So... My name is David and I am a researcher here at the University of California Berkeley.
I have been asked by others to help improve a piece of software for people like you.
Um, I'm not responsible for the software, even though I do Tor development, I don't really do Tor Browser.
So don't worry about offending me.
We're really looking for... we're trying to make the software as usable as possible,
so we would especially like your help in identifying any parts that are difficult or confusing.
To this end, we're asking you to perform a "cognitive walkthrough".
This involves talking out loud while you perform the tasks that we ask you to complete.
As far as possible, I am going to be here to simply to observe.
I am going to try not to interfere. Don't wait for feedback from me,
and try to only interact is something is unclear, if you need further instructions.
So I am going to give a short example of cognitive walkthrough. And then you are going to do a demonstration cognitive walkthrough.
To give you an idea of what I am looking for.
So I am going to assign myself a task.
And this task is to find a paint program and draw a red hexagon.
So, I am looking at a desktop here. There's nothing on the desktop.
I am looking for something that will draw a paint program for me.
Down in the bottom it doesn't look like anything does that.
So I think I'm going to have to look for it. And to do that, I know I can find files by looking at Finder.
I am going to click on "Applications" and then see what... see what I can find.
This one is called "Paintbrush". So I am going to try that one.
All right, so it starts up and it is asking me a question.
I see it is asking me for width and height of the image.
Now I'm not sure if I will be able to change this later. It's not clear to me if this is an irrevocable decision,
but I don't know what to do about it so I am going to just click okay.
It looks like it changed size to match what I just typed in, that kind of makes sense.
And it looks like there is already a color thing opened up, so I'll pick a red color.
And I want to draw a hexagon so I am looking for a shape tool.
This one... looks like it's only rectangles.
This is ellipse.
Okay, so I don't have a hexagon tool, I don't think, so I'll try and just draw it with lines.
Now I am going to click here. And draw a line.
It's not what I expected.
I wanted it to connect those and that didn't happen.
So I am going to say "Undo".
And this time I am going to try to try just dragging.
Okay, that's what I wanted to happen.
But it is the wrong color. It's not what I expected.
I picked red here, and it surprised me that it didn't actually make the line red.
So I guess maybe if I click here, when I clicked that, this turned into black.
So this is really confusing. I don't know what this color meant.
Anyway, now it's turned red. So now we can continue.
I'll just redraw this line.
And I guess I kind of have to freehand this.
That was no good. Undo that.
I wonder if there is a way to automatically like close this shape, but I don't see that so I am just going to do it manually.
And now to fill it in, I know from other paint programs that this paint bucket will do that.
I click on it... yeah. And that's exactly what I expected to happen.
So that's the cognitive walkthrough. Explain what you see. Anything that is surprising. Yes.
Think out loud, basically.
Yeah. Exactly.
Alright, uh let me close this. Now, I am going to give you a demo task to practice the cognitive walkthrough.
Okay.
So I want you to open up a web browser and then find out the population of Zimbabwe.
Okay. I recognize Chrome.
Mmhmm.
Which is what I use, so I'm going to open that up.
I am just going to type in the search bar up here, which I know is just a Google search.
Population of Zimbabwe, did you say?
Yeah.
Zimbabwe.
And then let's just see what we get if we just type it in there.
Google's telling me that in 2013 it was 14.15 million but I... Their source is the World Bank.
I trust that a lot but I would probably...
want to look at the CIA factbook. Which is the third result. Just to...
Sure.
...double-check that.
And it looks like something's going on with these images that aren't loading.
But I see it says "People and Society". Which may give me population.
And then there I have a population mark.
13.7... But do we have a year? Oh, July 2014.
So this actually probably would be the most recent, most accurate one I can get.
Okay. Great, yeah. Good job! So it's good... yes. To explain when something is familiar. You've seen it before, so you recognize it.
Or when anything is—appears broken. You know.
Mmhmm.
And there may be some downtime that you're going to have to do a download. And so, while that is happening, just, you know,
see what you can see on the screen and explain what is going on.
Okay.
Go ahead and close this and I will give you your list of tasks.
Okay.
So here they are, seven things.
Okay.
You are going to be... downloading, using Tor Browser for some web browsing tasks.
Okay.
And I will just be observing. Just kind of do this the way you would do it if you were if you were going to do this at home, and do it from scratch.
Do you have any questions before we start?
No.
Okay. Alright, go to it!
So, I am going to download Tor. I am going to reopen Chrome.
And I am just going to search "tor browser".
Which, if I am going to be completely transparent, isn't something I probably would do.
Or have a source do in a real situation, just in their Chrome browser.
Especially if they were at an institution, like on an enterprise network or something.
Sure, okay.
Okay, I am going to... "torproject.org"...
There's even...
I am seeing the second result is "Download Tor".
That might save a few steps, I will click on that.
And I am going to download Tor Browser for Mac.
Okay.
Um, this is a little... weird-looking here.
I see a... this is good though.
This is telling people that they shouldn't totally rely just on Tor, or on this program.
"You need to change some of your habits".
I am assuming that's like, kind of like threat modeling and that sort of thing.
So that could be good, although I think maybe that would be better...
I don't know. I look at that and that almost looks like an ad or something.
The way that's set up, it seems like, like I almost, like, my first instinct was to just kind of look past it.
But it is something that is probably important.
And then it's repeated down here.
I am just reading through these.
Okay.
So these all make sense. This is all good info.
"Don't open documents downloaded through Tor while online".
So that is something that I don't fully understand?
Oh I see.
So I guess basically if you were to download like a PDF...
and then open it, some of that traffic might not be as private as you want it is my basic understanding.
Mm.
Yeah "This will reveal your non-Tor IP address".
I guess, yeah that makes sense.
I mean, that's not something that intuitively I would know though, I don't think, so I am glad that's there.
"Use bridges and/or..."
I am reading this last section, "Use bridges and/or find company".
And it almost seems like it's a little out of my league as far as my understanding of networking.
I guess they're just saying... Get your friends to use Tor and set up Tor bridges?
I don't really, I don't totally grasp what that last point is going for.
Okay, this is finished!
I am going to click on it. And install.
I am going to drag this into the Applications folder... There is already one there!
Yes, this is my fault. This is left from a previous experiment. Why don't you just say "Replace"?
Yes. This is what I would normally do if this happened, at least.
Sure.
Okay, so I am going to now close out of Chrome.
Close, actually, I think now I can just open it right from here.
"Can't be opened because it's from an unidentified developer".
Oh, this is annoying.
I have had to deal with this before.
I am going to go to System Preferences.
And I think it's "Security & Privacy". There's like a box you uncheck or something.
Oh, right here. Hopefully I won't need... Oh, I don't, I don't know...
It's "password".
"password".
Okay, I am going to say "Allow apps downloaded from anywhere". "Allow From Anywhere".
Close that. And then try this again.
Yes. I want to open this.
"A copy of Firefox is already open. Only one copy of Firefox can be open at a time."
Um, there must be something running in the background because I am looking at Firefox and it doesn't say it's open.
So I think what I am going to do now is look at the processes and see if there's any... which, what is it called on...
I just did the gesture to pull up the...
Mmhmm.
Dashboard maybe? No. This must be painful for you. [Laughter.]
Uh... Here we go.
"Activity Monitor", that's what it's called. And then I am just going to look through here and see if there's anything that says "Firefox" or maybe "Tor".
Maybe like there's like an old one open?
There is nothing called Firefox.
I don't see anything called Tor.
So at this point, I would probably become a little bit frustrated. [Laughter.]
Let me see. I might at this point, probably just restart.
Mmhmm.
But I am just going to try this one more time.
It's taking longer than I expect... So yeah, okay.
I think I am just going to... Just make sure... Yeah, I am just going to restart.
Here, don't restart it, because it will mess up the video screen.
Okay, well then I think this is probably where I'm going to need your intervention.
So here, open up the Applications folder, and open it from here.
Oh.
You actually found a known bug, but a pretty bad one.
Right. Just because that stays open, I think. It's a little... okay.
I am trying this again! Okay, and now I have a box.
