DoubleClickjacking: A New type of web hacking technique

Eh, it's hardly seamless, and double clicking is extremely uncommon on the web so that would be a big red flag.

Double clicking on the web is extremely common with older less technically adept users. This same cohort is also the most susceptible to scams.

This. I have told my eighty-year-old parents this many times over the years, but it doesn't seem to stick.

I see a lot of people doubleclicking on the web. Both young and old.

I couldn't even begin to count how many bug reports I've seen over the years that start with "when I accidentally double-click foo, bar happens". It might not be an intentional usage pattern, sure, but that doesn't mean it doesn't happen a lot.

I’ve tried to explain it many times too, but I can’t really articulate a good, comprehensive rule for when to single and when to double click.

> double clicking is extremely uncommon on the web so that would be a big red flag.

You've never had a slow internet connection have you? I've seen double clicking from all users in the office. Comes from frustration.

How many times have you tried to open an application; for it not open? So you click the icon again only for two windows to split open?

Young, old, even techs. It's not as uncommon as you think.

Google Drive uses it as an interaction pattern. I find that baffling, but while uncommon, it's not totally absent. And as others have pointed out, many users carry over their expectation of having to double-click from desktop interfaces.

I’ve even triple or quadruple clicked sometimes with disastrous results

Another obvious case of double click is to select all text in a given area. This one is a bit more obscure though.

Edit: Actually that's generally I guess triple click. Double to select a word.

Web browsers and the applications on them have become extremely memory hungry. Memory management pauses are common and people click multiple times irately.

Another complicating factor that many less-tech-literate don't have a good internal model for is window focus. I've seen several people try and single-click on a not focused web button, only for nothing to happen. When they click again, the button is activated. They then learn to always double click that button.

Having a mental model of "this button needs to be double clicked" gets them the result they want, even if that's not a very accurate reflection of the computer.

I double click to select text all the time. Get your flags ready.

When you're on windows and not in the browser, you double-click to launch a file or program in the Explorer (which also is what runs the desktop). Single-click is select.

So, the rule:

List of files on your computer or desktop? Double-click. Otherwise? Don't.

I'd laugh if an effective way to present this is:

CAPTCHA:

Please copy `qwertyuiopasdfhkl`

Into here `<textbox>`

Edit: Quick (ai mockup) concept... https://imgur.com/mc0IdEA Obviously it would be most effective with a longer string though.

Yeah, I have no data beyond anecdotal to back this up, but I witness A LOT of people double-clicking everything, regardless of what it is. I assume it's because they only got so far in "computer" as to learn "click + drag to move, double-click to open a program or file". Link on a web page? I want to open that!

What if I’m opening an email in Outlook? What if I’m looking at something in Control Panel? (That one’s a trick question, since the answer has changed in modern Windows versions.)

In theory: if you’re clicking on a UI element that has some notion of being selected, then a single-click selects it, and you need a double-click to take an action on it. If there’s no notion of selection, then a single click takes an action.

In practice: adherence to this ranges from perfect to abysmal. And users who don’t understand the computer well may not know how to think about whether a given UI element is selectable or not.

I'd say don't do that. Who reads emails?

Although seriously, I find I never break out of the preview in Outlook email. The only spot in Outlook where I really need to double-click is the calendar. Which is annoying.

I've had a few worn mouses register double clicks upon a single click. It happens inhumanly fast and users won't realize it until using an app that reacts to double clicks.

> When you're on windows and not in the browser

So many people have absolutely no concept of different windows let alone a browser. They run Chrome or IE maximized and that is "the Internet". They'll have tons of tabs open because they don't understand tabs and how to navigate them or that they can be closed.

A problem with billions of people using computers is that only a tiny fraction have working knowledge of them, an even smaller fraction understand them. Most people only understand operations by rote.