Usability problem of the day (a revived Facebook hoax)

In the courses I teach about human-computer interaction, I typically open each class with an example of a usability problem. I'm putting these online, in case others find them useful.

Privacy in the digital age is complicated and sometimes confusing. If Randi Zuckerberg can't figure it out, despite being a former marketing director for Facebook as well as the founder's sister...

Sometimes usability problems can make things worse. Let's consider a persistent Facebook hoax. One of your friends posts something along these lines:

To all my FB friends, may I request you to please do something for me… PLEASE place your mouse over my name above (do not click), a window will appear, now move the mouse on “FRIENDS” (also without clicking), then down to “Settings”, click here and a list will appear. REMOVE the CHECK on “COMMENTS & LIKE” by clicking on it. By doing this, my activity amongst my friends and family will no longer become public. Many thanks! Paste this on your wall so your contacts would follow suit too, that is, if you care about your privacy -- which I know we do.

This is a clever bit of malice for a few reasons. Let's walk through the process to see how usability figures in.

 You hover your cursor over a name and wait for short period of time. This takes slightly more concentration than moving and clicking.

 You hover over Friends until a menu pops up.

You click on Settings.

You move down to Commands and Likes and uncheck it. Done!

Of course, what you've really done is not as described in your friend's post. Instead you've removed your friend's comments and likes from your newsfeed, significantly restricting that person's interaction with you.

And if you continue to follow the instructions, you'll ask other people to do the same to you. That makes the hoax viral.

Facebook menus violate a standard guideline: Menus should have titles. This isn't arbitrary; menu titles give the context for you to understand what the options in the menu are for.  On the last menu I've shown above, the options are related to Friends, but to get to this menu you've had to click on the item "Show in Newsfeed" on the previous menu, and that information is no longer shown; you need to remember it. It's also possible that the hover-and-wait action is a little bit more difficult than the more familiar point-and-click, adding a bit of distraction.  These extra cognitive demands might not be a problem in every situation, but they certainly are when someone has explicitly given you the wrong impression about what you're doing.

Mechnical Facebook flaws aren't the main issue, though. This hoax is really a social engineering exploit. Take another look at the message:

To all my FB friends, may I request you to please do something for me… PLEASE place your mouse over my name above (do not click), a window will appear, now move the mouse on “FRIENDS” (also without clicking), then down to “Settings”, click here and a list will appear. REMOVE the CHECK on “COMMENTS & LIKE” by clicking on it. By doing this, my activity amongst my friends and family will no longer become public. Many thanks! Paste this on your wall so your contacts would follow suit too, that is, if you care about your privacy -- which I know we do.

If you've read books about scam artists (Frank Abagnale's Catch Me If You Can and The Art of the Steal are good examples) you'll already know how well this can work. Here it's taking advantage of personal connections and pushing the friendship/favor/family buttons as hard as possible. (It even works in non-native American English, surprisingly enough. I've seen this version appear in some of my American friends' posts.) How could you refuse? Your friend is making such an effort to be persuasive...

It's worth paying attention to the social angles in computing. Online you'll find explanations of the hoax that say, 

“This is how Facebook privacy works…”
“All this does is hide a friend’s activity…”
“If you read the technology news, you’ll see that Facebook hasn’t changed its policies lately…”

But these are technical explanations. You also need to understand the human side, both to see how it works and to protect yourself from scams based on technical issues you might not understand.