Jaanus on the internet

The case for/against password masking

2009-06-28T21:08:14Z

I have great respect for both Jakob Nielsen and Bruce Schneier and I usually agree with both of them. But in this case, I think they’re wrong.

Recently, Nielsen posted a case against password masking that made me raise my eyebrows and go “hmmm… I’m puzzled”. Then Schneier agreed.

Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn’t even increase security, but it does cost you business due to login failures.

It’s a bad idea to propose password unmasking. Here are my reasons why.

I don’t know if they both work alone in a private office, but I have always worked in an open office setting where many people have access to my screen. I am uncomfortable with the idea of people being able to look at my screen to discover my passwords. Same for demos and presentations, customer support/screensharing etc. Computer use is more social than Bruce and Jakob seem to assume.

These days, browsers do a decent good job of remembering passwords, so ideally, you don’t need to enter them more than once or twice when beginning your relationship with a site.

Let’s think outside mobile and web for a second. I thought of a mechanical keypad securing a door, with or without an accompanying keycard or other tokens. It has no feedback about password/PIN entry, and yet people still manage.

I do exactly what Nielsen describes. I copypaste all my passwords, and only remember one “überpassword” to secure the secure partition where I keep the file. I don’t see how that is insecure. I just checked, the file manages hundreds and hundreds of my digital identities, all of them with a long unique generated secure password. There’s no way I would bother to remember all of them, or even some, besides the überpassword unlocking the vault.

There’s this trend that I believe in, where you can use another site (Google, Yahoo, Facebook etc), as your identity provider, and third-party sites can use them. OpenID technically started this a long time ago, but OpenID URL-s concept is boring and hard to understand. This has been democratized by wrapping the whole OpenID approach in an easily clickable button that you can use to log in with Google etc. This trend will continue and cut down your password amount and error rates.

Nielsen brings up a good point about mobile, where the public demo and shoulder surfing may not be that big of a deal. Maybe it’s OK to unmask passwords in mobiles. But let’s take a step back and ask: why do I need to identify myself in mobile apps to begin with? The mobile phone knows who I am because I have a billing relationship with my service provider. It’s a missing feature that this identity currently can’t “bubble through” to the apps, similarly to OpenID. But it’s something that will eventually show up, once the service providers and phone makes see the value of this. Or in a simpler form, mobile apps will work as described in the previous paragraph, reusing your identity from other providers, instead of you having to create and remember a new password for each new relationship.

Browsers vs search engines, and how it makes complete sense

2009-06-22T00:36:12Z

This is a really great video.

I wasn’t surprised by this by a least bit, because all my academic training was about one simple mantra: “the user is not like me”. People care less than you think about technology, and are creative in a completely different way from what you think. This is a great thing for those who can figure it out and build on it.

Coincidentally, just this weekend I finished reading “The Inmates Are Running The Asylum”, Alan Cooper’s book that basically makes the business case for interaction design. Related to the above, it looks into how programmers and engineers, who he calls “homo logicus”, are different from “normal people”, and how should polite software behave.

I made myself a poster with the important bullets for the office wall. Download if you want. And to learn more about what these mean, buy the book.

Retro Estonian commercials available on DVD

2009-06-08T00:12:57Z

Do you remember the Borat movie? And the fact that it had a bunch of bizarre clips in the end credits, that were actually genuine Estonian TV commercials for a Soviet era? See my old longer post here.

A selection of the clips is available on Youtube and you can buy all of them subtitled on a DVD from timeless.ee

Software vs hardware keyboards of iPhone and Palm Pre

2009-06-06T18:41:28Z

A good piece on iPhone vs Palm Pre, discussing, among other things, hardware and software keyboards, and what are the merits of one over the other.

There’s an important aspect of the iPhone keyboard that I don’t see mentioned very often, and the following photo shows it.

It is very easy to enter non-standard characters with iPhone, and I use this capability a lot to send messages in my native language. It is easy for Apple to deploy new characters or entirely new layouts to the keyboard.

