Holly and Morgan talk user experience, including Holly’s experience of falling off a mountain and Morgan’s experiences buying a TV.
Holly and Morgan talk user experience, including Holly’s experience of falling off a mountain and Morgan’s experiences buying a TV.
How's your day going, Holly?
Holly:Really good, actually, I feel alive. How about you?
Morgan:<laugh> Yeah, it's not bad. Got some really interesting text messages from you earlier saying that you were, you were gonna be late to the podcast recording cuz you had a minor mountain emergency. Could you please explain what happened?
Holly:I did have a minor mountain emergency earlier on, getting out in the hills, doing some exercise and uh, I was doing a route which was very, very good route about 12 miles long. And for the first five miles, uh, it's nice and gentle, nice, all flat, the whole way, really easy route. And then for about two miles is a very sudden, very steep ascent. So I got to the top of this ascent up to the peak and I was walking down a trail and the trail is like heather and long grasses. It's very, very open at the top, very, very windy. And I'm walking along and I took another step forward and fell to my hip in mud, which was wonderful. I got to test that my kit is as waterproof as it advertises that it is.
Morgan:<Laugh>
Holly:It is very good, but also I found myself up to my waist in mud and uh, of course had my, uh, mobile phone with me. Now when I, when I uh, go out, I've got a radio with me. I've got two mobile phones. So if like an actual emergency happens, I would've been completely fine. But my phone got wet, which meant that I couldn't charge it, which was gonna cause me a problem for messaging you about when I was gonna get back to civilization to start the podcast. So frantically start sending you voice messages to basically say that<laugh> had a minor mountain emergency, I'm going to be late. And then that's it. That's all that you got told.
Speaker 3:<laugh>
Morgan:Yeah, I was a little bit concerned actually, but then you laughed in the, the final voice note, so I knew you were okay also, I figured that it would've been more obvious if you'd really hurt yourself, but I do genuinely like, I don't know how you've kept yourself alive this long because you are the most accident prone adult I know.
Holly:It's one of those things as well cuz sometimes you don't actually know, like if you hurt yourself, you don't know how bad it necessarily is. So when, when I fell and, and I did hurt my back and my knee and stuff, but my first instinct was to get off the mountain and to get down to the lower ground again. So, uh, I started moving that way as quickly as I could. When I was at the top of the hills. Everybody up there is, you know, prepared for a proper hike and everyone's wearing windproofs and waterproofs and stuff like that. Uh, and they look like they're out for a proper hike. But down at the, the lower lands down by the road, everybody's just like walking dogs and wearing their summer clothes and, and suddenly they see me emerge from<laugh> from uh, one of the tracks completely up to my waist in mud, hair is everywhere, face is everywhere. And, uh, walking past people and being a, a polite British person and saying good morning as I walk past them.
Morgan:You are so Yorkshire. That gives me kind of like swamp creature vibes. But you, you look really nice now. Like you, you can't tell that you fell in like a muddy ditch at all. You look a little damp, but that's it. I assume it rained.
Holly:It did rain actually. Yeah, I, um, recorded a video up the hill, uh, which we've posted on our, on our Twitter about the podcast and, and being late, I did two takes, um, because the first one, as I started recording it just, it just really, really started raining, which I was okay with cuz it just made the video funnier. Um, but I did take a second, second version of that where it was a little bit more out of the wind.
Morgan:Well I'm glad you were okay.
Holly:It is one of those things though, it's like how do you advertise the podcast? I think, you know, when you look at, you look at other content like, uh, you know, YouTube and stuff like that. With YouTube videos, you can, you know, rely on the algorithm and the, the algorithm is gonna find things that are similar to what other people watch and kind of help boost, Oh, you, you watch videos about this topic, here's a, a video that you might like. But with, with podcasting it's kind of difficult to advertise the podcast and get people to listen, isn't it? So I thought those little videos might help boost engagement a little bit.
Morgan:I think everybody that knows us already knows that you're feral, so I think it's fine.
Holly:It's like, hi, I'm up mountain right now. The reason for that is not important, but you should listen to our podcast.
Morgan:<laugh>
Holly:It's not about mountains, but it's good though.
Morgan:It has nothing, nothing to do with mountains really.
Holly:How would you, how would you describe our podcast? To people then if somebody...In fact, this did in fact happen to me. Um, I was at an event recently and one of the listeners, uh, said to somebody else who was there, I said, Oh, Holly has a podcast and it's very good. And I suddenly felt required to explain to this stranger who didn't know who I was, we'd just met, uh, didn't know anything about the podcast, to kind of just give him a line or two about what is the podcast called and what is it about. Uh, and I found under the duress of the moment, that was a very difficult thing to do. So, so how would you describe our podcast to people who hadn't listened before?
Morgan:It depends who I'm speaking to. I think.
Holly:A stranger you just met at a cybersecurity event.
Morgan:Is it like a professional event or is it like, B-sides?
Holly:A professional event? So, so more towards the suits than B-sides is.
Morgan:Okay,<laugh>, uh, that is a tough one. Um, I would probably say that it falls into the realm of a generic technology podcast because we're not security specific. We both work in security, but we talk about other things as well, like machine learning, not something that I've got particularly a lot of experience with. Um, chaos engineering, not security specific.
Holly:I immediately find myself unable to remember what any of the episodes were about<laugh>
Morgan:<laugh> I think if I was talking to somebody, not at like a, a suit kind of event, I would just say what I said to you, which was that"we're both feral and blonde and we talk about computers"<laugh>.
Holly:So what are we, what are we talking about today? We, we typically talk about how awful computers are. Uh, what, what topic have we picked to thoroughly describe how awful computers are today?
Morgan:I think we should talk about user experience today. How do you feel about user experience?
Holly:Well this is funny cuz I was just having a, a little bit of a drama over the fact that, uh, I'm usually on a Mac and today I'm on a PC, so most of the keyboard shortcuts are the same, but I keep pressing, uh, command instead of control and that's throwing me. So there's a silly user experience thing for you. So yeah, I think, um, I think user experience is a really important part of like designing software and I think a lot of people, um, don't necessarily think about it a lot. They might just think about like menus being well designed and well laid out, but not be thinking about the whole process of making a website easy to use and also just making the user feel like they have had a good experience with that website.
