Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I'm building an online store that has many features and functions.

Whenever a user interacts with the site a notification is shown.

These notifications should give the user a response to his action and tell him whether the action was successful or not and also if it wasn't successful tell him what went wrong.

I also considered and implemented control functions that check if the user tries to harm the application, other users or the database. If this is the case I would like to give the user a notification that shows him that I do know what he's doing and leave him with the feeling that he should rather stop now because "we see and know every step he takes".

Examples:

  • Contact Form: The user has to fill in his information such as his email address, full name and a message,

    • if he doesn't fill in a certain field of the form the notification "please fill in your [name of the empty field]"
    • if the user leaves all the fields empty and just hits the submit button the notification says "please don't send us any empty contact forms"
  • Feedback Form: The user has to write a message, email address & name are optional

    • if he doesn't fill in the message field, he'll get the notification "please write a message"
    • if he fills in the email field with an invalid email address (e.g. asdf) the notification says "Either give us a real email address or just leave the field empty"
  • Deleting profile information: The user can save information about himself. He's able to edit and delete his profile

    • if the user tries to delete a profile that does not belong to him (which means manually entering a URL with an id that is not of one of his profiles) the notification says "you can't delete other users' profiles, don't try this again!"
  • etc. ...

I like the nature of these notification messages but am not sure whether they are appropriate and useful, especially if for any reason a user that hasn't really tried to harm the system gets to read a rather impolite message.

Do you consider such notification messages useful?

What do you think could be problems I have to face if I use this kind of notification messages?

What would be a good alternative to such notification messages?


Addendum

First: Thank you for your time, thoughts and help!

I'd like to add, that the given examples are by no means all notification messages/places where notifications occur. I do know, that (as msparer and Lego Stormtroopers have pointed out) the described behaviour is not actually trolling. Still there are many other functions where trolls could have a little fling (chat, product review, support, etc.).

I fully agree with what Racheet said, that there is no actual benefit in blaming the user, especially if someone accidentally triggers a notification message that was designed for malicious users.

I also absolutely love how the_lotus handles trolls and will definitely create and implement something similar!

share|improve this question
19  
It seems didactic to me and I fully agree with Racheet: there is absolutely no upside for either the user nor the owner of the website. It even may provoke malicious users to go through greater lengths breaking your site. But why do you want to do this? Because, although your method doesn't sound like a good idea, the reason behind it may very well be legitimate. –  Ruudt Aug 6 at 12:00
33  
Don't feed the Troll, never :) –  Apolo Aug 6 at 14:24
21  
In my systems, if I can detect that someone is actually trolling I let them in their own little world (ex: Pretend the form was submitted). Some of my system have an internal reputation system for IP and Users for admin to look at. I've seen some forum actually letting the user post their message but only them can see it, so to them, it looks like no one is giving them attention. –  the_lotus Aug 6 at 15:11
12  
I wonder why it is even possible to request an action to another user if it can only apply to the current user, i.e. why you have a URL format of /{username}/delete instead of /deleteme. –  nmclean Aug 6 at 15:55
22  
None of those actions sound like trolling. That's either a user not knowing what they are doing or a malicious hacker. Trolling would be filling the content form with My Little Pony Fanfic or ASCII art of well... use your imagination. –  Lego Stormtroopr Aug 6 at 23:33

7 Answers 7

Don't write error messages blaming the user. There is no actual benefit to you from doing this.

In the event that someone accidentally triggers these error messages, you damage your relationship with them. Even if you do manage to tell a single malicious user that you know they're malicious, it isn't going to make them like you any better.

All you're doing is damaging your relationships with honest users of your site, in order to better damage your relationships with malicious users of your site.

There are no upsides for either you, or your users.

share|improve this answer
49  
"don't feed the troll". Your best chance is to bore him: if you do something he finds hilarious he will keep on trolling. It is not like you have any chance to scare him away anyway (source: my experience as a troll) –  pqnet Aug 6 at 12:32
8  
I agree. It's awkward and rude if these messages are triggered by accident, it's an empty threat ("don't try it again" or what?) and it doesn't contribute to the application's secuirty (anyone seriously aiming to harm your application won't be deterred or impressed by the existence of a regex that validates the form of an email address). –  Theodoros Chatzigiannakis Aug 6 at 12:33
11  
"All you're doing is damaging your relationships with honest users of your site, in order to better damage your relationships with malicious users of your site." Excellent. –  ABMagil Aug 6 at 13:36
1  
+1, came here to say this. Not to mention that any real malicious user that's targeting your site is not going care about what the error message says. –  grover5 Aug 6 at 13:46
2  
You should add to this that it's just better to give generic messages. If the user manually edits a URL to have an ID that they don't have access to, just give them a 404 page because to that user, that page does not exist. There's no need to let them know that the page does exist, just not for them. –  nzifnab Aug 8 at 16:31

The first thing you have to find out is, if it's really a troll. Your Contact Form and Feedback Form examples have nothing to do with trolls. It's just a feedback message. The third example sounds like a hacker or script kiddie who's trying something, also no troll.

So for the first two examples, choose a error message that tells what to do, but does not blame the user. For the third one, I'd suggest to silently redirect to another page, as tampering with URLs doesn't sound like a normal use case and doesn't need dedicated user feedback.

But as your question is about trolls, some advice about trolls (I deal with them a lot).

Recognising trolls

First of all it's important to find out if it's really a troll you're dealing with. E.g. a comment that looks suspicious and/or malicious could also be a new user that doesn't know how to use the system.

