Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Dark Patterns Hall of Shame (darkpatterns.org)
238 points by bookofjoe on May 29, 2021 | hide | past | favorite | 71 comments


One that I didn't find on the list, Coursera makes it really difficult to take ("audit") a course for free: https://github.com/ossu/computer-science/blob/master/FAQ.md#...


Is the phrase "audit" a specific Americanism, or is it more widely used? I've never encountered it (beyond the context of American colleges referring to sitting in on lectures in the US system of building credits yourself towards a major) - in other countries with different (perhaps more regimented) university education, I've never encountered the phrase. And personally I haven't encountered the concept either really.

I'm wondering if the phrase itself is also designed to be understood by the fewest number of people possible, in addition to being hidden?



It’s a standard expression, not an Americanism.


Not in regular use in that sense in the UK either.

I've heard it very infrequently and usually with some US context in the conversation.


The first reference on the Wikipedia article is to a Australian university page, but then again, the link's broken.


Kind of. To audit means to assess the quality of. This is true in British English, but hiding free access to a course behind the pretence that the student is auditing, not studying, is wholly American.


Audit is Latin for "I hear" (think "auditorium", "audience", "audition"). If you think about it an audience with a lord, a legal "hearing", and an academic lecture are in many ways similar.

Later the meaning of audit branched/changed, and one common modern sense of the word is to do a thorough examination of something, comparing results against specification. I speculate that it first became a technical specialized legal term (in a context where it was originally still about a hearing in court), and then mutated as it filtered back out to people who didn’t know the word’s origin.

The "audit" in "audit an academic course" (meaning to attend the course without obtaining a credential) branched from the original sense of the word.


It’s not standard in Ireland or Britain. I figured it was more of a MOOCism rather than an Americanism as this is the only context I’ve seen it used to refer to trying out a course for free.


I'm not sure about the "free" aspect, but I've seen it used to mean "attending classes without being enrolled in a course" in other places, that is, in the offline university context.


I’ve never heard it in Australia in this context.


I’m Australian, and have heard this sense of “audit” approximately once before in my life, from Americans.


We used it at the University of Western Australia back in the ‘80s when I’d attend lectures and tutorials for a course without formally enrolling (bureaucratic issues meant that that was often impossible). Some academics were very positive about it, they got good participants in the room, rather than just check-the-box degree mill students.


Glad I'm not the only one that noticed this. The link itself to 'audit' is basically as small of a clickable link as possible. I am honestly surprised they didn't just hyperlink 'a'udit at this point.


Geeez. I didn't even know that was an option. Very disappointing Coursera!


In many free mobile apps, there's a very annoying dark pattern in ad screens. Often an ad is displayed, but close button is not yet visible. Often a timer is shown however in the top right corner of the screen. Only after maybe looking 10-30 seconds to the ad, the close button appears. Sometimes the close button appears in a different corner as expected (I would expect same corner as the timer was displayed, e.g. top right corner).

I assume the close button functionality is not controlled by the ad framework, but developed and maintained by the mobile developers behind the app. So the mobile devs should be able to make the functionality more user friendly, if they wanted to.

I guess it's all trickery to make people more likely to accidentally click ads, but it's really annoying. Sometimes I wish I would be able to pay a small amount of money to remove the ads, but this is often not even possible.


I’ve specifically programmed stuff like that. Very specific specs are given to the devs to show a close button after a certain amount of time, only showing back/next buttons after a certain time/event, all mangled with deliberate tracking scripts that capture all of those user events.

It wasn’t necessarily to increase clicks, but more so to prolong time on page, and sneak in more ads in between their browsing.

When we were done jamming all this in, our boss took a look at it and said ‘increase the time before the buttons are visible, and show one more ad as well’. Relentless.

Tracking the user and showing syndicated content/ads is more profitable than just charging them a flat fee for many businesses.

The user experience did not matter at all to the stakeholders.


When it's not possible to pay for removing the ads, consider decompiling the app and removing ads. While I hate depriving developers well-deserved revenue for their hard work, allowing me as a consumer to choose whether I pay with cash or attention takes precedence.


On Android, the system back button works most of the time to close ads. You don't have to look at the ad screen at all to try to find a way out, at some point you just develop a reflex that makes it go away instantly without relying on advertiser's mercy.

