Know Your Form Data

Developers often build data entry forms that don't match with the reality of the information they are trying to collect. This can mean the forms are unusable.

I am surprised about how reluctant most specialist usability companies, at least in the UK, are to considering the security implications during usability testing. Reactions I've come across range from "usability has nothing to do with security" to "the client will deal with that". I think they are missing an opportunity.

Although we hear a lot about confidentiality, information security includes the principles of availability and integrity:

• Availability - Maintaining systems, resources and data so they are accessible when required and are functioning correctly
• Integrity - Ensuring data is valid, complete and cannot be modified or deleted without authorisation

Here's an example "change address" form where the integrity checks are not correct and therefore denying use of the service to a customer:

The form belongs to a very customer focused organisation in a highly regulated business sector. Therefore, I suspect that the web site has been through extensive usability testing. But it is not possible to provide an address that doesn't have a house number, flat number or street name. Strange, since there are many valid Royal Mail listed addresses like this, yet this web site has been built to specifically exclude them.

Well, I don't think the project team set out with this intent, but that's what happened. There is no way to change your address, except to phone the call centre. Of course, it might be that the database behind the scenes has some (incorrect) constraints on what it thinks constitutes an address and the developers have coded the web site to match. What makes me suspect this, is that the drop down list of county/region names includes truncated county names, and even entities that are not counties, regions or metropolitan areas. Also, the displayed text is the same as the values submitted by the form. However, that's not the right way to do it.

Some of these are not counties, and if the address was on Skye, would you select 'Skye' or 'Highland' (region)?

Even if the back-end system doesn't allow addresses without street names etc, the web site should accept valid addresses and then put the change into a pending state, for subsequent checking and update of the main system. It must be possible somehow, since you can do it by telephone.

The Royal Mail has an overview of what constitutes a correct postal address in the United Kingdom, but it always pays to check the original source which tells a slightly different story: Why, What and How - A Guide to using the PAF® (PDF):

This 204-page document also explains how long each address line could be, and everything else about the Royal Mail's Postcode Address File (PAF) products including character conversions. BitBoost Systems maintain a useful International Mailing Address Formats web page but always check with the original sources - don't rely on anyone else's interpretation.

Recommendations:

• Understand the properties of all your data
• Don't enforce internal constraints and methods on remote users
• Don't make your web systems more complex than your other methods of communication (such as telephone)
• Make it easy for web site user to get it right

And, include consideration of security issues during usability and user acceptance testing.