> 00:10:15,740
they're not super well described. Although, you know, there is a blurb of text explaining what it

145
00:10:15,740 --> 00:10:17,980
is. But it turns out that, like, when you're in private mode and you're not in private mode,

146
00:10:18,000 --> 00:10:22,280
um, paragraphs of texts that are kind of in the background maybe aren't necessarily the best way

147
00:10:22,280 --> 00:10:28,900
to warn people about stuff or, like, really explain easily and quickly concepts like that. Uh,

148
00:10:29,020 --> 00:10:32,400
but they're working on it. And I think this is actually, like, this seems like the tiniest, most

149
00:10:32,400 --> 00:10:40,040
insignificant change. Um, but just looking at what it does to, like, say, like, yes and no as far as,

150
00:10:40,140 --> 00:10:43,640
like, does this protect from my ISP? Does this protect from, like, other people using my

151
00:10:43,640 --> 00:10:47,820
computer? Like, kind of having a more, like, threat model immediate, like, real world application

152
00:10:47,820 --> 00:10:52,040
of just not being, like, talking about cookies specifically, but just, like, you know, your

153
00:10:52,040 --> 00:10:56,380
little brother can see what you're looking for or, like, uh, your government can see what you're

154
00:10:56,380 --> 00:11:00,860
looking for, et cetera. I think this could be applied in a few other places. Um, and I would

155
00:11:00,860 --> 00:11:06,380
love to see that kind of proliferate in more places where you have kind of an insecure and a

156
00:11:06,380 --> 00:11:13,000
differentiation between an insecure and secure mode. Cool. So, last time we were here, this is,

157
00:11:13,000 --> 00:11:17,800
so this is Signal. This is literally a copy and paste screenshot from 2015. Um, and this is

158
00:11:17,800 --> 00:11:22,480
a, uh, there was this idea that I had of just, like, well, this is kind of, just kind of where

159
00:11:22,480 --> 00:11:26,080
things got thrown into as far as the settings page goes. And, like, we're all guilty of this as

160
00:11:26,080 --> 00:11:29,460
developers. It's just, like, well, we got to have some stuff. It's, like, I don't know, let's

161
00:11:29,460 --> 00:11:33,120
just throw in the setting page, whatever, like, leave it alone. Uh, it's improved since then,

162
00:11:33,160 --> 00:11:37,360
actually, a lot. So, the issue with this, for example, two things. One, I hate the word

163
00:11:37,360 --> 00:11:42,340
fingerprint because any time I've talked to people that are just new at computers, they immediately

164
00:11:42,340 --> 00:11:47,040
think of a fingerprint reader, which are actually fairly common in a lot of laptops and smart phones

165
00:11:47,040 --> 00:11:52,480
now. And they think it's related to that because they share the same namespace, um, in memory and

166
00:11:52,480 --> 00:11:57,120
context. And it also doesn't say what to do with it. This is a problem that I have with, with the

167
00:11:57,120 --> 00:12:01,380
way people offer checksums. It's, like, there's no instructions on what to do with this, like,

168
00:12:01,380 --> 00:12:06,960
weird number that you're seeing. Uh, and that was the kind of case of what it was back then. Uh, the

169
00:12:06,960 --> 00:12:11,100
protocol's changed, so actually the way people would even compare fingerprints is different. Uh,

170
00:12:11,140 --> 00:12:14,240
the screen security, there's no explanation what it is. So that was kind of the main issue back

171
00:12:14,240 --> 00:12:17,020
then. Now, you have exactly the same thing. Uh, you have, uh, you have the same number of

172
00:12:17,040 --> 00:12:20,220
those, and they don't know exactly what kind of Apple recommends for, like, explaining things in

173
00:12:20,220 --> 00:12:24,320
general. So you have, like, a like, a short thing that this is when you're switching apps, and

174
00:12:24,320 --> 00:12:28,660
that's the official name of what it's called in other Apple apps so you know what App Switcher