Or, block ads system-wide. There's an app called Blokada, and you can also use the DNS-o-TLS support ("private DNS") to do that.


One that is terrible is Scribd. IIRC the flow goes something like this. 1) You press a cancel button on the subscription, and it takes you to a page that lists lots of things but if you don't pay attention, just at the bottom is asking you to confirm the cancellation and the previous things are the "benefits" you will loose if you cancel. 2) If you press, yes cancel, it takes you to a third page where it again asks you to cancel. That is how I stayed with them 1 more month.

Very bad.


I see it on the list here, and I know it’s not the most universally malicious of dark patterns, but Amazon defaulting users to a “subscription” on things like vitamins, diapers, toilet paper, etc. is so annoying.

Reminds me of a time I was in their Seattle book store maybe six months ago and overheard the person at the register telling every customer they “qualified for a free audiobook” and that he’d get them all set up.

At no point did he mention that the customer was being subscribed to Audible or that they’d be eventually charged for the service. I can only imagine the discussions up the food chain that made this retail employee feel like this was alright. I shudder thinking about how many people are probably being charged to this day because they simply never noticed (I doubt I would!)

Gross gross gross.


> I can only imagine the discussions up the food chain that made this retail employee feel like this was alright.

It doesn't work like that. The management give the workers mandatory sales targets, possibly with a bonus attached. The workers find that the targets are nearly impossible to meet, but it's much easier if they omit some of the important details. Sales go up and management all pat each other on the back. Nobody in management has a difficult conversation or even imagines for a second that they are anything other than a good person making the world a better place.


> I see it on the list here, and I know it’s not the most universally malicious of dark patterns, but Amazon defaulting users to a “subscription” on things like vitamins, diapers, toilet paper, etc. is so annoying.

I cancelled amazon prime and stopped shopping there, and this one of the reasons. The site is increasingly filled with such patterns.

Try and buy something without prime and it offers it to me on 2-3 screens, including the shipping screen after you've already told it no to prime.

Ostensibly someone might change their mind, but to me it looks like trying to get accept clicks out of customers who don't read the screens just click buttons.

>Reminds me of a time I was in their Seattle book store maybe six months ago and overheard the person at the register telling every customer they “qualified for a free audiobook” and that he’d get them all set up.

I would never go back to a place that gave me an in person audible commercial.


Quite a few retail shops try this sort of rubbish now. I've given up saying 'no' and just give fake numbers and emails now.


So, that's how Jeff got all that money. Slight-of-hand through his expendable pawns.


How would one not notice being charged? Do you not get an SMS or a push notification for every transaction in real time?


This happened to me several years ago. I signed up to Audible's free trial, got a single audiobook, then decided I wasn't really an audiobook person and forgot about it. Then many months later I noticed I'd been charged monthly (I think ~$10 USD or so?) for a service I never even used, and I don't remember even giving my card details for (it is my longstanding policy never to continue with "free trials" if they ever ask for payment details during signup, exactly because I know I'll forget and get charged). It turned out to be the card I use with Amazon -- I think I must have signed up for Audible using my Amazon account and they automatically used the card I had saved with that, without telling me. I don't remember the full details of it but I ended up hours on the phone with Audible trying to claw back my money.


No, at best maybe an email but it does not show up in recent orders on Amazon.

The plus side is Amazon is really good about refunding - I had kindle and music trials that I thought I cancelled, go for almost a year+ and they refunded the entire subscription.

The amounts of $9.99/14.99 are small enough that it's noise on the credit card amount, and it's all auto pay to pay in full anyway. So unless you do quarterly audits, you won't catch it.


Uh, probably another US weirdness then. Over here SMS alerts are standard. Depending on the bank, there might be a tiny monthly fee for them. I just can't imagine someone charging my card and me not knowing about that immediately.


my bank didn't get 2 factor authorization until long after reddit did.


I built this game based on all the dark patterns on darkpatterns.org

http://termsandconditions.game

If the creator is here anywhere - thanks for the inspiration!


Good, but please don't disable right-click. Should not have to use Absolute Enable Right Click Firefox add-on in order to ensure a link opens in a new tab.


Another way to do that is control-click or command-click on macOS.