Morgan:There's that rule isn't there about websites[that] have negative customer experiences make a more lasting impression than good experiences because if it's a good experience then it, it's just seamless. It just works. It is what it's supposed to be. And you have to think a little bit more, I think to come up with examples of good customer or user experience versus bad customer experience and websites that you hate and will never use again.
Holly:If you think about it in terms of like the common processes that you go through with websites so uh, registering for an account, logging in, changing your password. Those Things that are very common across websites. You rarely think, oh that registration form was well laid out, but I guarantee it. You will notice if it is badly laid out, like for example, um, you have to enter your mobile phone number and it's a dropdown and it starts at like 0 7 0 0 0 and you've got to scroll down until you get to your number.
Morgan:I'm not a fan of that.
Holly:You just get plus and minus numbers. You know, it starts at zero and you've gotta keep clicking the plus until you get up to your, your mobile phone number.
Morgan:I dunno who did that, but they're going to hell.
Holly:Or you get, uh, just a random button and you keep clicking and it presents a random phone number. It's like, is this your mobile phone number? No, you can click random. Again, it gives you another thought
Morgan:Like calming manatees, but phone numbers.
Holly:Yeah. When it comes to user experience, a lot of it is if the user experience is good, you may never think about it. So you might not necessarily be able to think that was a good user experience and kind of learn some of the lessons that, that made a good user experience. And that's without getting into things like accessibility as well. So people are using, uh, nonstandard devices, so things like screen readers to, to interact with the site or also people who maybe have difficulties like vision impairment or color blindness. We should ideally be designing websites that have a good user experience for everybody, including those with accessibility needs.
Morgan:Yeah, and I think that's a lot broader actually than people realize as well. Cause I remember when I was at school, there were people in my class that were dyslexic and they were given kind of translucent, um, colored film to put over their paper because reading this particular font and font color on a different color paper was easier for them than kind of black on white. And I, I think people forget about things like that and, and don't consider that when they're building websites or apps. Usually you've kind of got like light mode and dark mode now and, and maybe different versions of dark mode. Like I think GitHub has two dark modes last I checked. There's like a kind of dark gray and then a black, but nothing for like dyslexic people or people who might be like colorblind or something.
Holly:Yeah. So that could be like a dark mode for those that prefer a dark mode and then a high contrast mode for people who have a, a vision impairment.
Morgan:What's your experience with user experience been, when you've been building Akimbo Core, like your platform?
Holly:So it's, it's always something that I like to bear in mind and I, I'm not an expert when it comes to accessibility. So sometimes I do have to kind of look up the specifics of how do I know that my text is readable to, to the different kinds of impairments and things like that. And there's so many resources out there to help you make good color choices and those kinds of things. But I am conscious of it when I, when I build menus and when I build kind of user flows. But even so sometimes we find users get themselves into, uh, edge cases and stuff and, and users uh, do things that are unexpected. And in fact, right at the beginning of the development when the platform was very new and very feature light, one of the things that we started doing is this idea of"Follow you home". Uh, what this is is basically put a user in front of the interface, ask the user to complete a task and then just watch them complete it. Don't, don't prompt them or point them in the right direction or something like that. Because what you'd be looking for is can the user work that out? Can the user find the right menu and can they successfully complete the menu? And very often the users will try something that maybe you haven't thought of or a button won't be obvious and you kind of find these little, uh, user experience details just by watching users. When I say watching users as well I, I mean like specifically uh, tasking them and then watching them. The reason for that is sometimes users aren't aware of when they've struggled with something or maybe they'll blame themselves a little bit if they can't work through a process as opposed to just thinking that form wasn't well laid out.
Morgan:Can you give us an example of one of the edge cases?
Holly:So it can be really little things. So for example, it might just be the layout of a menu isn't obvious or maybe there's some feature that you could add to a menu that would make it easier. A very simple example would be when you log in on our website, uh, you have to agree to the terms and conditions, right? And that box is not ticked. So asks y ou f or your username and then there's little tick box that says"I agree to the terms and conditions". If you try and click through without ticking the box, it pops up and visibly says, Oh you need to agree to the terms and conditions c uz it would be very easy to just miss that t ick box, right? So it's little things like that where we're trying to prompt the user, Hey y ou, you m issed something here. But another example that I've seen from a company that I worked with previously on their mobile app, they had some fairly complex user f lows. So the user was going through a task and there were several steps to it and during that user flow, the close button was a little bit too close to the submit button. And what they found was users would go through the process, accidentally hit the close button, it would clear out everything that they'd just done and then that user would just leave the app and think, oh well I'm not filling that form in again. So they would just, they would just move on. This could happen in a lot of different places who have like a long complex form, something annoying like a car insurance form or something like that. And if you submit it and one of the items was invalid, does it clear all of the things you've submitted and get you to fill it back in again or does it take you to the one that's invalid? How well does it describe why it's invalid and those kinds of things? But yeah, this company they were doing um, A/ B testing, so showing different samples of users different versions of the menu and they found that they got a sudden boost in engagement with one version and all they had done is move the close button over a few pixels so that it was less likely you would accidentally hit it. So sometimes it's uh, major advancements, increases in engagement, those kinds of things. Uh, and it's just really simple changes. And also when it comes to accessibility stuff, uh, it might be a simple change, better color choices and those kinds of things. And that might be the difference between a user physically being able to use your software or not.
Morgan:I've seen something actually speaking of, of what you said a minute ago about if a piece of information is invalidate clears the form, something sort of related to that. I have a few different accounts with like fintech's kind of startup, challenger banks, um, savings apps and things like that. And I have like an old credit card with a traditional kind of high street bank and when I go into the app to pay my credit card, it's the worst user experience. So it takes me to the website and then my phone prompts me to use Apple Pay and like wallet and automatically populate the details in that form, which the website wants to let me do, but it doesn't fill in all of the fields properly. So it tries to put the full 16 digit PAN from the front of the card that I'm paying with into a four digit field. It then like fails to populate that field and the whole process fails. So they've<sigh>, they've tried to work on this recently and it basically forwards you from the apps that the credit cards in, to the app where the account that you're paying from is, but the form online is still really, really bad and clearly like they just haven't tested that very well with like enough of a, a range of devices.