175
00:12:28,660 --> 00:12:35,140
means, is kind of there. There is, um, other explanations for new features that didn't quite

176
00:12:35,140 --> 00:12:39,380
exist back then. Uh, you also have block functionality, which is really important. I think,

177
00:12:39,380 --> 00:12:45,480
unfortunately, there's a lot of focus that we tend to have in Informations Security on, like,

178
00:12:45,940 --> 00:12:47,020
the most, you know,VEGO's jobs ended up not being clear questions that most people would be

179
00:12:47,040 --> 00:12:52,160
making sure that we do things on the crypto side and on the math side really well but maybe not

180
00:12:52,160 --> 00:12:57,980
thinking about a lot of the other attack vectors or like issues of what attack means in this case

181
00:12:57,980 --> 00:13:02,840
like what if it actually means that like your creepy X will not stop sending you like you know

182
00:13:03,560 --> 00:13:08,500
creepy texts for example. So this kind of takes care of that. It took a while for that to roll

183
00:13:08,500 --> 00:13:11,760
out. Apparently there's been some IOS issues that have made that a little bit harder than it

184
00:13:11,760 --> 00:13:18,240
sounds but this is one of those things that I think you really want to have implemented as far

185
00:13:18,240 --> 00:13:22,160
as and this is why people do user testing because this is a concern that gets brought up in

186
00:13:22,160 --> 00:13:25,940
addition to like I really don't want to share my phone number like it's another thing but like

187
00:13:25,940 --> 00:13:31,820
that's kind of baked into the way this works so there's no changing that unfortunately. Kind of

188
00:13:31,820 --> 00:13:35,280
similar thing so this is kind of what you do with fingerprints now where it has an entire kind

189
00:13:35,280 --> 00:13:41,400
of screen that's dedicated to like a process of what you do. So like here it shows you the state

190
00:13:41,400 --> 00:13:41,740
of what you're doing. So this is kind of what you do with fingerprints now where it has an entire

191
00:13:41,740 --> 00:13:45,480
where it is. Which before you had to remember. You had to like you had to like basically throw

192
00:13:45,480 --> 00:13:51,220
this into human memory to be did I already verify this person? Did I not? In the early days of

193
00:13:51,220 --> 00:13:55,280
Signal there weren't that many users so it wasn't really seen as a problem probably. But as we

194
00:13:55,280 --> 00:13:59,680
have more and more people on Signal that's like more spaces in your like media like neural

195
00:13:59,680 --> 00:14:05,880
network to like save um basically to say like I already verified a person. I didn't verify this

196
00:14:05,880 --> 00:14:09,780
person. Did I verify this person? Maybe I did before I got my new phone. So there's all these

197
00:14:09,780 --> 00:14:11,380
things that have to be thought about. Uh.

198
00:14:12,900 --> 00:14:16,840
Modes as far as like you know now you can do this one feature and this is what that screen is

199
00:14:16,840 --> 00:14:22,480
for. Uh. And it also says why. So it kind of gives you an idea of what that is. Uh. It has a few

200
00:14:22,480 --> 00:14:25,680
different options so you have the easy option but you can actually see the full fingerprint by

201
00:14:25,680 --> 00:14:30,700
yourself so you can have some other means outside of the way it was designed for to compare by

202
00:14:30,700 --> 00:14:36,160
other out of band uh verification processes. Uh. And there's a learn more thing which I'm

203
00:14:36,160 --> 00:14:41,360
really a fan of. It's like people that want to learn more can learn more. Uh. Outside of that is

204
00:14:41,360 --> 00:14:46,920
that though there's been some new issues. Uh. We have um kind of going back to the assumptions

205
00:14:46,920 --> 00:14:52,600
people make of like how things work. Uh. Does anybody remember Path? The like kind of the weird

206
00:14:52,600 --> 00:14:56,960
like people threw a shit ton of money at it. They were like it's the next Facebook. Uh.

