Balancing inclusive design with security
In September of 2018 something weird happened in the Vend Slack. Our Chief Engineering Officer followed up his request for folks to submit their engagement survey with an offer of a 5% pay bump to all engineers who submitted their survey. Hang on? What.
Something was up—this was obviously not appropriate (or true!). In classic Vend™ fashion, trickster Mal Curtis had changed his Slack display name (and username! And display pic!) to impersonate Ben Gracewood—the aforementioned Chief Engineering Officer. Chaos ensued (briefly) as others quickly figured out what Mal had done, followed suit and soon we had a number of Ben G’s on our Slack instance.
The above scenario is funny to a bunch of engineers who are making a joke. It’s less funny to whoever is in charge of HR, or security. The ability for an employee to “assume someone else’s identity” and then commit “crimes” is something companies would like to avoid. And so they implement policies that prevent this kind of thing from happening.
Today, in the work Slack (paraphrased, and given a new name, to protect their identity):
hi team 👋. this is a very silly question 😅. but I’m just curious. So my full name is Isabella Morales Hernández, but professionally and in general, I prefer to use my last last name only, Hernández, because my full name is rather long and hard to remember in full. That being said, I keep daily updating my name in Slack’s profile, because if I update it to Bella Hernández, the next day it updates back to my full name and to do that every day it’s a bit tiring. I wonder if I’m doing something wrong when updating, or if there’s a way to maintain the name I want to use in Slack at all? Thanks
Our work Slack clearly has a script which runs daily and updates the Slack name to match what’s recorded in some HR system somewhere. That could be for security reasons (we also can’t change our usernames, for example), or it could just be convenience.
Bella has two surnames, as follows Spanish naming custom. Supporting this is wonderful, because names are pretty complex. Names are also really personal. Bella goes by Bella Hernández. Her colleagues identify her as Bella, not Isabella Morales Hernández. Abhi Chinniah recently wrote about her complex relationship with her own name on The Spinoff just recently. Names are hard—and people’s relationship with their names are fluid and contextual.
So how are we meant to strike this balance? Between letting chaos reign, or restricting people’s identities? We’ve had this conversation at Vend by Lightspeed with regards to how we show Users in our system. We want users of our system to feel respected, and be able to express themselves—and we also know that merchants who put their trust in our system expect us to help them avoid being scammed. We can’t have a cashier change their name to someone else’s and then commit “crimes”, and get away with it.
I’ve spoken about ID Badges before—specifically in how they help us avoid truncation—but we also use ID Badges in this scenario. A user’s display name is front-and-center—this is “who I am” and I can control what this says. However, much like the “Spinning Ludwig” emoji status gave away Mal as a fraud—we need a “tell” so that other actors in the system can identify someone who’s being nefarious. That’s what the second line does—it is confirmation of the user’s identity.
Inclusive design doesn’t need to come at the cost of security. In fact, our security team continues to believe that security shouldn’t come at the cost of usability—or vice versa. When you can consider all the mountains, you can come up with a solution that works for everyone.
We’re hiring! Come join our team in Auckland as a Digital Product Designer and be part of these kinds of wonderful conversations on the daily!