"Most trolls are sad people, living their lonely lives vicariously through those they see as strong and successful"

Disrupting stable systems and upsetting people gives them the illusion of power. So pay attention to users who insult without reason or deliberately post wrong/insulting comments.

If you're not sure if you are dealing with a troll, it is OK to ask a user about a strange comment/contribution. But always be polite! If you receive a rude answer, then ignore it and don't respond to it by any means!

What NOT to do

Don't feed the troll!

The worst thing you can do is to tell trolls what you really think about them. That's like punishing a masochist. It'll just motivate a troll to carry on trolling. A troll's sole intention is to get attention and to upset other people. So no matter how angry you are with a troll (and believe me, I'd send big guys with baseball bats to their homes if I could) – just don't show it to them.

What to do

If there's a troll, the best thing that can happen – apart from just going away – is that they always use the same user name. This allows you to keep an eye on them. So it wouldn't be wise to block the user name, as this is exactly what they're aiming for. As mentioned, they're craving for attention. So ignoring and deleting the contributions, best automatically after a given time is the best option.

Further reading:

share|improve this answer

First of all, as I stated in my comment, none of those actions are "trolling". If the are malicious they are "hacking" or "cracking" or what ever verb you wish to use there - but not trolling.

Treat hackers like everyone else, give them the same information you would share with anyone. Looking at your examples:

Contact Form:

  • If the user leaves everything empty, politely inform them of this: We value your feedback, but you've left the feedback field empty. Please add some feedback and we can work on improving our service.

Feedback Form: Your responses look fine here.

Deleting profile information (or doing any action that requires additional permissions):

  • "I'm sorry your account doesn't have the permissions to [delete another users account]. Please contact an administrator if you think your account needs additional privileges.

Its important to note here we have said two things:

  1. We have a privileges and permissions system set up, so you need to meet specific requirements to perform specific actions - this should make a hacker rethink their target
  2. You (the user) isn't at fault, your account may not be set up correctly, but you may actually need to perform this action and we have given you a solution to this.

At the end of the day, consider crackers or trolls like every other user, and give them no more information than you would give anyone else. Every additional piece of information you give a hacker is a piece of information they didn't have before.

As they say kill them with kindness, there are only so many times a troll will see "I'm afraid I can't let you do that Dave" before they give up.

share|improve this answer
4  
Deleting profile information: "I'm sorry you entered your account number incorrectly". That's correct for the genuine user making a mistake, and doesn't give a hacker additional information. –  gnasher729 Aug 7 at 9:58

For your responses in your user interface, assume that the user is a genuine user who is making a mistake. They are the only targets for your user interface. For security reason, make sure that you don't give any hints to malicious users how to get around security. For example, say things like "your username or password is incorrect" and not "your password is incorrect" because you don't want to give a hacker the information that they guessed a username correctly.

Your company doesn't make money from trolls and hackers, so you shouldn't waste your time designing a user interface for them. And every time you mistake a genuine user for a hacker or troll, you have the opportunity to lose a customer, or worse annoy them so much that they warn people off your company. It's even possible your response makes them think your site is hacked and dangerous.

You gave an example of trying to delete the account of a different user. I have some big security concerns here. Of course a user can enter data that should refer to his account incorrectly (and you can tell them). It should be absolutely impossible to enter data referring to another account by accident. If a user can do that then it seems your site has a problem (not in the user interface design, but elsewhere).

share|improve this answer
    
no user can delete any accounts except their own. users can only delete informational profiles (e.g. body measurements). the id for the profile that should be deleted is submitted via URL, therefore a malicious user could try to manually enter a URL with a random id. if you still have (big) security concerns I would like to elaborate on this topic. –  dabe Aug 7 at 10:36

To answer the question in the title: don't. Treat data trolling (invalid data input) for what it is: invalid data input.

The simplest way to keep people from 'trolling'? Don't allow users to break things. If you do, users will play around when they really shouldn't.

For the form UI: don't allow the user to click submit (grey it out) unless all forms are filled. Make it clear that all forms must be filled (make them red..?).

For the backend: make sure requests are authorized, sanitized, and necessary. For requests to /users/{username}/delete, make sure that {username} == the username attached to the user's session cookie. Make a very generic error message (as mentioned in Francisco's answer, where he uses boring/long error messages to frustrate trolls. To tie into the form issue, make the server sanitize requests. If somebody sends an empty form (or invalid data), throw an error.

share|improve this answer
1  
Francisco has deleted his answer, maybe you could supply an example yourself? –  iFreilicht Aug 11 at 9:14
    
Fortunately, Google cached his answer. I added a brief description and changed the link to the cached version. Hope it helps! –  Luke Adams Aug 11 at 15:26

If you have a way of accurately identifying a troll you want him to stop engaging with your website. You have a bunch of options of doing so.

You can increase page loading time. When your website becomes sluggish trolling becomes less fun. Randomly ignoring 10% of the mouse clicks of the user would have a similar effect.

When it comes to user submitted content you can pretend to the troll that he successfully submitted content but hide the content from all other users.

share|improve this answer
    
Of course, only if you can be absolutely sure that it's a troll! –  John Peyton Aug 11 at 14:16

You might also consider this from a security point of view. One or two actions like this from any one person can be a mistake. Repeated attempts are an attack. While I wouldn't take actions that would purposely egg them on ("dude, you'll have to try harder than that to submit a comment!") if you can nail down invalid application requests from one person/source, then lock them out. That's simple to say of course. The details are harder: how long are they locked out, do all invalid actions count the same as others, etc.

See the Mozilla AppSensor project for more info on this approach.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.