207
00:14:57,120 --> 00:15:02,620
Basically the idea behind that was there was a big controversy about it essentially like

208
00:15:02,620 --> 00:15:06,660
uploading all your contacts and then like keeping them on their servers. So when people hear

209
00:15:06,660 --> 00:15:11,340
about you know something on their site is able to see that I'm friends with some somebody on the

210
00:15:11,360 --> 00:15:16,360
other side. The mental model people have and assume is that like stuff is on the server cause

211
00:15:16,360 --> 00:15:19,180
that's the way it works for their email. That's the way it works for social media. That's the way

212
00:15:19,180 --> 00:15:23,260
it works for like a lot of other things. And they're not going to necessarily understand like

213
00:15:23,260 --> 00:15:27,520
well I did a hash on a thing and then we did another thing and that's how the server doesn't

214
00:15:27,520 --> 00:15:32,200
know what's going on. Uh. And this is hard to explain because it's a very you know there's a lot

215
00:15:32,200 --> 00:15:39,020
of unique security processes. But I think having uh so just as Threema they kind of do that as

216
00:15:39,020 --> 00:15:41,340
far as like explanations go. Of like what's going on and what's not going on and what's not going

217
00:15:41,360 --> 00:15:45,940
on. This is why we can see who else is on Threema while still like not giving away or keeping

218
00:15:45,940 --> 00:15:51,320
your like phone number or contact or email address or whatever identifier they use. Uh. And

219
00:15:51,320 --> 00:16:00,180
you get to the screen via uh this is like an ID. Via these like little more information icons

220
00:16:00,180 --> 00:16:05,260
which are pretty common in a lot of mobile apps. So it's I'm a fan of them. Uh. Because some

221
00:16:05,260 --> 00:16:08,700
people like for them it might not matter very much but for anybody that really wants to know

222
00:16:08,700 --> 00:16:11,340
what's going on behind the scenes I think they should. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh.

223
00:16:11,340 --> 00:16:11,720
Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh.

224
00:16:11,720 --> 00:16:12,560
Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Oh this is like an easy way to

225
00:16:12,560 --> 00:16:17,420
present that without having you know throwing the same thing at absolutely everybody. It's a

226
00:16:17,420 --> 00:16:24,440
good way to distinguish that. Uh. Cool. Uh. Last time we also kind of covered Peerio. It's

227
00:16:24,440 --> 00:16:30,500
changed pretty radically since then. Uh. The problems were the last time were that it felt a

228
00:16:30,500 --> 00:16:34,340
lot like email because of that people had certain assumptions on like being able to send a

229
00:16:34,340 --> 00:16:39,240
message to a contact without adding them first. Whereas now it because the design is so

230
00:16:39,240 --> 00:16:41,320
centered it's basically like slack or like any other like kind of like that kind of like

231
00:16:41,320 --> 00:16:47,180
like 800 chat apps that are out there now. Um, people assume that you have to be added to a

232
00:16:47,180 --> 00:16:51,140
room or that you have to add people so that like mental model that people have about the way it

233
00:16:51,140 --> 00:16:56,280
works kind of is more in line with what people are already used to. Uh, which is great. Uh,

234
00:16:56,300 --> 00:16:59,780
oh, something really great about this. The other thing that I mentioned last time is like

235
00:17:00,380 --> 00:17:05,100
period would be one of those things where like it's, it would be tricky to use your test for

236
00:17:05,100 --> 00:17:08,860
because of the fact that you're dealing with the enforcement of a really long passphrase

237
00:17:09,400 --> 00:17:13,880
that's dedicated normally to human memory. And when user testing is done, normally these are

238
00:17:13,880 --> 00:17:17,560
like really short sessions. But in this case, like if you want to test like the strength of

239
00:17:17,560 --> 00:17:21,980
forcing somebody to use a long passphrase and whether they will actually remember it, that has

240
00:17:21,980 --> 00:17:25,440
to be done a little bit differently where you have to like test over time, over a series of

241
00:17:25,440 --> 00:17:31,320
weeks, over a series of months to make sure that they still can. Um, in personal experience at

242
00:17:31,320 --> 00:17:35,840
CryptoParty is that digital security trainings, like people did forget these a lot because it is

243
00:17:35,840 --> 00:17:38,840
a long list of weird words. Um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so,

244
00:17:38,840 --> 00:17:40,560
um, so, um, so, um, so, um, so, um, so, um, so, so, um, so, um, so, um, so, um, so, um, so, um, so, um, and

245
00:17:40,560 --> 00:17:40,860
so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um,

246
00:17:40,860 --> 00:17:43,660
so, it was a king and people could use to log in. So they would never have to remember it. But

247
00:17:43,660 --> 00:17:47,000
then if they changed computers or did something else that would like, oh, no, I have to remember

248
00:17:47,000 --> 00:17:52,380
my long passphrases again. And they don't. It's a common misconception that like if you use words

249
00:17:52,380 --> 00:17:56,780
that will be memorable, that's not always the case. But what they did actually like kind of saw

250
00:17:56,780 --> 00:18:03,020
the same behaviors in their own user testing eventually. And they created a new word list.

251
00:18:03,120 --> 00:18:06,740
So rather than using kind of the common word lists that are out there for different languages,

252
00:18:07,000 --> 00:18:13,180
the way they created a word list that was actually memorable was they would look at,

253
00:18:13,220 --> 00:18:19,420
like, the way more people have, like, written language thrown at them. So going into the

254
00:18:19,420 --> 00:18:24,560
fact that, like, a lot of humanity isn't, like, super into reading or at least, like,

255
00:18:24,560 --> 00:18:29,320
hardcore, like, heavy book reading. Like, what do a lot of people watch is movies. So

256
00:18:29,320 --> 00:18:32,460
what if we just took the subtitles from movies and created a word list out of that for each

257
00:18:32,460 --> 00:18:37,040
language? So that's basically what they did. So we ended up with, like, very common words

258
00:18:37,040 --> 00:18:45,380
that people recognize and know. And, you know, maybe has less, you know, there's a bigger

259
00:18:45,380 --> 00:18:49,980
set of words. So it's, like, fewer amount of combinations. But even doing things like

260
00:18:49,980 --> 00:18:54,080
requiring an extra word of more common words can help mitigate that. So there's, like, kind

261
00:18:54,080 --> 00:18:54,540
of weird...

262
00:18:54,540 --> 00:19:03,580
different ways of approaching things that has an effect on stuff. So the other thing that is

263
00:19:04,140 --> 00:19:08,700
something to test about that is a little bit different than other testing situations is

264
00:19:08,700 --> 00:19:14,300
testing for worst-case scenarios. So in this case, have any... are any of you from the

265
00:19:14,300 --> 00:19:18,440
Northeast Corridor, the, like, Accela part of the country, like, Boston, New York,

266
00:19:18,640 --> 00:19:23,560
Washington? Okay. You know my fields then. Have any of you used the, like, garbage Amtrak Wi-Fi?

267
00:19:25,700 --> 00:19:32,760
Okay. Yeah. Okay. Yeah. Somebody... somebody will get this. The, uh, so Amtrak, uh, you know,

268
00:19:32,900 --> 00:19:38,840
it's what we use to get around the East Coast. But there's free Wi-Fi. It's... It's very slow and

269
00:19:38,840 --> 00:19:45,740
intermittent, and it drops a lot. So there's a lot... there's a very, like, kind of situation that

270
00:19:45,740 --> 00:19:50,440
I think... And this is a known issue where you'll see people tweeting about it constantly. It's like,

271
00:19:50,500 --> 00:19:53,540
what does the Amtrak Wi-Fi suck? Uh... It's... it's... it's a known issue. Uh... The, it's... it's a

272
00:19:54,420 --> 00:19:57,980
And you have to, like, keep that in mind when you're testing things that depend on the

273
00:19:57,980 --> 00:20:03,420
Internet, for example, or even whether certain aspects of a network are blocked, like Tor.