I dare anyone to show me it is as easy with the hardware keyboard. Even if it is possible to enter nonstandard characters in a similar way of holding a key, they will pop up in a place that is disconnected from the button press, so they will feel like second-class citizens and I will feel like a substandard person because of that. On the iPhone, the extended characters pop up very close to the original keypress and the experience of entering, say, “ä”, is not that different from entring “a”.

For Apple, the software keyboard means that they can reuse the same SKU (physical unit) for any location, and deploy all the needed changes in software configuration. This must be much cheaper than Palm etc having to manufacture different units for different places and not being able to reuse them. So I expect the iPhone to sell much better globally (as it already is selling) than Pre (which is just US and one carrier for now).

Bad UX from Microsoft: Windows Media Player for Mac download experience

2009-05-08T17:59:52Z

It’s sad that Microsoft keeps giving me bad experiences, despite having Bill Buxton and other wonderful people on their team. (Yeah, Buxton is in MS Research, not the “product”. Whatever. Still Microsoft.) My intent is not to bash them or anybody else just for the sake of bashing, but just now I came across something that made me again go just “sigh…” and shake my head.

So here’s the situation. I am trying to install Windows Media Player on my Mac. It’s not a bad piece of software at all for using Windows Media content on Mac. Yes, you can have Flip4Mac that integrates with Quicktime and is sometimes more convenient. Yet at other times, I’ve found Media Player gives me better experience, because it is Microsoft native so they have all the codecs and logic packaged up inside their own app and don’t need to interface with QuickTime.

So anyway. I google for “windows media player for mac” and get to this page.

Ok, this is a pretty good page. It tells me there are two approaches for playing Windows Media content, and I pick the last link, Windows Media Player 9. Cool. I click on it and see this page.

Now this is starting to go a bit downhill. Looks like it jumped somewhere halfway in the page, but it’s still telling me about Office… err.. what? I want Media Player. Oh, in the bottom Products and Downloads section, looks like Windows Media Player is selected, so … where is the download link?

I realize “uh oh, this is not as easy as I thought. Time to switch my normal user hat for UX forensics expert”. And indeed, looking at what’s going on there, you see there’s a Details window where you can scroll, and you go down there… eureka. Some download links.

(Nevermind that it talks about it being released in 2003. I’m telling you, it’s actually a working piece of decent software.)

Ok, so you may think that you download the thing and it’s done, but no… you download a file, but it’s in some “sitx” format which my Leopard knows nothing about. So let’s see… there’s “How to Install”. What does that tell me?

Aladdin Systems? What is that? Of course there is no link. Sigh.. back to Google, and I search for “Aladdin Systems”. Well, that doesn’t give me much anything useful about Aladdin itself. There is Aladdin, but it has nothing to do with StuffIt. But there is Smith Micro, who I think made StuffIt, so hey, that’s great, let’s see where the link takes me…

Umm… what? Why am I seeing all these versions and there’s a woman talking to me? Which one is the right version? I thought StuffIt has a free version, but now I am not sure any more… all I wanted to do was play some Windows Media

I wish this story had a happy end, but it doesn’t. I didn’t yet figure out the StuffIt page. I guess I’ll still find the right thing to decompress the strange archive and then I can finally use the app.

Estonian e-voting 2009 application now available to public to test their setup

2009-05-05T02:12:21Z

Estonia is going to have two national e-votes this year. First for European Parliament, second for municipalities. I am going to vote over the Internet on both occasions.

The first e-vote is in about a month. Today, they published the application for public, so that people can test whether their computers, ID card readers and ID card readers work correctly. I tried it out, of course. See the screenshot walkthrough here. All worked well, apart from one strange warning when opening the disk image with the application. I hope they fix it.

Read also my longer rant about ID cards, e-voting and the associated topics. Sadly, many so-called “e-voting” around the world in other countries have been complete jokes or disasters, and have undermined the validity of the concept in the eyes of the public.

I continue to believe that correctly, securely implemented Internet-based voting (or derivatives thereof, such as mobile etc) is currently rare outside Estonia, but is going to happen sooner or later anyway, and Estonia serves as a model of this.

