There are permission request boxes such as this one, or requests from other users as per online social networking sites. Are there any studies that show people becoming jaded of dialogue boxes of any sort?
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It only takes a minute to sign up.Sign up to join this community
Yes, there is extensive research on this question available in the literature on usable security, and they have found that users do indeed become jaded. This is an important challenge for making security usable: sometimes developers think, if in doubt, just throw in another warning dialog; but the research literature shows that this is a bad idea.
References. Here are some examples of work in the literature:
S. Motiee, K. Hawkey, and K. Beznosov. Do Windows Users Follow the Principle of Least Privilege? Investigating User Account Control Practices. Symposium on Usable Privacy and Security (SOUPS), 2010.
N. Good, R. Dhamija, J. Grossklags, S. Aronovitz, D. Thaw, D. Mulligan, and J. Konstan. Stopping spyware at the gate: A user study of privacy, notice and spyware. Symposium On Usable Privacy and Security (SOUPS), 2005.
R. Bohme and S. Kopsell. Trained to accept? A field experiment on consent dialogs. CHI, 2010.
R. Bohme and J. Grossklags. The Security Cost of Cheap User Interaction. New Security Paradigms Workshop (NSPW), 2011.
J. Sunshine, S. Egelman, H. Almuhimedi, N. Atri, and L. F. Cranor. Crying Wolf: An Empirical Study of SSL Warning Effectiveness. USENIX Security Symposium, 2009.
S. Egelman, L. F. Cranor, and J. Hong. You’ve been warned: An empirical study of the effectiveness of web browser phishing warnings. CHI 2008.
L. Cranor. A Framework for Reasoning About the Human in the Loop. Usability, Psychology and Security 2008.
Microsoft conducted a lot of testing into the User Account Control (UAC) between Windows Vista (when it was introduced) and Windows 7. They have a post about this on their msdn blogs:
We have learned from our customers participating in the Customer Experience Improvement Program, Windows Feedback Panel, user surveys, user in field testing, and in house usability testing that the benefit of the information provided by the UAC consent dialog decreases substantially as the number of notifications increases. So for the general population, we know we have to present only key information to avoid the reflex to “answer yes”.
The article goes on to discuss some of their AB testing that they went through when making decisions on how to handle permissions dialog messages in Windows 7.
In making our choice for the default setting for the Windows 7 beta we monitored the behavior of two groups of regular people running the M3 build. Half were set to “Notify me only when…” and half to “Always Notify.” We analyzed the results and attitudes of these people to inform our choice. This study, along with our data from the Customer Experience Improvement Program, Windows Feedback Panel, user surveys, and in house usability testing, informed our choice for the beta, and informed the way we want to use telemetry from the beta to validate our final choice for the setting.
A key metric that came out of the study was the threshold of two prompts during a session. (A session is the time from power up to power down, or a day, whichever is shorter.) If people see more than two prompts in a session they feel that the prompts are irritating and interfering with their use of the computer. In comparing the two groups we found that the group with the “Always Notify” setting was nearly four times as likely to have sessions with more than two prompts (a 1 in 6.7 chance vs a 1 in 24 chance). We gathered the statistic for how many people in the sample had malware make it onto their machine (as measured by defender cleaning) and found there was no meaningful difference in malware infestation rates between the two groups. We will continue to collect data during the beta to see if these results hold true in a much broader study.
Unfortunately they haven't published their test results (as far as I can see), so as with any study that references data that isn't published may need to be taken with a grain of salt. However the article (and the links to previous articles mentioned within that post) make very interesting reading.
Dialog boxes are needed. In the old HCI thinking, a user interface is essentially a dialog between a human, and a computer.
However, handling of the dialog boxes can become habitual. The typical example is Word or any similar document editor: when you close an unsaved document, usually, you don't want to save it. In those exceptional times when you actually want to save it, you're prone to click "don't save" anyway.
Therefore, it is a recommended best practice to avoid opening dialog boxes often. Provide forgiveness instead of asking for confirmation: provide a way so that the user can undo. If you look at document editors on iOS (Pages, or OmniOutliner), they don't have confirmation dialogs at all, and I guess the Lion version of Pages doesn't have it either.
Also, the users are sometimes not able to comprehend the situation in question. Like, in this case, I bet an average user doesn't really know, what "Microsoft Windows Component Publisher" means. There is no meaningful action in this case from the view of the user.
In other cases, the dialog box doesn't tell the user what can he do, what would be the result of each of the choices, and how would the user benefit from those possible futures. Always provide the right context, and make the options always clear from the users' perspective.
The users are always trying to achieve a goal. If the goal is to remove an application, they do whatever it takes to remove the application, even if a dialog box tells them it also removes their whole windows installation, publishes their nasty pictures on the internet, and sell their soul on eBay.
Together with this, and the habituality of choosing a default option, it's rather discouraged to do dialog boxes most of the time.
I'll grab the studies for you, and edit this answer in a moment, just couldn't find it at Nielsen (useit.com - albeit I'm sure it's there), but I have a few UX books lying around here.
Edit: Unfortunately, I didn't find the usual psychologic journal stuff about this,as this has been a known fact since the eighties, and even writers from the nineties were too lazy to cite these studies correctly.
I could also quote the Apple Human Interface Guidelines (or iOS guidelines) and perhaps also the Windows Interface Guidelines, but they are about practical issues. Also I grabbed two other UX books and I could grab a 90s edition of SEPA (Software Engineering: A Practitioners' Approach), where I remember there was the 10 commandment of user interfaces, that was an often-quoted UI rule-of-thumb guideline, but I don't think I'd find its reference.
All in all, it seems this is something that we understood for 30 years, and everyone is just too lazy to back up their claim. Perhaps it is this way because everyone knows from their private life how easy is to make such mistakes, and it is the most easily tested thing in experimental settings.
As for what to do instead of error boxes, read Raskins' book, or Norman's book. As for looking at how an alert-less application flow looks like,look at Google Docs or Lion / iOS 5 versions of Pages.
Sorry, I couldn't find it, it seems even I just remember that this is how it should be done and these are the reasons, but I can't find in my library where did it actually come from.