Doesn't change that sites shouldn't be able to block right-click, but it's a slightly easier work around than installing an add-on.


Just Shift+Right Click to force the native context menu


Some time ago I signed up for a hosting account with Siteground. The pricing page clearly listed the prices in monthly format - and I was charged the monthly price when I signed up.

To my surprise, the next charge was to be for the whole year. After contacting support, they explained to me that the first month was oferred as a trial, to test things out, but that they do not offer monthly prices otherwise.

Let me put that again, they displayed monthly prices on the signup page, charged the monthly fee for the signup, but it turns out that they actually signed me up for a yearly plan and they do not offer monthly plans at all.

I don't know if they still do it and they offerred me a monthly plan after I complained about it.


As far as dark patterns go, nothing compares to the intentionally confusing mess that is Google's privacy settings.

It could all be replaced with a single button labelled "stop tracking me".


Do you live outside the EU? After 50M€ of fines, they seem to finally understanding the meaning of the word "privacy". A few days after creating a GMail account (for my printer), I even received an invitation to do a privacy checkup.


> After 50M€ of fines, they seem to finally understanding the meaning of the word "privacy

[X] Doubt

All the incentives are in place for them to find novel ways to abuse the user's privacy. Their share price, which they have a mandate to maximize, pretty much depends on it.

50M is a drop in the ocean for Google; they can justify amounts that are orders of magnitude larger than that as a cost of doing business.


Privacy or ‘Google privacy’ (ie. only you and Google have access to your data)?


How many founders are here to take note of interesting patterns?


Indeed, I'm worried that without proper legal action, the Hall of Shame will only serve as inspiration for the next wave of start-ups. "Hey look, Amazon does this and they converted so many users to subscribers. Let's try that too."


Good. At one point they will transgres the threshold of acceptable behavior or we will get used to them so much, we'll figure out ways to bypass them.


It's called a different flavor then: growth hacking


How else would you expect them to get those cool Founder t-shirts


Will the Hall of Shame also use Airtable?

Isn't the ad-based business model of this unicorn itself a dark pattern? Or aren't we yet at that stage, and consider "Read the legalese of the privacy policy, and either continue or move on" good enough?

There's opportunity to use open-source, self-hostable Airtable alternative, such as NocoDB [0] or Baserow [1].

As for darkpatterns.org itself. On the Hall of Shame page there are 5 trackers, and on the landing page (due to YouTube embedding) there are 8. But the site lacks a Privacy Policy AFAICS explaining this. Arguably a site about Dark Patterns could be a shining example of not using them, and I think it could well be tracker-free without major concessions.

[0] https://news.ycombinator.com/item?id=27303783

[1] https://news.ycombinator.com/item?id=26448985


Hi, I'm the author of the website you are referring to.

The website is built using webflow, which is a very reasonable choice for someone who wants to run a website who is not also a developer. Embedding or linking to content on third party services like youtube, twitter or airtable is not an unusual thing to do.

The website has no revenue model, and has been provided free of charge since 2010. Though it's not perfect - it would after all be preferable to entirely javascript-free - it's had a tiny net positive effect on the web.

You suggested using NocoDB instead of airtable. NocoDB was launched 3 days ago.


The parent commenter was out of line with their insinuations IMO. Thanks for your efforts towards keeping the web a little bit cleaner.


Yes, they are mere suggestions. You are doing great with the site, attracting attention to Dark Patterns in general and now with HoS to the specific parties involved. Highly appreciate the effort, thanks.


The term "dark pattern" is a bit of a misnomer and too soft. How about we just say what it is - manipulation, misdirection, and sometimes outright fraud.


An alternative term is Deception Pattern. Might communicate better that they are often intentional.. i.e. with the intent to deceive.


I like it, concise and accurate.


Cookie consent banners are the worst. I could swear that every single one I‘ve ever encountered has „Accept all“ as primary call to action. On top of that some employ opt-out forms made in hell, where one has to manually click through half a dozen of checkboxes while „Accept all“ is still the primary action at the bottom of said form. I‘m not only incredibly annoyed by constantly being greeted with obtrusive overlays and huge banners, I‘ve also given up on opting out a long time ago[1]. Arguably this part of GDPR failed miserably.