274
00:20:04,320 --> 00:20:12,020
So this is onionashare. This is an older version. And this is an example from the real world

275
00:20:12,020 --> 00:20:16,960
of, like, me sharing something with somebody on a broadband Internet connection somewhere

276
00:20:16,960 --> 00:20:22,020
else in the world. But I'm running this as a server, so I'm running this, like, you

277
00:20:22,020 --> 00:20:28,620
know, desktop app. And when I first did this, like, the Wi-Fi was fine. The Internet was

278
00:20:28,620 --> 00:20:32,780
fine. I was, like, paying things. I had an IP address. It was all good. But then, of

279
00:20:32,780 --> 00:20:38,320
course, the Wi-Fi dropped halfway between, like, Maryland and Delaware. And it doesn't

280
00:20:38,320 --> 00:20:42,580
reflect that. It basically just has the same, like, green, like, everything's fine. It's

281
00:20:42,580 --> 00:20:47,840
working. And, of course, it's not. And so there's just, like, back and forth outside of

282
00:20:47,840 --> 00:20:51,860
that band of, like, what's going on. There's a lot of confusion. And that's the kind of

283
00:20:51,860 --> 00:20:52,000
thing that I'm trying to do. And I'm trying to do it in a different way. I'm trying to

284
00:20:52,000 --> 00:20:55,680
do something you want to avoid. Some apps do this better than others. Some will have, like,

285
00:20:55,700 --> 00:20:59,500
an offline messaging thing. It will be, like, you seem to be offline. So there's, like, a

286
00:20:59,500 --> 00:21:02,500
process behind the scenes that will just check to see whether it can connect to the Internet,

287
00:21:02,600 --> 00:21:06,620
usually by pinging whatever API server it's connecting to behind the scenes. In this case,

288
00:21:06,640 --> 00:21:09,780
there's no API server, but there's, like, other things that you can check to see, like, do I

289
00:21:09,780 --> 00:21:13,840
have Internet? The other thing in this case, which is unique to Uninashare, is, like, do I

290
00:21:13,840 --> 00:21:17,520
have Tor? Because there's some networks that block Tor. And being able to know that the reason

291
00:21:17,520 --> 00:21:21,720
why this doesn't work is because Tor is blocked is something that you want to let

292
00:21:21,720 --> 00:21:28,040
users know so they're not guessing. So that's something to keep in mind. Different ways to do

293
00:21:28,040 --> 00:21:32,260
this. Slack does this as well. But, yeah, and this is what kind of the other side looks like.

294
00:21:32,340 --> 00:21:38,180
And then this is what life on the northeast region looks like. And, yeah, oh, that's the

295
00:21:38,180 --> 00:21:41,980
image I was trying to share. This is very important. I was very sad I wasn't able to share

296
00:21:41,980 --> 00:21:46,520
this. But there are a lot of improvements being done. So just, like, as I'm critiquing these

297
00:21:46,520 --> 00:21:51,540
things, like, know behind the scenes that they all are improving, basically. This is the

298
00:21:51,540 --> 00:22:00,140
kind of design issue on that. Which brings me to another point of how I've been able to kind of

299
00:22:00,140 --> 00:22:05,700
approach design issues with different projects. A lot of commercial projects will have kind of a

300
00:22:05,700 --> 00:22:09,920
full set of, well, not a lot. Some will have a full set of teams made up of, like, a product

301
00:22:09,920 --> 00:22:17,900
designer, you know, a product manager, a QA team, other folks, a security person. Like, with a lot

302
00:22:17,900 --> 00:22:21,500
of this stuff, it's kind of open source software. It's very scrappy. It starts off with a real

303
00:22:21,500 --> 00:22:25,940
really small team. And, you know, they're not hiring anybody. So there's no dedicated designer.