How SkypeToGo can be faster than Skype for iPhone

2009-04-11T21:41:28Z

It’s great to have internal competition between your products. And Skype has it between SkypeToGo and the iPhone version for some functions. The question then becomes, which of the two do I use, while still giving money to Skype. I don’t need to look for external things.

I use SkypeToGo a lot for international calls. When Skype for iPhone came out, I was curious to see how it compares with SkypeToGo, with my hypothesis being that Skype for iPhone is slower. So I did an analysis using the Keystroke-Level Model. It’s one of the more “hard science” parts of Human-Computer Interaction methods. I won’t write the theory here, you can read more in Wikipedia or see the project page.

In short, there is a software called CogTool that neatly packages up the hard science. You give it the system interface, describe what keys the user presses, and it tells you how long the actions are going to take. There’s science behind why the numbers it reports are correct. Go read the papers if you want to learn more.

So, long story short, I compared SkypeToGo and Skype for iPhone for the task of calling a phone number that was in my contact/shortcut list. I had previously set up everything with all sorts of auto-logins. So I am answering the question, “starting from the iPhone home screen, how long is it going to take me to be connected to phone number X?”

These were my preliminary results.

In short, CogTool told me that the task takes 8 seconds with SkypeToGo, and 6.6 seconds with Skype for iPhone.

Here are the calculations and screen flows for both.

You’ll notice that some screens are present in the flow, but not used. This is because in CogTool, you can’t have “transitory” screens that just move on to the next state.

In English, the steps for SkypeToGo are:

On Home screen, tap the Phone application.
The Favorites section is automatically opened, since that’s what I usually have open in the Phone. I have marked the SkypeToGo number as a Favorite contact, so I just tap it.
When connected to SkypeToGo, I tap the “keypad” button to bring up the numeric keypad.
I tap “1” to access the SkypeToGo speed-dial menu.
I tap “2”, since the contact I want to call is my second speed-dial contact.
The call is connected.

With Skype for iPhone, the sequence is:

On Home screen, I tap the Skype app.
I am signed in and Contacts list comes up. I tap “R” in the righthand menu since that’s what my contact’s name begins with.
I tap on the contact in my contact list.
I tap “call”.
The call is connected.

So… the first had five taps, the second four taps. Second was faster than the first. Makes sense.

And yet… I realized I had made a mistake and left some material out from the Skype for iPhone calculation. When I tap “r”, I cannot immediately call my contact since it is not among the first ones that begin with “r”. I must perform a drag to move down my contact list. (Actually I must perform several drags, but I just added one to keep it simple). Here is the updated design, calculation and overall result.

Now, differently from the previous calculations, these numbers may not be scientifically correct. Although CogTool supports touchscreen and tapping, which is what I used for all the actions before, it does not support dragging on a touchscreen. So I had to add some mouse actions, whose timings may not be scientifically the same as what you would get on a touchscreen. But I think they are generally correct.

You see that the dragging slows things down greatly, and SkypeToGo is faster.

There is one HUGE caveat for the above work, tilting the balance even more in SkypeToGo’s favor. There are no “system delays”, and all system responses are assumed to be instant. In practice, you have system delays for both. In SkypeToGo, you have the dialing delay and voice prompts — but you don’t have to listen to the prompts once you have memorized the sequence. So, for SkypeToGo, I would add about a 5-second delay, so the final result would be 13.083 seconds instead of 8.083. As for Skype for iPhone… I don’t really want to go there. It has a HUGE lag with my large number of contacts and is basically unusable. I’d say the system responses for logging in and initializing the contact list take at least 20 seconds in my case, and the whole thing in total is thus about 30 seconds — and that’s an optimistic estimate.

There are some design lessons here for Skype, beyond the obvious “make it work faster”. I actually have hundreds of contacts in my iPhone contact list, but I could avoid going there, just being able to pick from my Favorites without any scrolling. The same thing could work for Skype for iPhone. I care about some contacts more than others, so I could mark them some sort of Favorites. And I would go so far as to say that I don’t even care about seeing most of my contacts at all while on the move, which would also fix the efficiency problem. So if my contact list Skype for iPhone could only work with a subset of my contacts — maybe those that show up in my chats plus those that I have specially marked.

