Advice on language to use? #1708
Comments
This is what we at Duo do when presenting users with the option to use their available platform authenticator. We "brand" the platform authenticator option by looking at the user agent and intuiting the OS to then display specific names like "Touch ID", "Face ID / Touch ID", "Windows Hello"... And when we can't identify the platform (or the platform doesn't have a special name, like Android biometric) we default to calling it "this device":
I personally think the "this device" labeling is fine for all platform authenticators. It's what I'd use on personal projects if I didn't want to go through the trouble of trying to maintain branding logic. Regarding "roaming authenticators" it's getting murkier as caBLE support continues to mature. "Use security key" used to be all you needed to worry about to communicate use of a roaming authenticator, but now there's this whole angle of, "a platform authenticator usable as a roaming authenticator". Still not sure how to handle that in this transitional period but maybe it's not worth fretting over for now. |
|
My suggestion would be "Continue with your device" as there is a visual hand off to the local OS. |
|
This is the sorry result of companies choosing to ignore educating
businesses and consumers about "FIDO". As a consequence, we've ended up
with:
* FIDO
* WebAuthn
* Windows Hello
* Passkey
* ...
IMO, companies who wish to save themselves time/money avoiding having to
repeatedly explain the idiocy of marketing departments (who do not
understand the reason for standardized names for complex technical
concepts*) should stick to one of the following messages:
* "Register your FIDO credential"
* "Register your passwordless credential" or
* "Register your credential"
I would also encourage having a link on the site to educate consumers -
at a high level - about what is going on; this site from the FIDO
Alliance is helpful: https://loginwithfido.com.
Arshad Noor
StrongKey
/* Imagine what the state of the internet might be today if companies
had chosen to brand TCP/IP with names their marketing departments chose
instead of what the RFC defined - a few of us might still have been
programming with COBOL while the rest of us would have been pushing
paper forms to feed that machine.
/
…On 3/19/22 10:45 AM, certainlyNotHeisenberg wrote:
(This is not an issue but a question for the community. Just not sure
where else to ask it. Apologies if this is the wrong place!)
I'm using WebAuthn and unsure what language to use so the user
understands what's happening. I'd love anyone's input!
Specifically, I'm using the user's email address as the display name
and defaulting to platform authenticators. So, there are two steps,
where step 1 is "Enter Your Email". But I'm unsure what to call step 2.
I started with "Complete Biometric", but the platform authenticator
won't always be a biometric — sometimes it'll be a passcode, or
pattern, or PIN, etc.
Then I tried the slightly more generic "Complete Biometric/Passcode
Check", but that's a mouthful and still not totally accurate.
Then I tried to see if I could customize the language based on the
platform (e.g. "Complete Face ID" on a certain iPhone, "Complete Touch
ID" on a different iPhone, etc.), but there are issues with that:
* There's no totally reliable way to know what platform the user is on.
* Even if you know the platform, there are often several options at
the device level for what the platform authenticator would be.
(E.g. on an RCA Q2 phone I have, I can set in phone settings the
authenticator to be a passcode, PIN, or pattern.)
Another issue with the generic "biometric" term is that it can sound
somewhat scary. The term itself doesn't distinguish between a platform
biometric like Face ID, which users find familiar, and a whole new
biometric like a third party facial recognition system, which users
often find quite invasive.
I suppose "Complete Platform Authenticator Check" is the most
accurate... but I doubt many users would have any clue what that means.
So I'm at a loss for what language to use! Any ideas would be very
welcome. :)
—
Reply to this email directly, view it on GitHub
<#1708>, or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ABWSVTWGDYUVQFGYT4IPQ5TVAYHFFANCNFSM5REJTAQA>.
Triage notifications on the go with GitHub Mobile for iOS
<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675>
or Android
<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.
You are receiving this because you are subscribed to this
thread.Message ID: ***@***.***>
|
I disagree. This is the result of this WG choosing to ignore accessibility and human interaction as part of our goal. Communication to users and how we chose our language is critical. As a result this standard is dense, overly technical, and confusing even for subject matter experts. How is the barrista at my cafe meant to understand "discoverable credential" or "resident key", or "direct vs none attestation". How can the users of the system we are creating be empowered, if they can't understand the soup of technical jibberish we keep throwing around? By ignoring the deployment use cases and the experience of both RP's in deployments and the experience of the humans that use these devices, we have created this situation. These marketing departments are not "idiotic" they are trying to create a human experience that is accessible to a diverse range of humans. I would encourage you to rethink your choice of words and attitude, and to empathise with peoples who backgrounds are different from your own. |
|
I just came across eBay's WebAuthn implementation, and they use this language:
And then once you've signed in, they say:
I think this is reasonably clear (if a bit of a mouthful). |
Thank you for calling this out, @Firstyear. After 7 years of working on FIDO and exhorting FIDO Alliance members (long before this WG was formed at the W3C to standardize the API for FIDO protocols) to keep things simple and to focus on consumer education, it has been extremely frustrating to watch this train careening off its rails in slow-motion. But, that is no excuse for my rant. My sincere apologies to all the marketing people who were merely doing their jobs, and all others who were offended by my posting. At this stage, I will acknowledge that the future of this standard appears to be fully within the control of the three trillion-dollar companies (and their acolytes) driving Level-3 of this specification. And, unless Ms. Lina Khan and Ms. Margrethe Vestager choose to understand the implications of what is going on and do something about it, there is little anyone else can do. I am unsubscribing from this list to avoid having to witness the inevitability of this train wreck. |
|
Thanks for the apology @arshadnoor - I appreciate it. I do agree there are many problems in the approach currently taken by this wg, and that the lack of consideration to human's experiences is really problematic. I could have been more gentle in what I responded to you too. |
|
@arshadnoor A specific problem with standards developments in contrast to traditional product development, is that the-standard-to-be may challenge members who already have related products on the market. This became particularly evident for the WebAuthn SPC extension, which neither has been compared to Apple Pay, nor to the nowadays almost ubiquitous proprietary mobile banking Apps. AFAICT, SPC is one of the most complex solutions on the market. In fact, SPC is so complex that small to medium sized merchants hardly have any alternative to outsourcing the payment part in its entirety. |
|
We're closing this out to bring the discussion into the WACG at the next meeting. |
(This is not an issue but a question for the community. Just not sure where else to ask it. Apologies if this is the wrong place!)
I'm using WebAuthn and unsure what language to use so the user understands what's happening. I'd love anyone's input!
Specifically, I'm using the user's email address as the display name and defaulting to platform authenticators. So, there are two steps, where step 1 is "Enter Your Email". But I'm unsure what to call step 2.
I started with "Complete Biometric", but the platform authenticator won't always be a biometric — sometimes it'll be a passcode, or pattern, or PIN, etc.
Then I tried the slightly more generic "Complete Biometric/Passcode Check", but that's a mouthful and still not totally accurate.
Then I tried to see if I could customize the language based on the platform (e.g. "Complete Face ID" on a certain iPhone, "Complete Touch ID" on a different iPhone, etc.), but there are issues with that:
Another issue with the generic "biometric" term is that it can sound somewhat scary. The term itself doesn't distinguish between a platform biometric like Face ID, which users find familiar, and a whole new biometric like a third party facial recognition system, which users often find quite invasive.
I suppose "Complete Platform Authenticator Check" is the most accurate... but I doubt many users would have any clue what that means.
So I'm at a loss for what language to use! Any ideas would be very welcome. :)
The text was updated successfully, but these errors were encountered: