Now I am going to do a short example of cognitive walkthrough on a non-related piece of software
just to give you an idea of what we are looking for.
So the task I have for this cognitive walkthrough
is to open a painting program and draw a red hexagon.
So I am looking at the screen right now.
I am trying to see what options are available to me.
Nothing looks like it is exactly a painting icon.
So I'm not exactly sure where to click.
I probably would go for this, but on second thought,
I want this magnifying glass because that usually gets me some results.
Let's try "paint".
And that looks like pretty likely so I am going to choose that one.
All right, now it is asking me,
it looks like its asking me how big it wants the image to be.
I'm wondering at this point whether I will be able to change this decision later.
It doesn't say whether I will be able to undo this, but I think that what it is will be fine.
So I'm just going to ignore that and click okay.
And the window changed size. I assume that means it changed to the size that I just entered.
All right, so I need to make this red. This definitely looks like color selection so I will try that.
It is giving me a bunch of options for color.
"Strawberry"... is not quite what I want.
Maybe "Maraschino".
Now, I am seeing if there is a tool that will draw shapes like a hexagon.
This says "Rectangle" and if I click on it, it looks like it is only rectangles.
"Ellipse". That's no good. "Rounded Rectangle"?
So I think I might have to draw my own hexagon.
I am going to click on a paintbrush. That's the tool I want to use.
No, wait! The line tool is better.
All right, so I am going to draw a line by clicking and going over here and click again.
And... that's not what I wanted.
So, I was expecting it to draw a line between those two points but that didn't happen.
So I am going to undo that.
And this time, I am going to try dragging.
Okay, and that does what I want.
So, okay, I got the hang of this. This is pretty easy.
I wonder if there is a way to auto-close this shape, but I don't feel like actually looking for it,
so I am just going to manually link this up.
And now, I know from other paint programs that usually a paint bucket will fill something in, so we will try that.
Okay, and that did what I expected. It filled in the red area.
All right, so that's a cognitive walkthrough. That's an example of how we're going to do it.
Now I'm going to ask you to do another demonstration. This one will not be using the software that we're testing.
Oops. That's not what I expected.
But just to let you have practice at doing this.
So your task is to use a web browser and find out the population of Zimbabwe. So go ahead.
Looking at the desktop, I see the common ribbon across the bottom
with two popular web browsers, Saf—, Chrome and Firefox. And I am a die-hard Chrome addict,
so I double-click Chrome to launch that.
Chrome is prompting me to sign in and this isn't a computer I trust, so I'm not going to sign in.
Instead in, I am going to type in the URL bar, "https slash slash google dot com".
I like to run all of my searches over—
Oh, and I get as far as typing in "https g", and the browser selects, or, suggests Google for me,
so I am going to take that suggestion.
I now have the search bar in the middle and I type in "population of"...
And I get as far as typing in "population of zi" and it selects "population of zimbabwe".
I am going to go with the "I'm feeling lucky" suggestion, not even letting it complete the year,
and it gives me a handy-dandy bar—or, graph sourced from Wikipedia
which tells me that the 2013 population of Zimbabwe was 14.15 million.
Okay, great. Excellent. I think you have really got the hang of it.
Thank you. And, Command-Q to close the browser when I am done.
Good.
Which does what I expect.
There may be some points during this where there is some down time. Where I am going to ask you do download some software.
Sure.
So while it's going on, I encourage you to, you know, look and see what you can see on the screen and just describe what you see.
In order to fill up some of that time and make good use of it.
Okay.
So, now we are going to begin the real experiment.
I am going to have you... You're going to be testing a piece of software called Tor Browser
which is a special web browser that has... that is used for anonymity purposes.
And this is the list of tasks that you are going to do.
Okay.
And do these in the way that you would normally do them, if you were going to follow these steps at home.
Okay. So...
Do you have any other questions before we begin?
No, I'm good.
So, first instruction is to download Tor. So I am going to fire up Chrome again.
And I actually know that Chrome will just allow me to type searches in the search bar,
so I am going to type in "tor mac download".
And that gives me some suggestions. I pick the first one.
Which takes me to "Download Tor" from www.torproject.com, or .org. That looks like a reasonably reputable site.
It's an HTTPS site.
I have a warning about wanting to do things differently so I am just going to pop that open in a new tab...
No. I clicked on that wrong... Pop that open in a new tab.
And in the mean time, I am going to hit the "Download Tor Browser" button.
So that is a 40-meg download.
I'm going to go read the warnings about things that I should and shouldn't do on Tor.
Because I am assuming that I want to have maximum security so, follow all of the warnings, make sure I don't do this wrong.
Okay. Seven and a half megs of download to go.
All right, in the meantime, I am going to...
pop open a new tab and read about "tor onions".
And again, that tells, takes me to the Tor Project webpage.
Ooh, I have a "hidden wiki" for Tor onion URLs.
That looks like I might want to open that up and read more about that.
And pop open another tab and type "tor onions" again because there were a lot more links
so I am going to read the Wikipedia page on Tor as well.
It tells me it's a network for preserving anonymity and resisting censorship.
Okay, here's the table of contents... Okay. This appears to be a slightly more historical and theoretical document.
So I am going to go back to the Tor Project. In another tab.
And click the "Documentation" link.
And have a look at the "Installing Tor on Mac OS X".
Okay. It tells me it wants me... this is the compile-it-yourself version.
And the recommended way is to use the Tor Browser Bundle. Which I think I am downloading.
Yep. I am downloading still.
But I am just curious what other stuff... Okay. Well there's definitely a suggestion on configuring your application to use Tor.
So I should probably keep that tab open.
Okay! my download appears to have completed so I am going to let Chrome open the disk image.
It is verifying right now.
Mounting the disk.
Drag Tor Browser Bundle into Applications.
Okay. Copying... 95 megs.
All right.
And Shift key, pop open my applications,
and there is Tor Browser.
"'TorBrowser' can't be opened because it's from an unidentified developer."
Grr! I express some frustration at this fact.
[Laughter.]
[Sighs.] And, Shift-U,
I tend to actually, when I am changing quarantine bits,
rather than turning off quarantine checking on the entire system, I just remove the quarantine bit.
So, I go to "cd slash Applications",
"ls minus l",
"Tor Browser". Excellent.
There is my Tor Browser. So I, uh, is it... "chattr"?
"chflags", "d", "com dot apple dot quarantine Tor Browser".
Argh. It's "chattr".
Okay, it doesn't want to let me do that which means I need to go to the System Preferences, unfortunately.
Mmhmm. And we will just undo anything that you do, so don't worry about it.
Okay. It wanted me to do something again... I forgot what. Warning says,
"Security preferences", okay.
Okay... "Security & Privacy"... "General"?
Ah, here we go. "Open Anyway"! Click the lock to make the changes.
Uh, it's "password" on this computer.
Okay, let's see if I can do that from an identified developer.
Actually, I am going to say open that anyway. Let's see what happens.
Maybe I don't have to open up my system too much.
I see the bouncy Chrome browser, or browser ball.
It's verifying. Waiting, waiting.
Okay, so yes. I want to open Tor Browser.
Okay, I now have a dialogue that asks me to configure my Tor settings.
If I am connecting directly to the Tor network or if my computer is censored or proxied somehow.
Looking at this, I would almost actually choose the censor or proxy mode, just because I work in computers
and I know that my work network actually filters Tor...
And I may have heard stories on the news about various consumer ISPs also filtering traffic.
But! I am tempted to go with censored, but I am going to try the easy, "this will work in most suggestions—most situations" choice
and just connect directly.
Okay, connecting. It is telling me it is doing stuff. Loading network status...
Pausing a little bit?
Okay, I can close the System Preferences now.
And, while it is doing its thing, I am just going to go back to reading the instructions about Tor.
Okay, cool. Tor seems to have loaded.
"Congratulations, this browser is configured to use Tor"
and the first link it gives me is a "Test for Network Settings" so I am going to click that.
Which gets me as far as step 3.
Right.
This is definitely not nearly as fast as regular Internet.
I see you have NoScript loaded.
Okay, great, the browser is configured to use Tor correctly.
So now that I have Tor running, I am going to use the default searches inside the Tor Browser, so that appears to be Startpage, and
I am going to type in "onions".
I am going to pop open a new tab, and in that new tab, I am going to see if anybody talks about YouTube over Tor,
just because I think that maybe not all sites on the Internet are going to work correctly when Tor is in use.
Okay, so... back to Startpage, it gives me lots of stuff about onion foods.
Not so much about Tor onions.
Okay, good. We actually just needed, wanted the search here.
But. You may go ahead and do an additional search if you want.
I just put in "onions" and "tor" into the search bar to see if that tells me more stuff.
And okay, there are a whole lot more results here now.
There's a Reddit link, there is a second search called "Hidden Wiki"
which gives me a URL that is line noise dot onion, and that looks like something interesting to click on.
And I click on it in the background.
Ooh, here is a link on the "youtube over tor" search that I did called "Watching YouTube over the TOR network" from Ubuntu Forums.