The other question I have is, for SkypeOut contacts, why is there the screen where I can only tap “call” and do nothing else? Looks quite useless at this point, and could save me another tap.

Download the CogTool file

Skype for iPhone first quick thoughts

2009-04-01T03:08:52Z

Today was a happy day for the Internet.

Skype for iPhone was released today.

When I first heard the rumors last week, I didn’t really believe them. But I was ready to be surprised in a positive way. And Skype followed through, with the download really being available Monday night in the US, ahead of the Tuesday launch.

I have many thoughts about the software itself, but I’ll let those bubble around a bit and do a post series, rather than try to vomit everything into a big post right away. But what I can say is this: Skype for iPhone is definitely more interesting than, say, Skype 4 for Windows. Not only because I will myself use it daily, but Skype is really breaking some new territory here and upping the ante in the open mobile platforms struggle.

The product

Skype for iPhone
Uploaded by SkypeConversations

In short: I haven’t yet been able to makea successful test call with the phone. I’ve made a few that sort of work, but they get dropped or words break up. But I could hear bits and pieces working. This product will definitely drive it home to many people what “hi-fi voice” really means. The video above does not really do justice to the call quality. It’s clear and superior to anything you’d get on a regular phone call.

I think there’s also something wrong with the privacy settings, but I can’t confirm this. After I connected with Skype for iPhone, my Skype on Mac showed that “allow calls” privacy had moved from “only contacts” to “anyone”. But I have cried about bogus bugs before, that have turned out to be my bad, so I’m not pointing any fingers about this bug yet.

I have 900+ contacts and the product is misbehaving — locking up etc. I hear from my Skype friends that you should let it run for a while, and then it starts to work better, but in any case, it’s not optimized for this many contacts. I can fully see the rationale for this. But look: you can also think about this as the opportunity to have me tell 900 people how awesome the new Skype on iPhone is. And if they don’t have an iPhone, Skype alone is a reason to get one. Or, at my office, I have 20 people with iPhones sitting within 20 meter radius of me. Based on my bad initial experience, I am unlikely to be super enthusiastic on the first day. So, the poweruser situation could have been handled a bit more gracefully than making the program unresponsive while the list is being updated.

To balance this last piece out, the product itself is very nicely done, and probably works well with fewer contacts. The chats (“instant messages” in some Skype material) work wonderfully and I’ll write more about that sometime.

Towards open mobile platforms

In less than a day, Skype made it to the top of the list of iPhone App Store free apps. I think this ups the ante about the struggle for open mobile platforms. On its blog, Skype says:

Apple’s rules prohibit third-party voice apps like Skype from using 3G networks. Currently there are no other VoIP applications available for the iPhone that allow VoIP calling over 2G or 3G networks. At Skype, we’re as frustrated by this as you are. We believe very strongly that your mobile network shouldn’t be able to determine the nature of the data that you send and receive.

Bold words. I was wondering whether this is a good enough reason for Apple to not even have Skype up on the App store at all. But apparently not having voice calls outside wifi was good enough. People at at&t are probably trying to figure out right now what do they do about this.

A nicely done launch

I liked the Skype for iPhone launch much more compared to, say, Skype for Windows 4. The latter had a bit too much fanfare for my liking. Whereas on iPhone, it just happened. Done. There. Check.

The only ironic thing is, the App Store is not available in Estonia where Skype was built. Will Skype for iPhone launch contribute to fixing this? I know many people who would be very happy and gave Apple lots of money when this happened.

UPDATE re iTunes Store: as of Apr 2009, it is now open in Estonia. Only for apps, though, not yet for music or other content.

Search spam in iPhone App Store

2009-03-21T19:13:30Z

When one app lists unrelated apps in its description, I can only conclude that it’s spam.

iPhone OS 3.0 and its accessories piece

2009-03-19T03:49:45Z

Just watched the iPhone OS 3.0 announcement event. Lots of good stuff. I’m looking forward to it becoming available.

The piece I found most interesting was about accessories. Namely, that you will be able to control any kind of hardware (assuming the hardware provider provides an iPhone app), either wirelessly via Bluetooth or through the Dock connector.