"Before you connect to the Tor network, you need to provide..." "Which of the following best describes..."
I think I can just connect directly to the Tor network. I don't know if there is some weird, like Cal wi-fi thing that would...
Yeah, this network, there's none of the...
Okay.
It's loading and I have seen this before. A number of times I have used Tor...
Okay! I've got the Tor Browser open. And now I am going to check that Tor is working.
Basically, I am just going to go "what the fuck is my IP" [Laughter.] "dot com".
And see where it thinks we're located.
Do I need "www" there?
Oh, no, it just took a while. Oh, so it thinks we're in the Netherlands. So I assume it's working.
I don't know if there are other steps you can take to ensure that. But usually, this the check that I do to see if my VPN's working or whatever.
Okay.
"Do a web search for 'onions'."
I am going to back and use their search bar. "onions". Okay.
Cool, yeah. You don't need to go down any farther. We just wanted to see the search.
Great. And now, I go to YouTube...
And search for "ode to joy".
Okay, so I guess I don't have to open anything, so I'm just going to...
Go ahead and click on whatever you would...
Oh, okay. I'm going to let this video load.
I see this bar up here. "Cookies help us deliver our services".
I am think just going to let that be and not deal with it.
This video is loading kind of slow.
Should I New Identity it?
No, we just wanted, like, however much you need to get the experience of, you know, the YouTube thing.
And any other comments you want to make on it.
This is being really slow.
It seems like it is flickering, which I don't know if that is part of the video or not.
I almost think it's not.
That's weird. I haven't seen that before.
I don't think that is part of the video. I think that is an issue.
Having to do with this ad, maybe, or something? I don't know.
Okay, that is good for the YouTube.
Okay, so now I am going to "New Identity".
Which I know you can go and click on the onion and it's the first option.
So I am going to hit that.
Is that what you expect to happen, when you? What's your understanding of what happened, and what do you expect?
My understanding, so like, say, so I'm on YouTube, and I just had searched for that video.
And now, hitting a new identity, if I were to go back to YouTube, it wouldn't like suggest anything about Ode to Joy because any info
that the browser, the connection, was keeping on my search for that would be now totally divorced from me, is my understanding.
And as far as the behavior of the new window popping up, I think that's fine, but I almost...
I don't know... I don't know if that is like crucial, but...
I almost might be worried if I was on something that I cared about, like some page,
that I'd like lose that and be kind of freaked out.
Because, like the back button's grayed out.
So I know, whatever I was just on is kind of lost.
Okay.
Which would be a little concern— I mean, now that I know that,
maybe I would just make sure to like save that link or do something...
But I could see how that might be an issue
for some users who would want to like, bookmark that or something.
And I actually don't know how bookmarks work on Tor. But I assume... Yes, it's just the same as Firefox.
Okay. Alright, so the last one, just go through the toolbar at the top part here, and explain what you think each part of it means.
Okay. This... oh.
So I haven't really messed with this before.
But I'm... "Forbid Scripts Globally".
I mean, I am guessing that this is just another like layer of protection for, like, not revealing your IP address?
But there might be some situations where you'd have to like allow, to like make something work on certain pages.
But I don't know.
I'd probably just leave that on its default settings.
Which I guess...
It's saying, the one that is advised isn't the default?
Which is a bit confusing.
And now, I am on the one that is advised.
And the one that it was defaulted on, it is telling me is dangerous!
Which... I don't know... that's kind of weird to me. [Laughter.]
But. Okay. I think I don't understand enough.
I mean, I am guessing, is this maybe, like my thought process, are these scripts,
does that mean like, allowing webpages to run scripts like on your computer, or something?
I don't really understand that.
But this whole "dangerous"/"recommended" thing and the dangerous one is the one that defaults is weird to me.
Okay.
This I know is New Identity.
But then I have toyed around before with like preferences and looking around and usually it's out of my understanding.
Yeah. So I will just close that.
I get the back button.
The search bar is intuitive, I mean, it just looks like Firefox.
Um, this is familiar. I can choose which search engine I want.
And then this is also familiar.
And I see HTTPS Always is running, so that's cool.
Alright, great.