Network

Dark Patterns

Dark patterns are design choices that trick users into taking an unintended action or preventing them from taking an action. Examples are, tricking a user to subscribe to a service, and then making it difficult for them to unsubscribe by hiding the unsubscribe button. UX (user experience) designers are trained to think about how people interact with technology. Unfortunately, this knowledge can also be used to deceive users. They are using human psychology to their advantage hoping users will get frustrated and give up or click the wrong option accidentally.

There are many forms of dark patterns. Harry Brignull started the website darkpatterns.org in 2010 to identify and highlight the most egregious offenders. The three most common are the Misdirection, Confirmshaming, and the Roach Motel.

Misdirection is when a website establishes a pattern and then exploits that pattern. An example would be as a user is filling out a form, then clicks a green button to go to the next step, green button, next step, green button, next step. Then at the end of the process, the option to opt into a $10/month service is a green button, and the option to continue without the monthly service fee is black text on a white background. Misdirection also occurs if an option for “yes” is highlighted in red, or an option for “no” is highlighted in green. These design decisions are made to confuse the user and make them click what the business wants them to click.

Confirmshaming is a tactic to guilt users into agreeing to a service or signing up for an email list. These are often found on shopping websites where the language will say, “Sign up for mailing list” and the alternative is “No, I want to pay full price.” In some cases, the pop up creates more urgency with added “One time offer” language.

 

The Roach Motel is familiar to many users. This dark pattern centers around the idea it is easy to get in, but difficult to get out. Have you ever had to Google how to unsubscribe from a service? A Roach Motel purposefully hides the cancel option, and possibly makes users go through multiple confusing confirmations to finally cancel the service. Amazon is famous for how difficult it is to cancel an account. Darkpatterns.org has a great video on all the steps a user has to navigate to cancel an Amazon account, and then at the end of the process the user has to chat with an Amazon specialist because the user actually cannot cancel the membership on their own. Amazon must cancel the membership.

Dark patterns take advantage of psychology and short attention spans. Users get frustrated and give up trying to cancel that monthly membership or email blast. However, with some education and the occasional search engine dive, users can navigate this world of purposefully bad UX design.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

 

Posted by Charles Wright in Cybersecurity, Information Security, Recent Posts, Small Business, Virtualization

March Newsletter

The March Newsletter is now available on the website. This month, the newsletter is interactive! After you download click around to explore additional media from a given article. If you’d like to receive the newsletter before we feature it on the blog, sign up for our mailing list. We also send out security alerts and other news in the IT world.

Click Here for the March Newsletter!

Quanexus IT Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Cybersecurity, Physical Security, Recent Posts, Small Business

LinkedIn Scraping Attack

LinkedIn is in the spotlight of IT security news again. A hacker claims to have 500 million LinkedIn profiles for sale. The criminal posted four files that contain LinkedIn member IDs, full names, email addresses, phone numbers, genders, job titles, workplace information, and potentially other identifying data.

LinkedIn reviewed the data, confirmed it was real, and released a statement claiming the data was scraped from public profiles, and not a breach.

“This was not a LinkedIn data breach, and no private member account data from LinkedIn was included in what we’ve been able to review.”

For a year now criminals have focused on LinkedIn to acquire information on employees and target them in attacks. LinkedIn is now in the top three companies impersonated in phishing attacks, a year ago it wasn’t even in the top 25. Earlier in the pandemic we wrote a blog post about criminals using LinkedIn to attack newly hired employees by impersonating IT support of the company.

The scraped data are forms of publicly identifiable information or PII which can be used along with other public information to give the criminal a more complete picture of a person they are attacking. Even though the information is public, a criminal could use the list to construct a more credible phishing attack. A searchable, sortable, aggregated list of 500 million users could be very useful to a hacker. They could sort the data by business or area code and create more targeted attacks, use the data to pose as LinkedIn, or combine the data with other PII to target individual users in a spear phishing campaign.

Data scraping is on the rise because we share so much information publicly. LinkedIn has risen in popularity as a business to portray because of so many people looking for new jobs during the pandemic.

With the announcement of this data scraping attack, users should be on the lookout for phishing emails referencing LinkedIn, or the information the user has on LinkedIn. It’s always a good idea to understand what information you have publicly available, so if an email or text message doesn’t feel right, you can better understand the information the hacker may be working from.

In a couple recent podcasts, Jack talks about oversharing PII, and data aggregation. Find those podcasts here and here.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Recent Posts

Podcast 5 – Insider Security Threats

Jack and Chuck talk about security threats that originate from employees. Insider threats can be intentional or unintentional. Watch to learn the three main attack vectors and how to avoid them.

 

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Cybersecurity, Information Security, Physical Security, Recent Posts, Small Business