I sometimes stream stuff from my Apple TV through my actual TV, having the TV speakers off and listening to stuff by my wireless headphones, so I can walk around my place and still listen to a podcast or something. And I can control the playback with Apple Remote app from iPhone. It was initially weird to wrap my head around this concept, but it works totally great.

So now this accessories piece generalizes this functionality, letting iPhone become a central control device for everything in the living room and kitchen and other places in your home. I would welcome being able to control my cable box from iPhone instead of using the bad remote and ugly onscreen menus that they have.

I also found it interesting that they demonstrated an insulin reader device that plugs in to your iPhone. Traditionally consumer electronics has steered clear of medical and other critical applications, although consumer-class hardware is nevertheless used a lot in medicine (with most of it being Microsoft/Windows territory). This shift into actual health applications — not just reference encyclopedias or such, but actually interacting with your body — was an interesting move.

It was also interesting to watch the insulin reader demo because it’s a very clear example of persona- and scenario-driven design. They presented an actual persona profile and their daily scenario on the stage, which of course made me as interaction designer jump with joy because I could identify with that design method.

How to connect a FireWire camera to computer when camera has only FW400 and computer has only FW800

2009-03-10T14:52:53Z

I’m currently working with a video camera that has FireWire output and FireWire 400 cable. But let’s say your computer only has FireWire 800 like the new Macs. And you still need to connect the camera to computer. I can haz? How?

One option is to look for new cables. But assuming you already have a spare FW800 cable that’s just sitting around, and FW400 cable that connects to camera, this would be a waste of money.

Option #2 is to realize that FireWire is a serial bus, which means you can daisy chain devices. And maybe you have something like a LaCie portable hard drive sitting around, which has both FW400 and FW800 connectors.

So what you do then, is connect your camera to hard drive, and hard drive to computer, like this:

Mac <-- FW800 --> hard drive <-- FW400 --> camera

A bit unorthodox, but does not require any extra cables and money, and works great for me.

Article about ID cards in common law countries, and my thoughts on it

2009-03-08T02:21:35Z

Bruce Schneier links to an interesting paper discussing ID cards in common law countries, and why they are often perceived as negative. Summary quote:

This chapter suggests that the U.S. hostility to ID cards is based on a romantic vision of free movement, and that the English view is tied to a related concept of “the rights of Englishmen.” I then suggest that these views distract from the real issues raised by contemporary national ID plans in the common and civil-law worlds.

As the chapter elaborates, ID cards are often seen as a risk to free movement, and some people believe it leads to a police society where anyone may be stopped any time without probable cause and arrested if they don’t carry an ID.

Now, it is true that in the modern society, there is a disbalance of government and individual. The government has more resources and is more powerful, and the individual is always at a disadvantage. The above suggests that ID cards will further deepen that imbalance and give the government more control. Free movement is, of course, important, but in my view this debate misses most of the opportunities. Instead, I’d like to turn the argument on its head and ask the opposite question: could it be possible that ID cards are instead a mechanism to empower the citizens in the digital age so that they can regain some of the control they have lost?

The ID card argument is interesting because it embraces many of the disciplines I have had the opportunity to work with — public governance, information security and privacy, and usability. So, let’s talk about usability — not of a product, but how “user-friendly” or more appropriately, citizen-friendly a government is in a digital age.

Regardless of what side of the above “free movement” argument you are on, unless you live in a jungle, your government has a lot of data about you. Most of the time, unlike authorized government agents, you do not have easy access to that data. Let’s imagine for a second now that your government has given you an electronic ID card — not as a surveillance device, but as a token that you can use to access government records and see the same information about you that officials in all the different agencies already see. And not only that, but you’d be able to see who has accessed your information, and for what purpose. All the accesses both by yourself as well as government and commercial actors would be logged, and you’d be able to review and scrutinize those.