That looks like that might be helpful if I am trying to find videos on YouTube.
Some people complain that it doesn't always work.
Uh...
Okay, not seeing a huge amount of warnings right away that tells me that it shouldn't work.
I am going to open a new private window though inside the Tor Browser, because, just on the assumption that I might be searching for controversial videos,
so I am going to, you know, dispose of all of my cookies and tracking information and then go to "https youtube", "youtube dot com" in my new private window.
And it tells me I am viewing YouTube in English, that is cool. So it's not routing me through Kazakhstan.
Let me see if I can type in "ode to joy" in the search bar, in YouTube.
Okay. There's a whole bunch of... now I...
Stupid Google. I don't want to look at your ads.
[Laughter.]
Okay, so I clicked on the first one.
Hmm. "Cookies help us deliver our services. By using our services, you agree to the use of our cookies." says YouTube.
Well, fine. I guess I can accept that because I am running in a private browsing window
and my cookies will be destroyed after this session anyway. So...
That was not the video I clicked on. This is somebody's channel.
"A plugin is need to display"...
Oh, okay, it loaded, I guess it fell back to HTML5.
And you have you have the little plugin warning up in my... about bar. But...
Okay, this takes a while. I am just going to go to my settings, okay.
I can't reduce quality on the video any so I guess I am just kind of stuck waiting.
It is curious that this session is giving me YouTube in German. So... I guess this particular connection has routed me through Germany.
Which could get kind of annoying, so I am going to pop open a new tab in the same private browsing window
and go to "www dot google dot com slash n c r" which is "no country redirect".
And that will set a cookie in that session to use English US.
So. Now I am waiting for my flash mob YouTube video to load. I am just pausing the video playback to let it buffer.
Doesn't seem to be winning, so...
You don't need to watch the whole thing, but just enough to get an experience of it.
This is just like T-Mobile!
[Laughter.]
Okay, so that is... Yep, I wish to close both of those tabs. Okay.
Good.
Now back to my onion menu. Okay, where is the onion menu on Tor Browser?
There's the Tor Browser... Here's a little coffee cup... What if I click on the coffee cup?
Clicking on the coffee cup doesn't do anything.
Um, "Options"? No. That is the... that's just the launcher options.
Okay. "Tor Browser Preferences". That is not what I was looking for.
Well, let's find Tor.
"TorBrowser - ux", "TorBrowser"... Okay, that's my Tor Browser.
Hmm, okay. "Tools". Those are Firefox tools, it looks like.
Which... HTTPS Everywhere settings...
"Use 'New Identity' under the onion menu." Hm. Okay.
Let me type in "onion" in the search bar and... nope.
That gives me Wikipedia links for onions and dictionary definitions for the onions
and Bing searches and foods, but...
That... okay. Let me go back to the Tor docs.
But actually, if I am being all paranoid and stuff, I am going to close out my Chrome tab and go back again...
And I am going to type in this new search tab, "osx tor onion settings".
Let me see if that...
That takes me back to the Tor Project Mac OS X install instructions. So that looks like something I want to read some more.
Okay. "Verify download".
Okay, so I'm going to look at the Tor FAQ entry for "Tor doesn't work".
Tor seems to be working, but it's not entirely clear to me where all my Tor settings are.
Let me go into System Preferences, maybe there is a... maybe there is a preference in there.
"tor". Nope. No system preferences for "tor".
"onion". No, no system preferences for "onion" either.
Searching for "tor".
And now I've got TorBrowser and TorBrowser but no other settings.
Hm. "Tor Browser Bundle".
Let me look at the Torify HOWTO. Maybe that will tell me.
Okay.
Tells me all about setting up proxy and SOCKS.
"Do not mix modes of anonymity"... "Tor over Tor"... "Software updaters"...
I think not. Uh...
Ooh! Tor manuals. Let's see if there is one of those for OS X.
"Configuring manually", "Configuring a relay". That looks like that might be useful.
No, that's for Debian. Doesn't say for Mac. Okay.
Let's back up a little bit and "osx tor settings" in Startpage search.
That's the... Tor Browser Bundle...
Okay... "Why use Tor" on a Mac, "What Tor can and cannot do".
Okay, step 1, "Install the Tor Browser Bundle".
Step 2, "Configure Tor to use the..." Tor...
Okay, so it is telling me to do something with Vidalia.
"vidalia".
Nope, that gives me links to Georgia and songs on iTunes.
Tor Browser...
Okay, hm...
Well, this page on the Internet tells me that in version 3.5 of the Tor Browser Bundle, "About"...
and I have something definitely newer than 3.5. They bundled Vidalia right into it, and...