[1] Manually opting out that is, I‘m blocking trackers on DNS level and via browser plugins.


I don't think it's the GDPRs fault. It just states, that if you want to use personal data you have to have a legal basis. One is consent, but consent has to be given freely and informed.

For my part I find that totally reasonable. What cookie banners try to negate is the fact that most people just don't want to be tracked.


The fact that most websites asks me to accept cookies _every single time_ I visit is quite reassuring. If they can't even remember that I've visited their site a hundred times before, I'm not so worried about their tracking.


They're probably just faking it to make you think that.


The worst part of this is that if you know how to do it, it's trivial to have your browser just clear the cookies at the end of the session... including the one that dismisses the cookie form from hell, and the cycle repeats...


Mobile dialogs where accept all is nice big touch area and "Options" is a link where you need to scroll it into view and the touch area is small and right against the accept button are another peeve.


> Arguably this part of GDPR failed miserably.

I'd definitely argue against that. For a hot minute they were truly terrible, with occasionally hundreds of tickboxes (Looking at you Techcrunch). Now 80% of sites I go to seem to use the same provider, which has a primary "Accept all", but rejecting all is usually a matter of clicking 3-4 radio buttons and a secondary "Confirm choices" button.

That's still pretty damned dark pattern-y, no doubt, but it's light years better than my previous options of either accepting or accepting.


Wasn't there an auto-GDPR clicker extension to help us get rid of them?


Agree, my main gripe with cookie banners is that they are designed to make you "accept all". But is has less to do with the layout of the banner than the fact that they pop up the second you enter the site, at which moment the mind will find all popups an annoying distraction (hence 'Accept all').

GDPR should require all websites to have their cookie settings under a standard icon in the top row of the screen, which you could scrutinize and tweak at leisure. As it stands you have one shot, short of clearing all cookies.


On the linked page is this

> Google Calendar has trained me to think that a Google Meet link on the invite is probably a mistake.

> That one decision has completely ruined the GMeet brand.

> Doing bad/dark UI patterns to pump up usage numbers might be good short term but an awful long term decision.

What is this referring to?


Google calendar invites from Workspace (fka G Suite, Google Apps) accounts include a meet invite link by default, regardless of if anyone actually intends to have a video call at that time


That confused me a lot too, curious to know what it refers to. I find Google Meet quite easy to use and it works well, the only weird part is that sometimes I have to wait for people to let me in, sometimes not. Not a dark pattern though, just bad design.


This is great, now I know what to implement when I develop to retain customers and make it hard to leave.


One awful dark patterns are instagram notifications "you might know XXX is on instagram", which have no options to be turned off in their settings, you would have to turn off all instagram notifications.


Am I the only one who had trouble finding the parameters menu in instagram?

Same thing for google mail.

Sometimes I wonder if it's crappy design or because they would prefer default settings (notifications etc)


The absolute worst thing about instagram is when you tap the search icon, then tap the search input, your keyboard is automatically hidden by Instagram right when it pops up, so you have to tap the input again. The purpose is to get you to choose one of their recommendations rather than what you intended to search for.


I wonder how many product designers read this as a learning opportunity. This site clearly states that dark patterns are effective (if evil).


don't give them ideas!


The preview version generates a history entry in the browser for each list item you click, that's probably a bug?


A... dark pattern, perhaps?



this could also be renamed to "cool patterns for startups and growth hackers" and nobody would notice.


Where is auto-renew by default?


> Tweets by darkpatterns Your browser does not support JavaScript so you can't see our tweets here.

Irony.


Will the Hall of Shame also use Airtable?

Isn't the ad-based business model of this unicorn itself a dark pattern? Or aren't we yet at that stage, and consider "Read the legalese of the privacy policy, and either continue or move on" good enough?

There's opportunity to use open-source, self-hostable Airtable alternative, such as NocoDB [0] or Baserow [1].

As for darkpatterns.org itself. On the Hall of Shame page there are 5 trackers, and on the landing page (due to YouTube embedding) there are 8. But the site lacks a Privacy Policy AFAICS explaining this. Arguably a site about Dark Patterns could be a shining example of not using them, and I think it could well be tracker-free without major concessions.


Note: this comment was posted twice due to an issue on HN, that I reported to @dang. Can't delete any longer, sorry.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: