Hacker News Reader

Comment by politician | Hacker News Reader

Regarding error messages: At a previous gig, we had to aggressively and repeatedly fight the business side who thought that vague credit card error messages were a large source of user confusion. Eventually, we won but it was certainly an eye-opening moment for the developers involved to even have to fight that battle.

View on HN

I've had the same argument many times over error messages for login and forgot password flows. Being security conscious is a way of thinking that many people aren't really capable of and an even greater number have problem maintaining consistently. It's so ingrained in product managers to make their software as friendly as possible that they forget that sometimes their users don't have similarly noble intentions. This is also why social engineering is so successful. When it's your job to be helpful, it's very difficult to be strategically unhelpful when necessary.

If you have a sign-up page, the usual "invalid email or password" message on sign-in form doesn't increase security.

Score your users based on attributes like whats in cart, IP reputation, browser/os, pages visited, source,3rd party fraud detecton providers etc. Score should reflect how likely the user is genuine or not. For well scoring users which should be 90% of your traffic, provide them with detailed messages.

I wish sites like newegg would treat customs with successful transactions as safe. I've had many times where they've outright canned an important order for really no reason. Trying to get them to accept it is a whole other hassle.

Vote with your wallet. I don't think this is common behaviour.

I have been. Despite it sometimes costing more I buy all my drives from other vendors. Mostly been amazon recently. They're cool with taking my huge orders.

There are tradeoffs, you have to balance security with usability. Generic payments failure messages are responsible for a lot of frustration in users, especially users who are paying online for the first time and have to go through complicated payments processes like 3D secure.

As a programmer, I get it, but as a user there's been a few times where I fat-fingered a number or an address and the payment failed - it was then a minor PITA to figure out exactly what I got wrong.

Reply on news.ycombinator.com