Clicking around to see... How to I open new...?
Okay, so this tells me that I am going to have to start looking in "torrc settings"?
Let's see what happens if I type "tor browser bundle new circuit".
Okay, so I clicked on the link to Stack Exchange, that says how do I switch a, to a new circuit?
"Tools". "View"...
Hm. "'New Identity' under the—under the onion menu."
Hm. I feel like I am...
Oh, hey! There's the onion menu. That was not obviously defined at all!
Okay. Cool. Now that I found the New Identity in the onion menu, I will click that.
It closed all of my windows and it gave me a "your browser is connected to Tor", and...
Okay, I went to 165.254 something, as my IP address. I am going to go "New Identity" again, close my window, and I am going to test my settings.
And it gave me 104.131, so I believe that maybe the New Identity is... actually tearing down my circuit and giving me a different exit node. Awesome.
"Cookie Preferences". Hmm.
Alright well, I am going to go to "www dot", oh, who's full of cookies...
"gawker dot com". They're totally going to give me cookies and stuff.
[Laughter.]
And maybe, yeah... yahoo.com while I am at it.
Now I should have a whole bunch of cookies.
So if I go to Cookie Protections,
I don't see any cookies in there. I guess that's cool.
Let me go to Tor Browser Preferences. And go to "Privacy".
I am going to click "Content" and then to go to
I am looking for all of the cookies and stuff in here.
Da da daaa...
"General"... "Tabs", "Content"... Let's see what's up...
That's pop-up exceptions, that's fonts and colors...
"Privacy". "Learn More".
Okay... it's not quite what I wanted to have happen.
Anyway, "Cookie Preferences".
Let's see. I am going to click the "Protect New Cookies" button and see what happens.
"www.google.com/ncr". Because that should set a cookie.
Okay, and then what happens if I go to Cookie Protections? Hm. Still no cookies.
Not sure what that does for me then.
"Preferences".
Okay, this is the usual Firefox preferences that I would expect.
I am not going to mess with those any.
Okay. I see that it's got private browsing turned on.
Turns off all of the plugins, which is good.
Restricts all the third-party cookies, and I guess spoofs... spoofs browser settings.
Which is actually... I am going to type in "what is my useragent".
Just to see what my browser identifies itself as.
And! There we go. whatismyuseragent.com.
And it tells me that I am probably using "Mozilla 5.0 Windows NT 6.1 Gecko Firefox".
Sure, why not. This doesn't look anything like this Mac full of nuclear secrets! Awesome.
[Laughter.]
Sounds awesome.
Okay. And open network settings.
Ah! And this probably lets me to change the thing I selected at the beginning
about needing to go through a firewall or proxy or some sort of censorship thing. So.
I am just going to turn those on and...
Okay. I am going to turn off the proxy because I don't know that, I don't know what my proxy settings are, let's say.
So I am just going to say that I am on a network that only allow 80 and 443. And my ISP tries to block Tor.
I am going to go like that and then I am going to go New Identity which seems like a reasonable guess to make Tor do the things.
And... do the Tor network check.
I got a new IP address, so that's cool. Seems to have worked without any hassle to me.
"Network Settings". Yep, network settings are still back the way that I left them. I am using only 80 and 443.
Good, and so finally, just go along the toolbar and give a summary of what you think each UI element does, in the top part of the browser here.
Okay, so this is the good old NoScript, and it is set to block all JavaScript right now. Which is cool.
It appears to be just like the NoScript I run in my browser, so no surprises there.
Now that I finally recognize the little green onion, I see that's the Tor menu and that tells me,
or that gives me control over the Tor module itself.
I can tear down circuits, I can tell what I want it to do with cookies,
configure all the other details.
I didn't click on the "About", but I guess that tells me what version I am running if I have to file a bug report.
It also lets me change the network settings.
I've got the usual sort of tabbed browsing experience and I can click the little plus to open up all kinds of new tabs.
I've got the usual sort of omnibox where I can either type in any URL that I want to browse to or I can type in a search string.
And if I type in "search string", it sends me to startpage.com which seems to be the browser's default search provider,
as is shown in the little search tool,
and I have a selection of other search engines I could use...
Startpage is the default for some reason, there is also DuckDuckGo, Google, Amazon, Bing,
I guess they get progressively worse as you go down the list.
[Laughter.]
And then the typical Firefox settings menu.
I didn't play with HTTPS Everywhere. But it seems to be set up to force HTTPS wherever possible.
Great, that is the end!
Okay.