Holly:Yeah, that that is a thing as well. Not only devices, so like looking at you know, Macs versus PCs but just things like um, screen sizes as well. You know, am I on a iPhone, an iPad mini, an iPad Pro, a laptop? This machine's got an ultra wide monitor so it's, it's 35 inches and the aspect ratio is like 21:9 or something. Um, so making the website on one hand look good but, but also be easy to use on all of those kinds of different screen sizes can, can be really difficult.
Morgan:Do you think that content management systems help with that, in some situations? Like I'm not saying that like banks for example, um, should be using those kinds of things but I know that there's some templates on WordPress that like optimize for different displays depending on, on how you're displaying that.
Holly:The idea of using a template that is responsive or adapts to the screen size and having CMSs that enable[you] to use templates like that then, then yes. But yeah, content and styles should be separated and some of the changes that we're talking about can be really minor. So when it's something like colorblindness, it can be good color choices and when it's something like visual impairment it might just be enabling the website to work with a higher font size. So that isn't necessarily like having a button on your application that lets you choose a higher font size. Browsers very often have these features built in like the ability to zoom within the browser and it's just making sure that your application works with those features. So if the user does need to zoom in, are all of the menus still accessible? Is all of the content still accessible?
Morgan:How does this apply to security tooling? Have you ever seen um, any security tooling that's been implemented that was just so bad for kind of user interface or user experience that it effectively negated having it installed?
Holly:Some security software that could get in way from an accessibility point of view would be CAPTCHAs, you know, if you have something that is designed to be difficult to read and then you have users that are visually impaired, it physically might prevent the users from just being able to use your software. And then if you are looking at um, implementing an alternative, so instead of something that's visually obfuscated, maybe you go for um, audio that's obfuscated so that if a user is visually impaired they can still get through the security check. You would then have to balance is one easier to bypass than the other, You know, cuz of course the the adversary is just gonna target whichever is weaker. Um, but that's a big thing very often. I don't think websites consider things like CAPTCHAs in terms of just preventing some users from, from accessing it. They're using screen readers or something like that. Not necessarily just a security point of view though. There is a lot of websites out there that are just poorly designed and navigating getting around them can be very difficult.
Morgan:And what's the worst example that you've seen in recent memory as an end user?
Holly:A very common thing that I see is, um, websites that are not optimized for mobile, right? So they're just not responsive in any way. Um, so that, that's a very common thing. I I interact with the internet as frequently on a mobile device as I do on a desktop device and I'm sure there'll be users out there who interact more frequently on mobile devices and sometimes websites just aren't designed at all to be used on a mobile device. It'll just present you with a desktop view the text is tiny and you can't see it or interact with pages or anything like that. Or sometimes websites will have like a web version of the page, which is does not have feature parity so you can't do a lot of the things that, that you wanted to do on it. That's really frustrating sometimes, you know, the menu's gonna be differently laid out and if not all of the options are there that that can, that can be frustrating. Yeah, so the, that's the most common example that I see is just like poorly web optimized.
Morgan:I saw something like that a while ago actually. I was looking at different dating apps, having a bit of a look at at what sort of data they collect, what the, the signup processes are like, what the user safety features are like, privacy policies and and so on. And there was an app that was owned by Match.com, that group, it wasn't the match app but it was, it was one of theirs, it was older kind of, uh, I guess intended or, or the target audience was, um, older people, um, people who,
Holly:People in their thirties,
Morgan:Late forties and fifties, um, as opposed to like Tinder or Bumble that tend to target, you know, people in their twenties. So I, I was quite disappointed cause I found that wasn't a lot of user safety content in there for a start. So there was far less resources available about things like romance scams and the like awareness I guess from a developmental perspective about the way that the app might be used or weaponized to target those people. And then when I was kind of cleaning up after I'd looked into those, most of the apps that I looked at had like really straightforward account deletion processes, but this one was atrocious so you could pause your account or freeze it temporarily because there was a, a hyperlink in the mobile app. It was a bit of a shame you couldn't actually do that in the app. You still had to go to the website to do that, but it took far longer to find the option to be able to delete your account and it wasn't hyperlinked, it was just a link pasted into the mobile app. So you have to copy it from the mobile app, paste it into a browser, which would then be, even if you're on a phone not optimized for mobile, the account deletion page, um, didn't work as intended. Like the workflow is completely broken. So I think I filled that in like three times or something and it didn't work. I like ultimately had to like scour the website for a support team that could contact and then email them and ask them to manually delete my account. There was an SLA attached to that because it was a monitored inbox with a three or a five working day response time. So definitely a lot slower, really quite difficult and onerous for the end user to get their account deleted. And then the deletion process didn't work as intended either, so I had to submit a data subject access request after that to double check that they'd actually done what I'd asked them to do. So that was an atrocious experience as an, an end user and I think on a dating app of all places, that's the last thing that you expect, right? Because like is it, I think it's Hinge whose tagline is like the dating app designed to be deleted and the, the goal is for you to meet somebody and not need to use a dating app anymore I guess, which is quite cute and funny from that perspective. But on this app they didn't seem to have any sort of acknowledgement that if it went well and the user got what they were supposed to get from the app, that they wouldn't need their account anymore and it would need to be deleted. There was absolutely no allowance or consideration for that. Kind of closing down your relationship with a customer workflow,
Holly:That's interesting as well, especially from a, a post GDPR world where the right to erasure is a right that you, you have, I think, I think everybody who listens...is probably aware of GDPR, probably aware of the right to eraser and organizations must legally enable you to have all of your data erased. Um, but another point that's related that I would say organizations should think about is like ethically it should be as easy to register for your organization account as it is to stop. And in particular what I'm talking about here is paid subscriptions. It should be as easy to start a paid subscription as it is to stop it. If I can just go on your website and pay with a payment card and get my account and that's it, that's great. But if I then have to call a call center or you know, go through an onerous process to cancel that subscription, uh, you are a bad company.
