4

I'm currently working on a redesign of a customer-facing account management. A stakeholder brought forth the idea of exposing certain information about the account to pre-login UI. From a technical perspective it's doable (via cookies with long or neverending timeout), but my concern is perceived security and resulting UX implications.

Imagine a login page that, for instance, displays "Welcome back, John Doe", and goes on telling you "You have 9 days left before your subscription runs out. You can either renew it manually, but why not set up recurring payments?", or "Your current subscription plan is 'Hello World Pro'. Did you know that by extending your subscription period now, you can take advantage of our special offer?".

Mind you, the user hasn't logged in yet. We're retrieving this information based on a cookie stored on their computer - and in order to actually take any action, the user will need to log in.

I'm seriously concerned that, while the stakeholder expects this to be helpful, it would in fact undermine users' trust in safety of their data. In the worst case scenario (e.g. a shared computer) it could even compromise a user's privacy. Nevertheless, I need to research this to present some hard evidence.

I know it is something that's considered useful in a mobile app, but to be honest - a mobile phone is yours and yours alone, while your home computer may be shared by your family, your work computer can be accessed by admins or other people, and I'm not even mentioning computers in various internet cafes etc.

So my question is:

What would be the appropriate Best Practices that would address such behavior, set some ground rules and provide guidance on it?

Improve this question
1
  • I think both Amazon and eBay have some sort of similar behaviour that might be worth checking out.
    – JonW ♦
    Jul 23, 2016 at 8:12

2 Answers 2

Reset to default
4

Do a value analysis to understand if users value privacy more than the utility provided in your site / app's context. For instance nobody wants that for a bank or an escort site, but for Amazon? Why not, it saves users time. So, users' perception of risk and benefit will be contextual.

You also must give users the opportunity to state that they are using a public computer for which cookies must not be saved. This can be emulated by having a checkbox on the login form to remember their credentials; clearly if they don't want to be remembered then you must not rely on past cookies to identify users. If you see that multiple users log in from the same browser, you might also want to hide information by default (many couples and families share an account or device nowadays).

Improve this answer
7
  • As a matter of fact, I proposed a one-time popup (modal dialog) with a message concisely describing the feature, and giving user the option to opt in or out. Coupled with users' ability to change their decision by visiting User Settings and turning it on or off, it does two things at once: ensures that they understand the benefits and risks, and promotes the feature at the same time. On top of that, data about how many users opted in or out should give us insight into their reaction to it.
    – Jan M.
    Jul 27, 2016 at 12:31
  • I would recommend not explaining the feature, actually. Just 'keep me logged in' or 'Let me see past orders without logging in' or something similar. If you explain the potential risk and that risk wasn't obvious beforehand, you will alert users and cause them to question their trust in your site. If the risk was obvious beforehand (given users' security mental models, see rickwash.com/papers/rwash-homesec-soups10-final.pdf and look up mental models of online privacy), then it warrants no explaining. UX-wise you will just degrade trust by rubbing their nose in hypothetical risks.
    – Steve Dodier-Lazaro
    Jul 27, 2016 at 15:34
  • This being said, it implies that you do not display information that is actually privacy-sensitive. If I order cans of pasta on your website, sure, tell me my last order is on its way on the front-page. If I bought sex-toys from you, hmm, no thanks! It's up to you (and/or a privacy consultant) to determine what threats might exist (classic threat modelling) and what social settings (important too: we often ignore misuse cases and negative externalities in security design) might be embarrassing given every item of data you propose to display without authentication.
    – Steve Dodier-Lazaro
    Jul 27, 2016 at 15:35
  • Well, the "explanation" is by no means going in-depth. It pretty much reads: "Even after we sign you out, we can provide you with personalized information about special offers, your subscription and billing status, and provide other personalized services. If you wish to take advantage of this feature, click "Remember Me". Otherwise, please, click "No". You can always change your decision later in your Account Settings." Naturally we don't want to cause users to panic.
    – Jan M.
    Jul 27, 2016 at 15:46
  • This took me 15 seconds to read. That's about 13 seconds too many ;-) What about a checkbox with "Show subscription and billing status when logged out", or simply "Remember me" which implies that the site will remember who you are, and that users are authorising whomever accesses this device to view information about their account? If, when testing with users, they mention worries about security (e.g. your site can be used to make payments), you could use something like "Remember me (payments to new recipients will still require password)" so the security concern is address.
    – Steve Dodier-Lazaro
    Jul 27, 2016 at 16:29
1

I'd be tempted to go with this idea. So long as it does not introduce significant risk (which is usually an area outside the remit and expertise of UX).

When I'm faced with a design idea that I have no experience with such as this, I always do 2 things:

  1. Articulate the issue, its potential benefits and disadvantages, and ask for it to be added to the project risk register to be monitored

  2. Work with a Business Analyst to understand what Management Information points need to be put in place and the type of user data to be monitored once this has gone live

Sometimes it's nice just to go with something new and it's refreshing that your client is proposing something like this rather than putting up barriers.

Improve this answer
1
  • 1
    I am also tempted to go with the idea. I just don't want to jeopardize customers' trust in our security. It's not a bank or such, but there is billing info available inside customers' accounts, so.. I think you made very good points, I appreciate them, and I'll definitely make sure to monitor this potential risk. Possibly do some A/B testing in advance, to get a sense of how customers feel about it.
    – Jan M.
    Jul 25, 2016 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.