Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Friction is Good: Let's add it to our digital experiences

theregister.com

Post reply on HN
Print view View original

21–30 of 46 posts

Re: Friction is Good: Let's add it to our digital experiences

#21

Post by samatman »

rglullis wrote: post #18
bluGill wrote: post #11

This article is light in details, but I'm going to guess that the money stolen was crypto of some sort. It is unlikely you could pull this off with regular banks as banks log everything. Sure if I gave you my checking account number you could take all the money I have in there - but the banks all know who got that money and so when I go to the police there is a trail to trace and much higher odds I get it back. This…

It says right in the first paragraph it was crypto. Still, if you think the problem doesn't apply to "real money": there was this story in Brazil some years ago of thieves going around to Carnival parties with NFC-enabled payment machines. They got away with hundreds of thousands of BRL just by walking in the middle of the crowd with the machine set to collect a small payment. IOW, people were getting robbed because…

There is no way to set Apple Pay to activate without user input, is this not true in Android?

Re: Friction is Good: Let's add it to our digital experiences

#22

Post by wlesieutre »

samatman wrote: post #21
rglullis wrote: post #18

Earlier quoted context omitted.

It says right in the first paragraph it was crypto. Still, if you think the problem doesn't apply to "real money": there was this story in Brazil some years ago of thieves going around to Carnival parties with NFC-enabled payment machines. They got away with hundreds of thousands of BRL just by walking in the middle of the crowd with the machine set to collect a small payment. IOW, people were getting robbed because…

There is no way to set Apple Pay to activate without user input, is this not true in Android?

Tap-to-pay NFC credit cards

Chip and pin or even chip and signature is just too much effort to pay for something

Re: Friction is Good: Let's add it to our digital experiences

#24

Post by nurbl »

atahanacar wrote: post #3

I don't understand what the writer is proposing here. How is slower = secure?

Consider that in a world where almost everything is automated and reacts quickly, some faulty logic somewhere could cascade and lead to a lot of bad stuff happening before anyone even has a chance to notice. Introducing some latency, need for validation, etc, at the right places could mitigate this. I don't think just sprinkling slowness everywhere is the idea.

I do think that the efficiency hype has made us all a little speed blind. It's not like faster = secure either...

Re: Friction is Good: Let's add it to our digital experiences

#26

Post by aqfamnzc »

wlesieutre wrote: post #22
samatman wrote: post #21

Earlier quoted context omitted.

There is no way to set Apple Pay to activate without user input, is this not true in Android?

Tap-to-pay NFC credit cards Chip and pin or even chip and signature is just too much effort to pay for something

To do this, are they using some kind of modified payment terminal with extended range somehow? My understanding is that the NFC coils have to be very close, like single-digit cm to get any kind of power or data through.

Re: Friction is Good: Let's add it to our digital experiences

#27

Post by aqfamnzc »

thfuran wrote: post #25
raspyberr wrote: post #2

>For sixty years, computing has emphasized speed I wish day to day software emphasized speed

It's frankly amazing how slow a lot of everyday stuff is given how damn fast modern hardware is.

It sure seems like modern hardware's speed is wasted on making things slightly easier for devs, rather than speed or performance increases for users huh. If 29 layers of abstraction saves a little dev time over 5 layers, that's fine, but it feels like it creates this unnecessary requirement to use <5y old hardware to run things smoothly

Re: Friction is Good: Let's add it to our digital experiences

#28

Post by GauntletWizard »

aqfamnzc wrote: post #26
wlesieutre wrote: post #22

Earlier quoted context omitted.

Tap-to-pay NFC credit cards Chip and pin or even chip and signature is just too much effort to pay for something

To do this, are they using some kind of modified payment terminal with extended range somehow? My understanding is that the NFC coils have to be very close, like single-digit cm to get any kind of power or data through.

At carnival in Bazil, you bump into people; Like, when they talk packed streets, they're talking body to body contact filling the street for blocks and blocks. All you'd have to do is put a terminal around your waist and you'd get close enough to activate NFC for hundreds of people just pushing through the crowd.

https://en.wikipedia.org/wiki/Brazilian_Carnival#/media/File...

Re: Friction is Good: Let's add it to our digital experiences

#29

Post by ToucanLoucan »

marcosdumay wrote: post #15
pram wrote: post #12

TurboTax has this kind of “performative slowness” to convince you it’s doing more than it actually is. It has pointless loading bars and spinning wheel pages as you navigate through every section. I definitely wouldn’t be an advocate of replicating it.

The article is asking for functional slowness, not performative. And it's a quite popular opinion, because almost every channel has some form of it, and he had to go way out of his way into cryptocoins to enable the problem to happen at all.

One could argue though if you're purposely designing your systems in such a way where they operate slower than they could otherwise, that in itself is just performative slowness.

Most of the processes that I think this author wants to see adopted don't even need to be slow, necessarily. More than anything it's just shocking how much modern software is so utterly bare bones in terms of features, especially around security. While I was attending a therapist not long ago, she had me use an app service I won't name to manage my appointments and payment information, and every login was done with a magic link. This was both annoying, because the app wouldn't stay logged in for a certain amount of time at all and I had to have it send me another password link every time I used it, and also ineffective, because if my email was compromised, nothing was stopping that actor from getting full and complete access to this app.

I don't think it was necessarily a huge risk, but there was literally no options for this. No MFA, not even a password or a PIN to set for stuff like billing information. I could see this being an absolute nightmare to unwind if you happened to have your email breached.

Re: Friction is Good: Let's add it to our digital experiences

#30

Post by ghaff »

klabb3 wrote: post #4

It’s not terribly difficult in case of financial transactions. Just separate into queueing and executing, with an auto-timer, notifications (email, push etc) and an option to cancel directly from the notification channel (without requiring 2FA etc to prevent hijacking issues). This could be applied to other things, like updating an auth factor (change email for instance). Just notify the old email and queue the opera…

You also have something like Gmail's option to have a short delay before sending an email which I use semi-regularly. Honestly, wish I had a 5 second delay on my cell phone for all the times I fat finger dial someone on my recents tab.
Post reply on HN