304
00:22:26,120 --> 00:22:31,420
So, like, how do people get better at these things? And some people have, like, strived to just,

305
00:22:31,420 --> 00:22:36,800
like, make design a focus of theirs. And I'm going to talk about one example of that. So, in

306
00:22:36,800 --> 00:22:43,580
this case, Tails, which is the incognito live, like, that live Linux system that has Tor baked

307
00:22:43,580 --> 00:22:50,220
into it, is something that we worked on a workshop on at Freeman Press Foundation last year with a

308
00:22:50,220 --> 00:22:54,000
bunch of folks that were not from the tech world at all. They were here for the Laura Poitras

309
00:22:54,000 --> 00:23:02,700
exhibition at AstroNoise at the Whitney Museum. So, basically, there were a few issues that we ran

310
00:23:02,700 --> 00:23:08,840
into. I wrote them down and I basically just submitted it to a bug tracker as if it were, like,

311
00:23:08,920 --> 00:23:16,000
you know, a software bug, a code bug, basically. There's some things that are kind of important

312
00:23:16,780 --> 00:23:20,200
things to think about when developing other software. So, you know, there's a lot of things that

313
00:23:20,200 --> 00:23:28,100
you can do. When you're creating documentation, people, like, might not necessarily see right

314
00:23:28,100 --> 00:23:34,120
away that it's not inside the window or of the window or necessarily see that, like, oh, the

315
00:23:34,120 --> 00:23:38,000
window dressing on this screen shot is different than the one on my desktop. These things are not

316
00:23:38,000 --> 00:23:42,780
always caught right away. So we did something where, like, we noticed that in the instructions to

317
00:23:42,780 --> 00:23:46,660
use the live USB writer for Windows, for example, people were, like, clicking on the web page

318
00:23:46,660 --> 00:23:50,180
screen shot of what it was because it was the exact kind of side of the screen. So, like, we did a lot of

319
00:23:50,180 --> 00:23:52,080
things to make sure that we had the right size dimensions of what the actual thing would be. So

320
00:23:52,080 --> 00:23:58,000
don't do that. Basically make it smaller. That was an easy fix. Naming things counts because

321
00:23:58,000 --> 00:24:03,640
people have different meanings for different words. So every Linux distribution has kind of a

322
00:24:03,640 --> 00:24:09,160
default mode and a failsafe mode. So for all of us coming from the Linux world, which you saw my

323
00:24:09,160 --> 00:24:14,300
Linux desktop, it made sense to me. Everybody else did not know what exactly that meant. So

324
00:24:15,300 --> 00:24:19,480
people saw this because they were using it as a means of, like, safety as far as privacy and what

325
00:24:19,480 --> 00:24:20,160
they associated with it. So, you know, there's a lot of things that you can do to make sure that

326
00:24:20,160 --> 00:24:23,340
it's safe. So they assumed that that was the default mode. That there was an insecure mode, like

327
00:24:23,340 --> 00:24:27,540
there wasn't PGP with, like, unencrypted e-mail, unencrypted e-mail. And they had to, like, go down

328
00:24:27,540 --> 00:24:32,180
one level to failsafe to get into, like, the secure torrified mode. So that's something that we

329
00:24:32,180 --> 00:24:38,740
changed by easily by renaming it. So if you boot tells now, you just see the regular default mode

330
00:24:38,740 --> 00:24:42,440
and then you see a troubleshooting mode. So they know the reason why they would ever want to use

331
00:24:42,440 --> 00:24:48,840
that option and, like, what action there is to do there. So it's very explicit. And we deliberate

332
00:24:48,840 --> 00:24:50,140
on, like, what language to use. And, like, what language to use. And, like, what language to use.

