IFD:Nutzerstudien WiSe1314/Gruppe Anmeldung endpresentation: Difference between revisions

IFD:Nutzerstudien WiSe1314/Gruppe Anmeldung endpresentation (view source)

Revision as of 15:32, 14 March 2014

2,212 bytes added , 14 March 2014

no edit summary

Hans

25

edits

@@ Line 167: / Line 167: @@
 ** Authenticity doesn't loom large for students personally.
-<span style="color:#ee9966">This is a good collection of overarching ideas for making good software.  There are a couple of specific points, like wanting to see when a user is online.  More specific points would be useful.  For example, what specific things are required to provide an "up-to-date and flexible" messaging experience</span>
+<span style="color:#ee9966">Some sections here are a good collection of overarching ideas for making good software.  Other sections here are a couple of specific points, like wanting to see when a user is online.  Each section should have a couple overarching ideas, with some important, specific points.  For example, what specific things are required to provide an "up-to-date and flexible" messaging experience.  What general rules did you learn about security?</span>
@@ Line 190: / Line 190: @@
 This application doesn't contain a login process. You only have to choose the app to be online and you directly see all of your conversations. It is quite easy and intuitive.
+<span style="color:#ee9966">WhatsApp is a good example of sacrificing security and privacy to make it easy to use. WhatsApp definitely provides a simple login, but no app has been able to simplify the login that much without creating serious security and privacy concerns.  For example, the WhatsApp login and password are generated based on data from the phone which can leak out.  The user cannot even change the password once its leaked.  Anyone with that username/password can then read and write messages using that account from anywhere on the internet: http://blog.philippheckel.com/2013/07/05/how-to-sniff-the-whatsapp-password-from-your-android-phone-or-iphone/  </span>
 . Facebook Messenger
 This application functions nearly the same way as WhatsApp, so you don't need a password to sign in.
+<span style="color:#ee9966">Facebook is a much better example to work with since it does require a password, and it is a password that the user sets and can change.</span>
 Our conclusion:
 Both applications manage without a password. That's quite intuitive but it isn't quite save. While doing our interviews we experienced that it would be convenient to have a password to have a safety warranty (e.g. in case of losing the smartphone).
+<span style="color:#ee9966">One thing that both WhatsApp and Facebook have in common is that they both make the app and they also run the service that the app uses.  This is the difficult part of ChatSecure: it is just the app, someone else is providing the service.  The advantage is that anyone can provide the service (companies, student groups, universities, individuals, etc.)  This means the user can choose a service provider that they trust the most, but that makes the login procedure a lot more complicated.  One idea that works well in this kind of situation is having "sensible defaults".  That means that the app will choose a specific service by default, and the user can just choose a username and password.  Then if the user wants more choice, then can expand a hidden section that contains all of the options.  <br /><br />
+Another approach is to ask the user a question before setting up the account.  Something like "how concerned are you about the security and privacy of this account?"  Then based on the answer to that question, ChatSecure would choose the defaults for the user (things like which service, whether to use Tor or not, etc.  Then the user could optionally change those defaults.</span>
 ==First design considerations and ideas==