Morgan:I would agree with that. Um, it's really frustrating and I think actually some companies, especially I think you see kind of, there are some fast fashion sorts of companies that have like a subscription-based model and tend to target young users. I'm thinking of sort of pre buy-now-pay-later schemes that are sort of becoming really popular at the moment and have been accused of being like quite predatory. But there were some almost like finance like credit card type things that I remember popping up back when I started uni and I had a few friends that kind of got sucked into these and had like real trouble cancelling their accounts and sometimes we would get billed for things that they hadn't bought and like in order to cancel their account or to delete their account and, and stop being billed for those things, they would have to call a call center like several times. Um, and it was just luck of the draw if they got through to an understanding kind of team leader or somebody who would let them cancel their account. And it really shouldn't be like that. Like you've gotta consider vulnerable people and vulnerable customers and the user experience. Um, and I don't think that's always at the, the forefront of people's minds when they're designing these things.
Holly:Just looking up, do you know what the um, the EU regulation is that makes that illegal? I ironically cannot bring it up because I've got one of those cookie popups,
Morgan:<laugh>, oh that's super annoying. Cookie warnings. Something that I see quite often with those actually is the, the menu will pop up to say accept all cookies or accept selection and they will deliberately have highlighted the accept all cookies box so that people will just click that without reading. Which means that I guess like app tracking and so on is more permissive than it needs to be. You're not just accepting the necessary profiling and so on as a user, um, and they get more data about you than they should just by virtue of making it a really annoying process. And you might just wanna be on that webpage for 10 seconds to double check something or to find a piece of information and then leave.
Holly:This is, this is one of those things when it comes to user experience though, it's making it visually obvious to the user. Like which is the, the good and the bad button for example. So this is something that, that I've been thinking about with our software. If the button is to delete data, uh, it is a different color and it is always in a different place. So typically when you navigate our menus, the okay button is the theme color and it would be on the right hand side, but any button that deletes data, uh, so to delete a vulnerability to delete an asset or something like that is a particular shade of what, what we called danger red, right? It's like in the CSS file it's called"danger". It's always on the left. The idea being it's like a slight inconvenience to the user of that button is in a place that you won't accidentally press it, but it's just making it so that it's a conscious decision for the user. Like this is gonna delete something or, or get rid of some data or purge some data. So it can be positive and negative there. We're using user experience to try and prevent the user from accidentally doing something.
Morgan:I really like how um, AWS dealt with this actually because they used to have quite a lot of incidents and people had plenty of, of data breaches that were due to deploying like incorrectly configured S3 buckets that were like exposed publicly. So what they've done is they've made it more difficult to do that. Like the barrier to creating a public S3 bucket is more difficult and by default everything is private. But in addition to that, for anybody listening how I share these recordings with Holly, we, we record separately and then pop recordings into an S3 bucket and I'd send Holly a pre-signed URL that's valid for a certain length of time so she can download the files so we can edit. And what Amazon Web Services do if you haven't used it before, is if you wanna delete something from an an S3 or if you wanna permanently delete a resource or something like that, they'll make you write out the words permanently delete, um, in a text box that kind of at the bottom of the webpage before it will delete the resource for you. So it just slows you down a little bit and double checks that that's what the user wants to do. And it's slightly inconvenient but it means that you're not gonna delete something that's critical
Holly:Sometimes as well when it comes to like more complex flows. I mentioned this idea of following the user home, right? It's like putting a user in front of the software and and watching them use it. Sometimes you get good ideas for features that way as well. So on our dashboard at the top of the dashboard, it displays the count of vulnerabilities that you currently have. So like low, medium, high, critical. And one of our users on a follow me home, he sat down and clicked one of the what we call dashcards, right? These, these displays at the top of the page and that doesn't do anything. We hadn't programmed it to do anything. So then we, we ask him, it's like why did you click there and what were you expecting? And what he was expecting was, if I click the number of high vulnerabilities it should take me to the page where it gives me more information about those...and now it does. So you know, by understanding more about not only how your users interact with the page, so like having a heat map of mouse placement and things like that, but asking the users about what was in your mind at the time that you took that action, what were you looking for or what were you trying to do? Sometimes you just get better ideas for how the page should be laid out, right? Because we're looking for the page to always be intuitive and that can sometimes be difficult because it depends on the context of the user. But yeah, sometimes we get good features from users just by asking them what did you expect to happen?
Morgan:How do you track that? Cause like I don't, I've never worked in kind of um, a UAT team or anything like that. Um, that's not usually the part of a project that I'm working on. So how, like what kind of tooling do you use? How do you assess those things? Is there anything that you look for specifically, um, or any flags that prompts you to ask those questions? Do you have like a screen recording of a user's session? Like how does it work?
Holly:Uh, on the simple side it can just be things like I mentioned, um, heat maps of mouse position. So if you are uh, using something like that, you could be monitoring every user session to see- how do users navigate the menus? Are there any menu pages that they pause on for a long time that could be an indicator that they don't understand it or they're trying to work out what to do next? That's very common. That isn't necessarily what we do. What I was talking about there, this idea of follow me home, that's way more intensive, so that is literally effectively interviewing users. So sitting a user down in front of you in front of the application, this could just be a video call with a screen share, but the idea that you are sitting together and, and they're interacting with it and then effectively interviewing the user afterwards as well and talking to the user about kind of their mental state as they, as they run through those things. We would only do that, that's obviously quite onerous. We would only do that for like major feature releases and things like that or the uh, very common workflows that could be, uh, doing something like please try and register an account or please try and delete your account and see if they can work out how to do that and see if the menu is intuitive enough for them to do that. And then, uh, hopefully, you know, they'll be able to interact with it easily and then asking questions about their approach, why they approached it in the way that they did things like whether they thought the menu was intuitive and then also what were they thinking at at the time of doing certain things. So what we tend to do is more inline with like the Lean Startup and Sprint approach of put it in front of a user and ask the user about it.