Now, there is a category of data that your government does not necessarily want you to see, that has to do with sensitive security and anti-terrorism information. Fine with me (and I don’t want to debate today about the detailed nature of these measures or their constitutionality. I just say there’s a class of data that’s “more sensitive” than other data, but I won’t scrutinize this in detail). But as for most data, it is in the best interest of both you and your government that you have easy access to it at any time. Things like tax and property records, driving violations, parking tickets, public transport tickets, your kid’s school records, sex offenders living in your neighborhood — there’s no reason why you shouldn’t have electronic access to those. And since getting a security scheme right is hard and costly, it does not make sense for all different government agencies to issue separate tokens and passwords to you; instead, it would make more sense if they worked together and standardized upon a common access token.

I believe that one necessary part of an ID scheme is an ID number assigned to each participant (person), which facilitates unambiguous identification. So, an ID card would really be nothing more than a number assigned to a person, and an electronic method to securely authenticate that the right person is currently using the card, and that the card has not been invalidated or revoked.

Opponents to ID card and number schemes immediately cry out “superdatabase!”, saying that having an ID card and/or number leads to all government data being put in a big pot and spooky agents having access to everything, since all data can be cross-referenced and what not. Like I said above though, the data is there already today, whether you want it or not. And the ID card should by itself not have any data associated with it, other than the ID numbers and cards issued to persons, and whether a given card is valid or not. (If a card becomes invalid, e.g is stolen or expires, the person receives a new card, but the personal ID number remains the same for the whole life.)

I believe that data should remain compartmentalized in relevant agencies. So, even though you are identified by the same ID number in both databases, it does not mean that the maintainers of these databases can access all data about you. Instead, giving persons access to their own data in the different agencies is a good way of starting debate about who else and why has access to that data, and what security methods are in place to enforce this access by persons and officials.

Now the above is a bit similar to how credit reporting works in the US. I had heard horror stories about it, but the truth is not so bad (other than the system being somewhat insecure). Social Security Number is being used both as the identifier and password. But insecurity aside, you can sign in to the system, pay the credit agency some money, and see your own credit history and interestingly also who has requested access to it. It works. I applied for a credit card, and then I went to check my credit record and indeed saw that this financial institution had queried my record. (But no one else had.)

This is a baby steps model that is in many ways broken and insecure, but it serves as an example of what could be possible. For example, I would like to log in to the Internal Revenue Service, Customs and Immigration Service or New York State Department of Motor Vehicles to see what current and historic data they have about me, but there is no way for me to do that today.

Largely, the above is how the system is implemented in Estonia today. I am thousands of miles away, but I am able to log on to the Tax Office with my ID card and file my taxes directly to the government using a pretty straightforward online form, without paying anything to the intermediaries. (For those who don’t know, in the US, if you don’t want to fill your tax record forms by hand which may be quite complicated, you can buy an online product where you can fill a similar easy form. But the products are offered by private companies, not the tax office.) I also need to carry over some figures from my last year’s tax report, so I can review my past tax returns in the same place.

There are other benefits. Imagine a secure electronic messaging system together with the ID card. If any agency of the Estonian government, or really anybody else in Estonia since anyone can ask the ID card system “what’s the e-mail address of this particular person”, needs to tell me something important, they have my e-mail address associated with the card where they can send me e-mail. If there is sensitive information, they just send me a notice that I should sign in to their secure website with my ID card (without having any prior relation or registration with them) and review whatever is needed.

In the US, whenever I send somewhere some form to apply for whatever private or government service, I need to write down my street address. I moved from Pittsburgh to New York last year and set up mail forwarding with the US Post Office, and I have indeed got some important mail forwarded. But the forwarding works for a limited time. I wouldn’t be surprised if there was some important mail sitting in Pittsburgh right now, waiting for me, and I have no way of knowing about it or accessing it.

Later this year, we will have two votes in Estonia, for the European Parliament and the municipality where I am still registered and stay when I live in Estonia. I will be able to vote on the Internet using my ID card, without worrying about mail voting or looking for a consulate. I know enough about the voting system to be convinced that it is secure — more so than any form of paper. (And definitely more than the completely insecure voting machines used in the US, where you must still go to the voting station to vote with a machine, which for me defeats the whole point of electronic voting.)

The Estonian e-government system does have a little bug that’s not too serious but I still hope it will be fixed one day. The personal ID number encodes a person’s birth time and gender. I think that is a privacy violation — not too serious one, but it would be better if the ID number was just a completely random number that didn’t by itself contain any data.

