[Tails-ux] Secure usability talk at CCCamp

Hey,

>
> sajolida:
> Yesterday I watched a talk from the CCCamp. I didn't expect it to end
> up
> talking in depth about UX but it did. Some stuff in there is
> interesting, some other is less or made my quite skeptical. But some
> issues are definitely connected with meta-discussions that we are
> having
> here or away from keyboards.
>
> The video is here:
> https://media.ccc.de/browse/conferences/camp2015/camp2015-6889-encrypted_email_for_planet_earth.html#video
>

Thanks!! Wouldn't have found this hidden gem on my own :)

>
> Points that resonated with our work to me:
>
> - "Trade-off between education vs. just make it @#*$&#$ work". This
> reminded me of the debate around displayed or hidden "advanced" options
> in the Greeter.
>

Tradeoffs are the real deal. However, the "striving for perfection but
ending up with something not good" is quite an illogical flow. When
that appears to be the case, it is because of fear of/rushing/second
guessing doing things right the first time, or fear of/rushing/second
guessing taking the time to let things settle/rise (think draught
porter/stout in a pint glass). In short, ending up with something not
good as the output of striving for perfection would only be the result
of a panic move and couldn't actually be considered striving for
perfection as much as giving up/settling for less.

In our case, there is the trade-off between a)the two experiences, since
there are balanced ups and downs to each, and b)the trade-off between
time and quality, which is always the case for everything everywhere. A
trajectory is an appropriate visualization of this balance, since too
much eventually becomes a negative. I made one back in the day,
here[0].

An example is the approach we are taking to the content: that a good
interface should allow people to teach themselves (not only how the
interface works, but also how the technology works, in that order, too).
So we need to strike a balance between education and function,
hybridizing the two by making each function self explanatory while still
informative to its function seems the most suitable. This touches on
the highest Tails trade-off, privacy vs usability, since the most
effective way to ensure privacy is understanding the concepts and
changing behavior, but in this case they have to use the tools (Greeter)
to most effectively understand them.

>
> - "Gathering metrics vs. protecting privacy". We've been talking
> about
> that on our website with tchou though we don't have any implementation
> plans.
>

No metrics :) Encourage community participation (though I guess not
though mailing lists :))

>
> - "Test early and test often". Again, this reminded me of our long
> and
> painful process and digressions on the Greeter revamp.
>

Referring to the trajectory[0], the space between Observations and
Concepts is the mass of the work, testing would be at each set of
concepts where observations are made.

But yeah, we need some more testing infrastructure - I have temporarily
recruited a UXpert to assist with patches to the current UI Testing
Guidelines[1] so that we have nothing overlooked.

>
> - "Reliance on standard patterns". Cf. our debate on following or not
> the GNOME (or Mac OS X) guidelines vs creating custom widgets.
> - "Self-reported data is unreliable". Cf. the misunderstanding
> between
> "user testing" and "user inspection" we had with tchou on #8233.
> - "Security personas". We should have a closer look at
> https://medium.com/@gusandrews/user-personas-for-privacy-and-security-a8b35ae5a63b
> and compare against our top-secret personas.
>

We have user personas?

>
> - "Startup techniques". Clearly connects with the conference of tchou
> at Pas Sage en Seine but from a very different point of view. I like
> his
> best :)
>

Missed this :(

> - I got a version of Lean UX (haven't read it):
> http://shop.oreilly.com/product/0636920021827.do. Ask for it if you're
> interested.
>

I am; please share :)

>
> - "A-B testing". We already mentioned this with tchou and I'd fine it
> interesting to brainstorm on how and where we could apply this.
>

This is comparing concepts. We could do this now with the Greeter, most
appropriately, comparing which starting point is most universally
preferable, the Guided or Self-guided flow, since logic can't take us
any further on its own.

We could also do this with the web assistant for download/install/clone
cases. The issue I see for us is that this takes time to do this
full-force, but when we arrive at designation pickles (like baseball)
this micro-testing could be of great benefit.

Overall, there were a lot of anecdotes, contradictions, and firm
beliefs, but the recommended diversity in research and clarity in
interfaces is spot on and couldn't be emphasized more. The biggest
correlation made was connecting usability to having a dedicated HuX
person(s), and I agree.

I enjoyed this a bunch, thanks!

Wordlife,
Spencer

[0]: DesignTrajectory.png
[1]: https://tails.boum.org/contribute/how/user_interface/testing/