Morgan:And do you find, or, or have you found or noticed that user behavior changes when they're being observed or do they respond and and interact with things in pretty much the same way as they do when they're not being directly observed?
Holly:Uh, the Heisenberg uncertainty principle. I can't...
Morgan:<Laugh>
Holly:I can't tell what users do when they're not observed. I can tell you how fast they're moving but not where they are.
Morgan:<laugh> it's like Schrödinger's user, they are both using the app correctly and breaking your entire website when you're not watching.
Holly:<sigh>
Morgan:If a user falls in the woods, does the app still work as intended?
Holly:If an unobserved user falls in the woods, then no, I have no idea because he was unobserved. I don't know what the users I'm not observing are doing, they are not being observed. What do you want from me woman?
Morgan:<laugh> Well I mean I suppose it, it would probably appear in things like um, the session length or if um, the signup flow completes as expected or if you get any weird queries or errors from those users like that might, that might give you a...
Holly:Oh we do monitor those things. The application has...what one user referred to as like an immune system. What this is is there are metrics about the application that we monitor, not because we are looking for some specific thing has happened, but that it is an indicator that something has gone wrong. So, um, how many logins occur on average over what period of time, how many registrations occur over what period of time? And then of course we're tracking like errors within the system and things like that. Something that, that is interesting is tracking when a permissions violation occurs. That could be a security event. A user is trying to do something that, that they're not supposed to be able to do. Or it might be that that group of users don't understand how the permissions model works. So for example, it that action requires you to be an administrator but they don't know that. So we, we track all kinds of things about the system but yeah, um, if uh, if logins suddenly fall off a cliff you may have broken something like the login form<laugh>.
Morgan:I remember that one.
Holly:So we, we do, we do monitor those things quite, quite closely. But no, in terms of getting an understanding for like the usability of the software, we occasionally sit down with users and and uh, task them and then ask them about how they approached it. Especially when it comes to uh, a new user. So if we have a new subscription on the platform, we'll likely follow up with that user of did they find everything that they were looking for or did everything work uh, in a way that they expected. And then we also look at the order of how they approached tasks as well. So there's kind of, you can imagine some, some standard user stories for using the software and we would look at which items did they do first cuz that might be indicative of something. It could be simply indicative of one of the menus that they needed. They couldn't find...
Morgan:Whereabouts on the, the difficulty scale. Does introducing your application to users for this kind of testing fall? Is it more difficult than the actual development itself?
Holly:It is only more difficult than the development itself in the sense that users will do weird things and get themselves into weird edge cases that you never imagined. And um, you might also see this if you watch things like play testing with video games where you would imagine most video games have got a really simple layout, a really linear story, but users might find themselves just in an odd place in the game or in the case of video games, users might purposely be trying to like glitch the game to do things that they shouldn't be able to do and those kinds of things. That could be a security event or it could just be someone doing something fun. So it's not necessarily uh, the follow me home stuff where, where we're talking to a user but sometimes we might see an error come up or a user has hit a permissions violation or something like that. We would investigate that and find out that the user has just done something unexpected. I'll give you an example of this. Users can register to use our software if they would like to, but most of the time we are going to create an account for that company and then we will send them uh, uh a link that they can click to gain access to their account. For security reasons, of course there's limitations on that link. One of the limitations is uh, it's only valid for 24 hours. Very often, you know, users have got things to do, you know, people are busy, they might not get around to it for 24 hours. So in the email we just add here is the link to access your account, it is only valid for 24 hours if you need it to be regenerated, let me know. When the user clicks that link and it has expired... What the application does in response to that is interesting cuz you have like uh, a few different options, right? It would be no good to send the user to the login page or something cuz they can't log in, they haven't been given access to their account yet. So what do you do? You have to present a roadblock to them. But how do you do that? Of course we have like a banner notification system so when you click the link at the top in a bright color, it's gonna say that link has expired and give you some explanation about the security and and why the link's expired. So we kind of thought that maybe that would be obvious. The user would see the link has expired, it's put them on a page to request a new link, but then you, you find users just um, doing strange things like uh, not noticing that the email said this link expires within 24 hours and not noticing the banner at the top that says sorry that link has expired even though it's in a bright color and then navigating away from that page. And of course the banner then closes. So how do we handle that stuff? We had one user for example, who clicked the link. The link had expired, it popped up at the top and said that that link had expired and then for some reason, he just waited and he waited for 30 minutes and eventually he emailed us and said, I haven't received another link. And it, it seems after discussion with him that he thought if the link had expired it would automatically send him another one. And of course it didn't. So that strange<laugh> incident we had with the user, the user literally just like sat on the page for 30 minutes because they presumed that was what would happen. Of course we then go back and redesign that form to either be more explicit or sometimes we think, hey that is a really good idea actually if the link has expired maybe it should just email you another one. So sometimes you get good ideas out of it and sometimes you just get confusion about why would a user, why would a user, do that, why would a user think that? But yeah, very often, hopefully less these days but you know, when software is new you get users doing strange things and finding themselves in edge cases.
Morgan:Yeah, I think on the, the other side of it as well, I recently bought a TV and it's a smart TV and you can install various kind of Android apps on it. The things that I'm probably gonna use it the most for are kind of standard streaming services like Netflix and Amazon Prime, Disney+, whatever. Um, and there's a Spotify app as well. Adding these apps to like the carousel, the the home display screen was completely fine, really easy logging into those apps, for the most part: fine. So with Spotify you have to open the app on your phone, you need to be on the same kind of wired-less network as the, the TV is so connected it to the wifi first and then basically cast whatever song you're listening to, to the tv. Why are you laughing?
Holly:Because you said wired-less.
Morgan:No, I'm gonna do this again. I'm gonna just cut this whole thing out.
Holly:That's, that's my facial expression of my brain going:"I dunno how I'm gonna fix that in post."
Morgan:<laugh>
Holly:I'm just gonna cut the the the letter D but then it's like did you want wired? or did you mean wireless?
Morgan:I'm gonna do it again. I'm gonna do it again.
Holly:Just say, just say the word wireless and then I'll transpose and fix it in post.
Morgan:<laugh> No. So, So! I recently um, bought a tv, I'm probably gonna use it the most for like Netflix, Amazon Prime, Disney+, that kind of thing. And there's a Spotify app too and I'm a Spotify user. So downloaded all of those, logged into, and that was a really straightforward experience with Disney+ and Amazon Prime cause you basically scan a QR code and then it asks you to approve that via like your smartphone. With Spotify you have to be on the same wireless network and then you basically cast whatever song you're listening to to the TV having connected it to the wireless network first. So that's fine. With Netflix it was a bit of a pain comparatively, you have to like individually enter every letter of your email address and then the password for that using like a remote like you can't, you can't use a keyboard so you kind of pressing this button like repeatedly to go from like one side of a, a keyboard that's displayed on your TV to the other side and if you like get it wrong or you put the wrong password in, then you have to go back and do it all again. Like you can't use a password manager or things like that. So massive pain.
Holly:I made a joke at the beginning of this episode about like picking a phone number by just like pressing the up key until you get to the right phone number. And you are describing an application that effectively has that UI<laugh>.
Morgan:Yeah and it's like, it's a bit of a weird one actually because you expect better from Netflix now you would think that they would maybe look at what Amazon Prime and Disney+ are doing and maybe even what Spotify are doing and let you cast from another device on the same network or something but they just seem to have forgotten about that workflow.
Holly:Or just get a user and put it in front of the app and then say please try and log in and watch how much of a difficult time the user has. I think it's often uh,<laugh>, it's very often obvious to me where some people who make apps don't use their own app. I sometimes definitely get that feeling from companies where I'm just like having a horrendous user experience and it's like nobody in this organization uses this app, do they? Cause all of these problems would very quickly be found.
Morgan:Oh there's another example of this actually, which is ridiculous. So there's a native mail client on iOS on my iPhone that I've connected a couple of my email addresses to, now I enabled two-factor authentication turning on two-factor authentication, broke the mail client and now it doesn't update anymore. So I have to use a third party mail client on my phone to be able to check my emails for that address. That's stupid. That's so dumb.
Holly:There used to be a great bug on iPhones where if you scrolled back in the calendar really far to about 1840, the calendar would just break. And uh, I've got some screenshots I can probably share of that of where you'll find like February has seven days and two Thursdays and stuff like that...
Morgan:<laugh>.
Holly:and it's like I get it from that, that point of view of just like maybe you should just set some limits and you know, if a user is trying to book an appointment in the 1800s, they've probably gone wrong somewhere and you can probably just put up a block on that. But yeah, definitely there is some weird edge cases that you get with software if you're not, if you're not careful.
Morgan:I think that one's pretty standard though, right? Like I wouldn't consider using multifactor authentication to be like an edge case, especially given that we encourage users to adopt it so widely now.
Holly:It depends on when the app was built. If the app is still supported...
Morgan:Well the app should still be supported cuz it's in the latest version of iOS. But yeah, it's like, it's not like a weird kind of 2FA that no one's ever heard of before. Like I use Google Authenticator for a lot of things and I recently got a Yubi key. It should work with those. I might, I might tweet at Apple,
Holly:Well you can't email them, can you?
Speaker 3:<laugh> You would be correct.
Holly:Yeah, so we've talked about like, uh, user experience and some bad examples of user experience. It is really hard to talk about the good examples of user experience cuz like we said before, it's like, you know, when you've got a bad user experience but kind of explaining what makes it a good one is, um, pretty difficult. But there are some things that companies can think of and software developers can think of. And a lot of that comes down to accessibility stuff. So trying to work with users that have certain limitations. Visual impairment; it could be simple things like colorblindness or it could be visual impairment where they need the screen to zoom and those kinds of things. Working with screen readers, I think this is something that developers should always keep at the back of their mind of just like, how is a user gonna navigate around this site and is it gonna work for users who have accessibility restrictions? For example, can I navigate this site using a keyboard? Those kinds of things.
Morgan:I was thinking of like those old video games. Um, you know, they're like text based ones where you'd have to use like your keyboard to select options, like tab between like different options and then it's like kind of a choose your own adventure type logic game.
Holly:Is this a text based game that you've been playing or are you just trying to exit Vim?
Morgan:<laugh> This is uh, an Easter egg reference to Holly's tweet that's just annoyed everyone on Twitter.<Laugh>
Holly:So yeah, from the, from the accessibility side of things, there's a lot of different things to consider, but thankfully, like I said, there's a lot of good resources out there. You also still see some pretty major organizations making basic mistakes. The ironic one that I showed you earlier was Microsoft advertising, you know, making the web more accessible and then picking really terrible contrast, uh, color options so that if anyone was colorblind, they probably couldn't read the advert about making the web more accessible.
Morgan:The one that annoys me is when you are, you know, like browsing a news page or, or a blog or something and there's an advertising banner at the bottom of the page and the like close-banner button is so, so small that you accidentally end up clicking on the advert and it takes you away from what it was that you were originally intending to use. That's a really bad user experience. I'm probably never gonna visit that site again.
Holly:Yeah, there's maybe some bias there with advertisers who want you to click on the advert because that is when they charge the person whose advert it is. Sometimes you just get presented with an advert. Maybe this is like a video advert on YouTube or something like that for a product that you just have absolutely no requirement for, but it won't let you skip the ad. You've gotta watch the whole thing, you know, it's like, um, oh this is the best cat food on the market and it's like, don't own a cat. Let me skip.<Laugh>
Morgan:<laugh> Yeah, I'm, I'm old enough to remember YouTube before they had mandatory ads, which probably isn't saying very much, but it feels like a lifetime ago because I'm sick of seeing ads every time I wanna watch a video and that's why I don't use YouTube anymore.
Holly:Artificial Podcast is available on a range of platforms including YouTube,
Morgan:<laugh>
Holly:I def-, I fully understand I'm in a very small demographic of people who listen to podcasts on YouTube. YouTube get on that. You should have a podcast specific section on your website. Podcasts would greatly benefit from having algorithms.
Morgan:Do you know what else they should do though? Because I don't know if they've, they've fixed this yet, but the YouTube mobile app, if you navigate away from that, it stops playing, or it did last time I used it anyway. It's really annoying.
Holly:Yeah, yeah, it's intentional. Um, if you, if you want that feature, you get YouTube Pro.
Morgan:I didn't realize that there was an alternative to that. Every other service that you use, even if you've like not got Spotify premium, it will continue to play in the background. If you minimize the app and do something else, it's horrendous.
Holly:That's a great feature that you can get if you give them money. Here's a funny user experience problem that I had recently, but you pointed me at AWS's recent machine learning event that they ran online. So I got my iPad and put it on my, my desk and I, I logged in to, to watch the stream and the stream would not load on an iPad. I think it's because the stream loads in a pop up as opposed to it in the browser window. Either way it didn't load, but because I got there early cuz it was excited for this event, I opened it in the browser. It says starting soon, click here to watch a click here and then it just gives me a blank page. So I thought that it had just not started yet and I missed the, the opening. It's fine if it fails. It's like, like failing isn't a good thing, but failing and telling me that you failed is better than silently failing.
Morgan:Yeah, I've had this, um, oh I've had it for ages and ages now, probably like near a decade. I've got like a Kindle Fire HD that I got when I was like in my late teens and somehow it's still going, it's still kicking. It's pretty sturdy, bit of kit actually, but um, it's the perfect size for me to kind of carry it from room to room if I'm working and not have to like unplug my laptop from my monitor and carry it around with me.[It's] just not compatible with a bunch of stuff that I wanna do.
Holly:Is it compatible with TLSv1?
Morgan:<Laugh>
:What are we talking about next? So are we doing uh, good user experiences then?
Morgan:We can do good user experiences if you can think of any.
Holly:For me it's just, it's in the small stuff. So for example, like if I'm logging into a website and for security reasons when I get my credentials wrong, it doesn't say like, your user was wrong or your password is wrong cuz it doesn't wanna disclose anything about the account. When it sends me back to the login form to try again pre-populate the username field for me, I gave it to you once, right? You, you can give it back and then that would allow me to see if I'd misspelt it or something like that. So it, it's a lot of little things like that, thinking through kind of all of the failure modes for all of your forms and making sure that it's clearly explained to the user what went wrong, what the user can do about it. The form should be to the most part, pre-populated with, with details as long as it's not sensitive details to be sending back to the user. Those kinds of things. For example, one of the little ones on, on our website is as you fill in the form, so something like the registration form or the login form, if you give it valid input for a field, the field turns green. So you know, if you type your password and then type the password again for the confirmation on the registration form, if they match, the fields turn green. And it's just like little things like that, like a visual indicator to help you through the process. Um, small things. Here's a, here's a silly one: Progress bars. How do you make the user feel like the progress bar was a good experience, right? I think everybody knows the bad experience of those progress bars where it, you know, it's completely erratic and it's like seven days, one minute, four hours, one week.
Morgan:<laugh> Do you remember that time you were updating MacOS years ago and it said about a minute for like three hours and it was like the meme for that week. Anytime you didn't know how long something was gonna take, you'd be like about a minute.
Holly:Yeah, an Apple minute. Um, so here, here's a thing you can do, there's actually a lot of whitepapers out there about, um, how to make progress bars feel better to users but: artificially slow the progress bar down for the first half so that you can speed it up for the second half.[This] will often leave the user feeling it went faster than it did. Sometimes as well, when it comes to like, uh, users having a bad experience, the problem is how do the developers find out about that? Because you can't fix it if you don't know it. And we talked about a couple of things earlier, like what, what we at Akibmo do. Um, I think one of the best examples of that is actually the video game Subnautica. So Subnautica had a feature where at any point in the game you could hit the F8 key and then you could give them feedback. So there's like a message box where you could type something and then you could kind of give like an emotional response to like, this is really good or this is really bad on, on a sliding scale kind of thing. And I think this is one of those things where like as a developer it can kind of be, um, maybe a little bit scary to...if a user bumps into an error or a permissions violation or something goes wrong immediately giving them a button to say, tell us about that. But the cool thing about Subnautica is they also received a lot of positive feedback of just users telling them like, I liked this, or I did this thing in the game and I really enjoyed it and kind of then being able to plot a heat map of where in the game users gave them that feedback and whether the feedback was positive or negative and what it was. So that helped them get over a lot of the problems of, how do you know what a user is feeling? Give them a button so that they can tell you how they're feeling. And it also allowed them to pick up a lot of quite subtle problems as well where maybe it wouldn't be obvious to the developers unless they sat down and talked to a user and sitting down and talking to everyone is maybe infeasible. So they just get a stream of data that allows them to, to run some analytics on that and find some stuff out.
Morgan:Yeah, I think that's really cool actually. And it sort of links into what we covered in our episode about startups where you'd build sort of, um, I dunno, more of a a tracker button or like a dead button or something for a feature that doesn't exist yet, just to see how many people interact with it. And then that lets you like prioritize on your product roadmap what it is you wanna build next. If you've got that sort of heat map of where the pain points are in a process or a game or an app, whatever it is, that lets you prioritize which areas you need to fix or improve as a priority and which areas are kind of okay for now actually.