333
00:24:50,140 --> 00:24:55,540
Based on what Microsoft and Apple were using for meaning the same things. Because we really want

334
00:24:55,540 --> 00:25:02,260
to, like, use language that is familiar in different situations in different contexts. So, like,

335
00:25:02,260 --> 00:25:07,060
people will use troubleshoot to talk about other tech troubleshooting problems. So that's

336
00:25:07,060 --> 00:25:11,800
basically where we ended up laying on that. The other thing, too, is just, like, making the

337
00:25:11,800 --> 00:25:18,840
documentation available offline. So back in ‑‑ this was early 2016. There's a link to how

338
00:25:18,840 --> 00:25:20,120
documentation ‑‑ which is what you go to. It's a link to how documentation works. It's a link to

339
00:25:20,120 --> 00:25:23,880
if you want to, like, learn how something works. But what if the reason you're going to the

340
00:25:23,880 --> 00:25:29,360
documentation is because you're having trouble connecting to the Internet? If your docs are

341
00:25:29,360 --> 00:25:34,200
online, you're not going to be able to read them. So in this case, you're booting a live system.

342
00:25:34,420 --> 00:25:38,260
So why not just have them offline and have them live in there? So that's what they did. And that

343
00:25:38,260 --> 00:25:41,600
worked. So people are able to, like, read up on what to do if they can't connect to the Internet,

344
00:25:41,680 --> 00:25:45,240
what could be the problems. Maybe their Wi‑Fi chip isn't working. But it's that way. They can

345
00:25:45,240 --> 00:25:50,100
actually read the docs to see what the problem is. Some things can't be done. Like, if you're

346
00:25:50,120 --> 00:25:55,600
using a Mac, it can't be fixed. So this is some Apple bullshit where if you have a live Linux USB

347
00:25:55,600 --> 00:26:00,180
drive, it'll just show up as Windows because it just assumes that operating systems are just,

348
00:26:00,220 --> 00:26:04,740
like, there's Mac OS X and I guess Windows and that's it. So that's something that we can't fix

349
00:26:04,740 --> 00:26:11,700
the confusion for, unfortunately, at least for Mac users. And so with Intel you have the option

350
00:26:11,700 --> 00:26:18,360
of creating a persistent storage, like, basically just like a looks partition. This is one of

351
00:26:18,360 --> 00:26:20,100
those things where, like, people don't necessarily know what they're doing. They don't know how to

352
00:26:20,100 --> 00:26:22,520
do it. They don't necessarily know that they would have to reboot to be able to, like, start saving

353
00:26:22,520 --> 00:26:27,700
things there and have them stay in there and persist there. So just, like, having a note of that

354
00:26:27,700 --> 00:26:33,640
within the, like, you know, the wizard that they set up for creating a persistent volume is

355
00:26:33,640 --> 00:26:36,960
helpful. But I think it should go a little bit further. I think it actually should just have,

356
00:26:37,020 --> 00:26:40,400
like, immediate button to just reboot right away because that should be the next action so they

357
00:26:40,400 --> 00:26:44,240
don't commit that to human memory and depend on human memory to remember that they haven't rebooted

358
00:26:44,240 --> 00:26:46,880
yet to do that. Just to make it that much easier.

359
00:26:49,160 --> 00:26:55,360
So this is a new thing. Like, there's not really a lot of people that I know that report design

360
00:26:55,360 --> 00:27:00,600
bugs. There's not a lot of designers in open source in general, which is a problem. And I think

361
00:27:00,600 --> 00:27:05,680
that's more of a kind of difference in, like, the kind of experiences that people have as design

362
00:27:05,680 --> 00:27:11,400
and what they associate with free or volunteer work versus what we do as developers when we, like,

363
00:27:11,400 --> 00:27:14,800
work on open source. We're, like, if we're working on open source, it's kind of just community

364
00:27:14,800 --> 00:27:16,640
and we're just working on a project together.

