Should I show the troll that I know he's trolling?

Question

I'm building an online store that has many features and functions.

Whenever a user interacts with the site a notification is shown.

These notifications should give the user a response to his action and tell him whether the action was successful or not and also if it wasn't successful tell him what went wrong.

I also considered and implemented control functions that check if the user tries to harm the application, other users or the database. If this is the case I would like to give the user a notification that shows him that I do know what he's doing and leave him with the feeling that he should rather stop now because "we see and know every step he takes".

Examples:

• Contact Form: The user has to fill in his information such as his email address, full name and a message,

  • if he doesn't fill in a certain field of the form the notification "please fill in your [name of the empty field]"
  • if the user leaves all the fields empty and just hits the submit button the notification says "please don't send us any empty contact forms"

• Feedback Form: The user has to write a message, email address & name are optional

  • if he doesn't fill in the message field, he'll get the notification "please write a message"
  • if he fills in the email field with an invalid email address (e.g. asdf) the notification says "Either give us a real email address or just leave the field empty"

• Deleting profile information: The user can save information about himself. He's able to edit and delete his profile

  • if the user tries to delete a profile that does not belong to him the notification says "you can't delete other users' profiles, don't try this again!"

• etc. ...

I like the nature of these notification messages but am not sure whether they are appropriate and useful, especially if for any reason a user that hasn't really tried to harm the system gets to read a rather impolite message.

Do you consider such notification messages useful?

What do you think could be problems I have to face if I use this kind of notification messages?

What would be a good alternative to such notification messages?

---

Addendum

First: Thank you for your time, thoughts and help!

I'd like to add, that the given examples are by no means all notification messages/places where notifications occur. I do know, that (as msparer and Lego Stormtroopers have pointed out) the described behaviour is not actually trolling. Still there are many other functions where trolls could have a little fling (chat, product review, support, etc.).

I fully agree with what Racheet said, that there is no actual benefit in blaming the user, especially if someone accidentally triggers a notification message that was designed for malicious users.

I also absolutely love how the_lotus handles trolls and will definitely create and implement something similar!

Answer 1

Don't write error messages blaming the user. There is no actual benefit to you from doing this.

In the event that someone accidentally triggers these error messages, you damage your relationship with them. Even if you do manage to tell a single malicious user that you know they're malicious, it isn't going to make them like you any better.

All you're doing is damaging your relationships with honest users of your site, in order to better damage your relationships with malicious users of your site.

There are no upsides for either you, or your users.

Answer 2

The first thing you have to find out is, if it's really a troll. Your Contact Form and Feedback Form examples have nothing to do with trolls. It's just a feedback message. The third example sounds like a hacker or script kiddie who's trying something, also no troll.

So for the first two examples, choose a error message that tells what to do, but does not blame the user. For the third one, I'd suggest to silently redirect to another page, as tampering with URLs doesn't sound like a normal use case and doesn't need dedicated user feedback.

But as your question is about trolls, some advice about trolls (I deal with them a lot).

Recognising trolls

First of all it's important to find out if it's really a troll you're dealing with. E.g. a comment that looks suspicious and/or malicious could also be a new user that doesn't know how to use the system.

"Most trolls are sad people, living their lonely lives vicariously through those they see as strong and successful"

Disrupting stable systems and upsetting people gives them the illusion of power. So pay attention to users who insult without reason or deliberately post wrong/insulting comments.

If you're not sure if you are dealing with a troll, it is OK to ask a user about a strange comment/contribution. But always be polite! If you receive a rude answer, then ignore it and don't respond to it by any means!

What NOT to do

Don't feed the troll!

The worst thing you can do is to tell trolls what you really think about them. That's like punishing a masochist. It'll just motivate a troll to carry on trolling. A troll's sole intention is to get attention and to upset other people. So no matter how angry you are with a troll (and believe me, I'd send big guys with baseball bats to their homes if I could) – just don't show it to them.