As far as I know, no one has really calculated the cost savings that would be achieved by implementing above features of e-government, neither Estonia nor US nor anywhere else. Some of them are easy to calculate in monetary terms and very visible in Estonia today. The Tax Office in Estonia is saying it costs them money to mail out paper notices about pending land taxes to people, and is encouraging people to sign up to electronic notices by saying: “If you sign up for electronic land tax notice, you will receive your income tax refund faster”. Everybody still receives their refunds within the legal time limits, but those opting in to electronic notices will receive their refunds in a matter of days, instead of weeks and months.

So, there are very tangible benefits in terms of cost savings, to ID cards and the associated e-governance. Other benefits are more difficult to calculate. How do you assign a value to each citizen being more empowered, and gaining equal access to information as compared to government officials? I am sure there are governments in the world who would want to calculate this for the opposite reason — so that they would NOT do this, and could keep people away from knowledge and thus power, and could express their own power in tangible numbers. But as for democratic open societies, I believe that access to information is something that both people and elected officials stand for.

With the economic crisis in full effect around the world and both governments and individuals desperately looking for ways to cut their costs while maintaining or improving access to public information and services, I have some hope that nonsense arguments about ID cards and e-governance (police states, limiting free movement etc) get thrown out and are instead repaced with more rational debate about the true benefits. The risks must definitely be accounted for, and there are sadly many counterproductive examples of such schemes being done with bad security, thus torpedoing the whole idea. But if done correctly, I believe electronic ID cards and e-governance are a great way of further empowering citizens and opening up societies.

ADDED: electronic ID cards do require some extra infrastructure. For example, if you have a smartcard-based system, you need a card reader connected to your computer. It doesn’t cost much, but you may still think it’s a hassle to buy and connect it. But if you think that rolling out the infrastructure is a showstopper, I’ll tell you a Skype story. One of the original Skype engineers, in 2003, was skeptical about the whole idea of Skype taking off. Why? “Nobody has microphones connected to their computer.” Which was probably true in 2003. But today he is glad that history and more than 405 million people have proven him wrong.

Spotify

2009-02-18T03:32:53Z

Tried out Spotify.

Now, the back story here is that I’m not very big on Internet apps for music. Basically there’s nothing missing in my life that iTunes cannot do. So I’m not a big user of Last.fm, Pandora, Muxtape, or any of those other things. I’m all mainstream and iTunes. So I had some skepticism for Spotify. But I figured I’ll give it the benefit of doubt and give it a go.

I’ve now been using it for a couple of days — more than I anticipated. And there are several good things about it.

The first thing I like, before talking about music, is the general high quality of engineering and design. It’s a really well done piece of client software. Specifically, it is small and super fast in all aspects. It starts pretty much instantly. When starting to play audio tracks, there is no perceivable delay. Searches are lighting fast, much faster than iTunes. The whole thing is extremely snappy and responsive.

Responsiveness is important to me. I keep ranting about how I need to constantly wait behind my computer crunching away in some infinite loop, and how programs start and run too slowly. I get very upset when the computer is wasting my time. Spotify in its responsiveness is a true gem that really stands out well.

It also has many other nice little things. It shows Growl notifications when changing tracks, without me having to change anything (although showing the album image instead of program icon there would make it even nicer). It responds to MacBook Pro’s “previous”, “pause” and “next” keys (I thought only iTunes can do that). The signup process was dead simple. The UI is fairly minimalistic. So it’s just a nice complete package.

Now, function- and music-wise, looks like you can do two things with Spotify today. You can search for artists/songs and play them, or you can run the “radio” where you specify the decade (from 50s to 21st century) and music style, and then it creates a “virtual radio”.

Just to make sure I haven’t missed anything in the marketplace, I gave Last.fm and Pandora a quick go. I still like Spotify more, because the other two guys’ webpages are overwhelmed with stuff that doesn’t interest me, and being web apps, they are much less responsive. Even if they only spend two seconds streaming the next track, that’s already killing my experience.

Now, there’s a couple of things that some of the other guys do, that Spotify doesn’t, and I hope it will. So here’s my little wishlist.