365
00:27:17,500 --> 00:27:22,240
Whereas design, like, the neural network of a designer and a developer will be, like, basically

366
00:27:22,240 --> 00:27:26,500
trained on different data sets where you have, like, experiences of, like, voluntarily working with other

367
00:27:26,500 --> 00:27:31,740
people. And then the designer kind of data set where it's, like, oh, remember when you did that work

368
00:27:31,740 --> 00:27:35,360
for free? It's because that asshole, like, ripped you off. And, like, no lawyer would let you take

369
00:27:35,360 --> 00:27:42,600
them to small claims court because it was, like, too small to be worth their time. So people have

370
00:27:42,600 --> 00:27:46,380
different expectations on what that means. So it's one of those things that, like, yeah, it would be

371
00:27:46,880 --> 00:27:53,900
great if more designers were, like, just start working on stuff on open source. But for now, this is kind of the

372
00:27:53,900 --> 00:27:58,900
closest way I've, like, asked designers to participate because it's worked out for me pretty well as far as

373
00:27:58,900 --> 00:28:03,940
with Tails, with Signal, with Perio. It's just basically just adding something to their bug tracker and

374
00:28:03,940 --> 00:28:09,080
being, like, this is the current behavior. This is what we want the behavior to be. These are some design

375
00:28:09,080 --> 00:28:14,160
suggestions. This is the reference to, like, what I am, like, backing up this assumption with based on

376
00:28:14,160 --> 00:28:16,860
the human interface guidelines of the operating systems that you're trying to build. So, like, I'm, like,

377
00:28:16,880 --> 00:28:21,400
targeting, here's some screenshots and here's the user stories of people that were confused by it.

378
00:28:23,960 --> 00:28:29,320
And there's also the consideration of just, like, who's actually going to do that. Certain systems for

379
00:28:29,320 --> 00:28:34,300
doing that are easier than others. For example, for doing that for onion share, for example, that's a

380
00:28:34,300 --> 00:28:39,000
GitHub ticket. That's super easy to use. Other platforms, like the Tor project, have their own

381
00:28:39,000 --> 00:28:44,320
specific bug tracker and they have, you know, you, of course, want to search to see whether this has

382
00:28:44,320 --> 00:28:46,860
already been discussed. So you're not just, like, re-opening or making it do what it's supposed to do.

383
00:28:46,880 --> 00:28:52,080
It's a duplicate issue. And if you have an archive of, like, you know, six years' worth of bugs and bug

384
00:28:52,080 --> 00:28:57,460
reports and discussions, that adds up over time. That's really hard to, like, really grep, especially if,

385
00:28:57,520 --> 00:29:01,740
like, the search functionality of the bug tracker that you're using is a little bit more of a

386
00:29:01,740 --> 00:29:07,240
challenge or time consuming to use. So the bug tracker is something that is also factors into a

387
00:29:07,240 --> 00:29:13,880
particular kind of user experience that has to be taken in mind as well. Cool. So, yeah, and that's

388
00:29:13,880 --> 00:29:16,860
Queen's Comfort. If you're ever in New York for Hope or whatever, you should definitely check out the

389
00:29:16,860 --> 00:29:20,720
Google search. If you're ever in New York for whatever, like, take the N train to Astoria. It's,

390
00:29:20,800 --> 00:29:29,640
like, if you like grease and butter and waffles, this is, like, heaven slash Valhalla of that. It's

391
00:29:29,640 --> 00:29:37,800
pretty great. Cool. So that's kind of a quick wrap up talk. I wanted to, like, create as much time

392
00:29:37,800 --> 00:29:46,840
as I could for Q&A. And, you know, any questions you have as far as what people see as far as, like,

393
00:29:46,840 --> 00:29:52,540
using all these tools that we use or any ideas you have on, like, what makes sense for different

394
00:29:53,140 --> 00:30:01,020
projects that you're working on, you have my ear on any design advice. So, yeah, microphones in the

395
00:30:01,020 --> 00:30:03,560
center are presumably turned on. So, cool.