What to do

If there's a troll, the best thing that can happen – apart from just going away – is that they always use the same user name. This allows you to keep an eye on them. So it wouldn't be wise to block the user name, as this is exactly what they're aiming for. As mentioned, they're craving for attention. So ignoring and deleting the contributions, best automatically after a given time is the best option.

Further reading:

• Internet Trolls
• How to handle a troll

Answer 3

First of all, as I stated in my comment, none of those actions are "trolling". If the are malicious they are "hacking" or "cracking" or what ever verb you wish to use there - but not trolling.

Treat hackers like everyone else, give them the same information you would share with anyone. Looking at your examples:

Contact Form:

• If the user leaves everything empty, politely inform them of this: We value your feedback, but you've left the feedback field empty. Please add some feedback and we can work on improving our service.

Feedback Form: Your responses look fine here.

Deleting profile information (or doing any action that requires additional permissions):

• "I'm sorry your account doesn't have the permissions to [delete another users account]. Please contact an administrator if you think your account needs additional privileges.

Its important to note here we have said two things:

1. We have a privileges and permissions system set up, so you need to meet specific requirements to perform specific actions - this should make a hacker rethink their target
2. You (the user) isn't at fault, your account may not be set up correctly, but you may actually need to perform this action and we have given you a solution to this.

At the end of the day, consider crackers or trolls like every other user, and give them no more information than you would give anyone else. Every additional piece of information you give a hacker is a piece of information they didn't have before.

As they say kill them with kindness, there are only so many times a troll will see "I'm afraid I can't let you do that Dave" before they give up.

Answer 4

For your responses in your user interface, assume that the user is a genuine user who is making a mistake. They are the only targets for your user interface. For security reason, make sure that you don't give any hints to malicious users how to get around security. For example, say things like "your username or password is incorrect" and not "your password is incorrect" because you don't want to give a hacker the information that they guessed a username correctly.

Your company doesn't make money from trolls and hackers, so you shouldn't waste your time designing a user interface for them. And every time you mistake a genuine user for a hacker or troll, you have the opportunity to lose a customer, or worse annoy them so much that they warn people off your company. It's even possible your response makes them think your site is hacked and dangerous.

You gave an example of trying to delete the account of a different user. I have some big security concerns here. Of course a user can enter data that should refer to his account incorrectly (and you can tell them). It should be absolutely impossible to enter data referring to another account by accident. If a user can do that then it seems your site has a problem (not in the user interface design, but elsewhere).

Answer 5

To answer the question in the title: don't. Treat data trolling (invalid data input) for what it is: invalid data input.

The simplest way to keep people from 'trolling'? Don't allow users to break things. If you do, users will play around when they really shouldn't.

For the form UI: don't allow the user to click submit (grey it out) unless all forms are filled. Make it clear that all forms must be filled (make them red..?).

For the backend: make sure requests are authorized, sanitized, and necessary. For requests to /users/{username}/delete, make sure that {username} == the username attached to the user's session cookie. Make a very generic error message (as mentioned in Francisco's answer, where he uses boring/long error messages to frustrate trolls. To tie into the form issue, make the server sanitize requests. If somebody sends an empty form (or invalid data), throw an error.

Answer 6

If you have a way of accurately identifying a troll you want him to stop engaging with your website. You have a bunch of options of doing so.

You can increase page loading time. When your website becomes sluggish trolling becomes less fun. Randomly ignoring 10% of the mouse clicks of the user would have a similar effect.

When it comes to user submitted content you can pretend to the troll that he successfully submitted content but hide the content from all other users.

Answer 7

You might also consider this from a security point of view. One or two actions like this from any one person can be a mistake. Repeated attempts are an attack. While I wouldn't take actions that would purposely egg them on ("dude, you'll have to try harder than that to submit a comment!") if you can nail down invalid application requests from one person/source, then lock them out. That's simple to say of course. The details are harder: how long are they locked out, do all invalid actions count the same as others, etc.

See the Mozilla AppSensor project for more info on this approach.