Holly:Yeah, and sometimes as well in the video game context, it isn't necessarily like a pain point or anything like that. You know, they might get feedback from a certain position of the game that says"this is terrifying". And you know, in the context of the game, that might be a good thing if that's supposed to be a, a scary aspect of the game. Or it might be, you know, in the context of broader software users having just an idea or like what to them is a frustration. So for example, one of the forms that we have, it tries to parse the input that you give it. So if you give it an IP address or a hostname or a URL, it tries to determine what that is and then takes different actions depending what you gave it. And one of the things there would be before the user submits that form within the form itself, tell the user what, what you thought it was. You know, I am interpreting this as an IP address or I'm interpreting this as a hostname, that might help the user out in some way. So just kind of giving that, you know, making it almost like a two directional in terms of helping the user out with filling those forms in. I was installing um, Windows recently. Um, I think it was Windows, I'm not gonna say the offering system cause it might have been Mac. I was installing an offering system recently and uh, it asked me what keyboard layout did I want and the keyboard layout was not alphabetical. I-, the one where it's like alphabetical, but common ones like US are at the top...it frustrates me, but you know, I, I can kind of, um, see it and I had to scroll down for so long to find it. And of course one of the problems with being English is, uh, sometimes these forms might say United Kingdom or Great Britain or England, you're not really sure which one you're looking for. And it's like so far down in the list and I, I was just passing like all of these different keyboard layouts that I'd never heard of before. I eventually got down to like QERTY GB<laugh> just like alphabetical would've been, would've been okay at least.
Morgan:Yeah, that is something that really annoys me to be honest- and also how software defaults to American say like US English and then it'll, it'll highlight things in red for like spell checker. Like it'll tell me I've spelled favorite wrong or color or something stupid like that. That really frustrates me and it's such a small thing from a user experience perspective. But if I've told you like 10 times that I'm using like British English, don't tell me I'm spelling- like I have an English degree.
Holly:I thought your degree was a French degree<laugh>
:There's only a little bit of French in there and I don't even...I don't even speak French.<laugh>
Holly:Uh, a difficult example of like getting good user experiences, anything that uses time zones. For example, I work with a lot of organizations in different countries, so I might be working with an organization in Africa or an organization in America and if we're looking to book meetings together, I want to not only be able to select a time that is convenient for me but not be selecting a time that's like midnight for them or something. So ideally I want to see both timezones next to each other and also I travel a lot and some things I might want to adjust so that it shows me in the timezone that I am currently in and some things I might want it to, uh, adjust to the, to the timezone back home. And very, very often software just does not handle timezones well at all. Not from a understanding timezones and being able to handle them, but just from that user experience of like the ability to like book a meeting whilst looking at maybe three time zones and picking the one time that's good for everyone. You know, if you've got somebody in the US, somebody in England and somebody in Singapore,
Morgan:I think that's really useful actually. And definitely something to consider because you've got, especially in cyber security, you've got a lot of like global security organizations or like managed security service providers who might have like a global, SOC with a follow-the-sun model and they'll need to book a meeting with like the US team and and the UK team at a time that, like you say, is not the middle of the night or after the UK team have finished work or something like that. And yeah, like it's wild because some of these like massive technology companies just haven't thought about that, but there's some startups in this space as well that are sort of changing the way that we approach things like that. So I'm interested to see if they'll introduce any of those features.
Holly:Yeah, I think that's one of the things where once you have a, an example of it being done right, it's much easier to point at like, please do it like this. And sometimes it's extreme examples like one in America, one in England and one in Singapore and sometimes it's not. It might just be like somebody in England, somebody in Central Europe and somebody in eastern Europe and just trying to, you know, pick a time so that you don't put it two hours after somebody's finished work or something. It doesn't have to be huge gaps. But yeah, I think I can definitely tell you if a user flow is a terrible experience, but coming up with examples of good user experiences, is sometimes difficult cuz you don't really think about them. If it, if it goes well, you don't really think about it. And that's the trick.
Morgan:Yeah, that's what I meant earlier. When I said that it doesn't necessarily stick in your mind if it just goes well it's seamless, it's smooth as expected.
Holly:Anything that uses a slider and will not let me enter an absolute value. So if it's like, you know, I see this a lot with video editing software. This is usually where it's painful where it's like a slider for maybe rotating some footage or something like that and it's like zero and you can slide up to 360 degrees or it's maybe the scale of something, it's like, just let me type the number I know what I'm looking for.
Morgan:Something that I like is, um, Airdrop actually, if you are like part of the Apple ecosystem or I guess, um, if you're an Android user, Oh, when I'm a shopping for TVs, I saw this. If you've got a certain type of Samsung phone and a Samsung TV, you can just tap the TV with the phone and it casts automatically. That's pretty cool.
Holly:<bang>.
:And then you've got, have you got a Samsung?<Laugh>
Holly:Just Airdropping something to my iPad<laugh>.
Morgan:Um, and if you've got<laugh>, yeah, if you've got, if you've got an iPhone and a Mac and Airdrop enabled like Bluetooth turned on and all of that, um, you can just cast webpages or whatever it is to your Mac or to your phone, you can drop like pictures seamlessly. And that's just a really fluid experience. If I'm looking at something on my phone and actually I wanna give it a bit more attention or I, I need a bigger screen for something, I can just throw it at my Mac. And then...
Holly:Sometimes you, you're just moving as well. So maybe like you're watching YouTube video on your phone, on your walk to the office, you know, and then you get to the office and you wanna put it on the screen kind of thing.
Morgan:Spotify do that really well as well. Like you can just pick a different device and, and cast. I think we should wrap it up.
Holly:Iv'e burned 1500 calories today. We've got no idea what I'm talking about anymore.
Morgan:Yeah, you, Yeah. You seem like you need t o lay down in a snack.< laugh>.
Holly:I've got my cheese sandwiches just over here next to my, my, uh, parking fine.
Morgan:<laugh> Okay. Um, so in a, in a nutshell, user experience, um, what's the hack, what's the life hack for UX?
Holly:Uh, I'll give you another bad example of, um, of user experience just to close out the episode, then you wanna make sure that the user is fully aware of what's happening at all times, and especially for like long running processes, You know, if it's gonna take 5 minutes or 10 minutes, something like that, you know, if they're maybe watching a progress bar, you need to make sure that the user is, you know, aware that it's still going, it's still working in the background and it hasn't just stopped.
Morgan:That's not how you're ending this episode. No way. I'm not allowing that. No, no<laugh> Why do you do this to me?