Merge the artist and radio functions somehow. Let me search for an artist, and play it back, but also play “similar” tracks like Last.fm who creates a virtual radio station around an artist.
I don’t like how I have to start from scratch with music apps. They should utilize the knowledge available to them. Specifically the iTunes library. My iTunes library has 20 GB of content and the XML file is 3.6 MB. It has a lot of data about me — what songs I like, how I have rated them, how often I have played them, etc. Spotify should grab this data and put it to good use. Now, of course, you can do this with web-based players too — given that you get people to manually upload their iTunes library XML file. Which could be a nuisance — you have to click the upload button and find it on your disk and wait for the upload to finish etc. But Spotify is already sitting in my computer, so it could grab this file seamlessly without annoying me.

On their site, Spotify also talks about upcoming social features. I don’t know if I’ll use them, but it will be interesting to see if they can maintain the UI responsiveness and simplicity while adding new features.

Now, the big question is, would I pay money for this whole thing? I really can’t say. I end up buying a lot of music from iTunes during some podcasts that mix together the gems of a particular music genre. I can see Spotify doing the same — helping me find great stuff. And maybe it can somehow inject itself into the iTunes or Amazon MP3 value chain. Or maybe I would even pay — but with the product like this today, I can’t see myself paying more than a few dollars per month.

UPDATE: found a bug too. It does not support Cmd-H key combo to hide the window. On Mac, it should, it’s a standard action. UPDATE TO UPDATE: Cmd-H actually works, so there is no bug. I blame it on my MBP, it has been acting up recently, and random things don’t work from time to time.

Of making pots

2009-02-17T05:05:27Z

There’s a quote from one of the readings in my design classes that’s been haunting me for a long time, and in a good way. Originally I read this in Bill Buxton’s “Sketching User Experiences”, but apparently the original source is Bayles & Orland, p 29.

The ceramics teacher announced on opening day that he was dividing the class into two groups. All those on the left side of the studio, he said, would be graded solely on the quantity of work they produced, all those on the right solely on its quality. His procedure was simple: on the final day of class he would bring in his bathroom scales and weigh the work of the “quantity” group: fifty pound of pots rated an “A”, forty pounds a “B”, and so on. Those being graded on “quality”, however, needed to produce only one pot — albeit a perfect one — to get an “A”.

Well, came grading time and a curious fact emerged: the works of highest quality were all produced by the group being graded for quantity. It seems that while the “quantity” group was busily churning out piles of work — and learning from their mistakes — the “quality” group had sat theorizing about perfection, and in the end had little more to show for their efforts than grandiose theories and a pile of dead clay.

Put more simply: you don’t get better at making pots by researching making pots, or thinking about making pots. You get better at making pots, by making pots. And pots here are, of course, only a placeholder for… just about anything.

Another example why javascript:history.go(-1) is a bad idea

2009-02-15T05:46:24Z

Just came across this example. I don’t mean to pick on this particular site, I just stumbled on it.

The following happens on these pictures. I am looking at the classic form which says “Lost password? Enter your e-mail and we send you the activation link”. I enter my e-mail and click submit. It tells me that this e-mail was not found. I hit their “back” link (NOT my browser’s “back” button) and come to the same form… except that the “submit” button is disabled. I can enter another e-mail, but I can’t submit.

What’s going on?

We see the following code in the page that shows me the form:

<form id="request_pass" method="post"
action="login.php?action=forget_2"
onsubmit="this.request_pass.disabled=true;
if(process_form(this)){return true;}else
{this.request_pass.disabled=false;return false;}">

So… when process_form validates the form to be OK, the button is disabled. Which is a good idea to disable multiple clicking. But, on the resulting page, you come back with javascript:history.go(-1), and this does not reset the previous page state. The page is shown exactly as the browser last saw it. With the submit button disabled.

How to fix? There are two ways:

Instead of javascript:history.go(-1), use a normal URL that triggers a page reload and script resetting.
Remove the validation and button disabling from the form. Less desirable, since does not prevent multiple clicking, which may in the worst case trigger several password reset emails and confuse the user.