Morgan has spent years making sure nobody can tell who you’re talking to on Ricochet Refresh. Whether anyone could actually work the thing was a much harder question to answer from the inside. A UX review through Commons Caretakers answered it, not very kindly.
“I’ve been staring at this thing for years and I know where all the buttons are. You lose context of how non-obvious it all is.”
People hear encrypted and they think private, which is the confusion Ricochet Refresh exists to correct. Encrypt a conversation all you like: if someone can see that this journalist is talking to that person twice a week at three in the morning, they don’t need the contents. The pattern has already told them what they wanted to know.
So Ricochet Refresh is anonymous and metadata-resistant as well as encrypted, running peer to peer over Tor, with no server in the middle to seize and no company to subpoena. Contacts, chats and keys stay on your machine, and who you spoke to and when is known to the two of you and nobody else. It’s sponsored by Blueprint for Free Speech, a non-profit working on legal protection and advocacy for journalists, whistleblowers and sources. Morgan is the main developer, with a couple of others in and out over the years and a small community around it.
Morgan’s day job is at the Tor Project, leading the team behind Tor Browser. None of which is the CV of somebody who struggles with difficult software.
The challenge
The hard parts were never the problem.
Ricochet launched in 2014 and looks it. The interface sits on a very old version of Qt and inherits its instincts from an earlier era of chat software; Morgan’s own comparison is AOL Instant Messenger, which is affectionate and also fair. Signal and everything like it moved on in the meantime, so new users open Ricochet Refresh and are simply confused.
Then there’s discoverability. Want to send someone a file? Right-click their name in the contact list. That’s the feature, and it made perfect sense to the developer who put it there.
“If you’re the type of software user who grew up in the 90s, right-clicking on things to see what’s available is a very natural thing to do.”
To anyone else it makes no sense at all, and people would ask how to send a file after months of using the thing. Morgan’s verdict is the sort of judgement you only pass on your own work:
“As soon as your application has a manual to explain how to use it, you’ve lost the plot.”
Behind all of it sat a plain constraint: in the entire life of the project there had never once been capacity or funding for UX research or front-end design.
“I basically leech design skills off the designers from my day job.”
Which got Morgan further than you’d expect. Borrowed instincts only reach so far.
Discovering Commons Caretakers
Blueprint has been through several rounds of NLnet funding, this being the third or fourth, and Morgan is warm about NLnet for reasons that have very little to do with money.
“There’s no quarterly reporting. There’s no meet-and-greets you have to go to and schmooze with the right people.”
This round was different from the ones before it, though, because rebuilding an interface meant the work had stopped being purely about software and algorithms.
“At this point we were like, okay, this actually has to deal with people. What resources are available?”
The answer was sitting on the NLnet site: UX support from Commons Caretakers, among other things. Morgan filled in the form and heard nothing back for weeks. It was around the holidays, so nobody chased it. Then at FOSDEM, Morgan happened to be staying in the same hotel as somebody from NLnet, mentioned it in passing and got a puzzled look in return. The form had broken, or the message had gone to spam. Somebody made the introduction to Commons Caretakers by hand.
The process
A couple of calls with Miroslav, a UX specialist. Morgan handed over the planned designs, a large PDF exported from one of the online design tools, walked him through what Ricochet Refresh was for and who used it, and left him to it.
What came back was a long document, and two things in it did the real work. The first was a walkthrough of a new user trying to operate the application.
“Our UX person didn’t understand how to do basic actions in the application. It’s amazing we have any users, honestly.”
Morgan’s read on the existing user base is unsentimental. People who use Ricochet Refresh must really care about their privacy, because the feature set isn’t there and the usability is bad. Nobody arrives casually. They have to want it.
The second thing was a competitor analysis: a big table of chat applications, the features each offers, and where Ricochet Refresh sits among them. Morgan had no interest in it at all on arrival.
“We’re never going to implement a feature just because all our competitors are doing it.”
That was true and it stayed true. But the table wasn’t much use as a shopping list, and that isn’t how it got used. What it gave Morgan was a picture of what people now expect from a chat application, emoji and bold and italics and the other small ordinary things, and expectation is a separate question from priority. Everything still goes through the same filter.
“If it improves usability, that’s great, but only if it can work with our threat model. If it doesn’t, I don’t care how much you want it, you can’t have it.”
The outcome
Front-end work started in earnest once the report landed. The backend has been re-implemented in Rust and the interface is being rebuilt screen by screen on a new toolkit, which Morgan is enjoying rather more than the old one.
“You write some C++, you ask for a button, and a button appears. Then you add an event handler and it just works.”
The approach has been to copy other people’s homework, deliberately and without embarrassment. The Tor connection screen borrows from Tor Browser, which has had years of UX funding aimed at exactly that problem: how to show someone a technical process without frightening off the casual user or starving the power user in a censored country of the detail they need. The profile unlock flow borrows from KeePassXC, since chats and contacts now live in an encrypted file rather than a plain one in your home directory, and asking someone for a password before showing them anything is a problem password managers settled long ago. What comes out of it is an application that looks like it belongs to the ecosystem it’s part of.
None of it has reached users yet. It’s in a dev branch, and Morgan is hoping for a vertical slice by the end of summer, with the new interface talking to old clients at feature parity.
“It’s been a lot of nothing works, nothing works, nothing works. Then you write a bit of UI code that’s wired up to the backend and suddenly I can open a profile. Then a bit more, and I can put my password in, and it actually works.”
More than a deliverable
Ask what the report gave the project and the answer isn’t a fix.
“We had a goal in mind and just needed help getting there, and confirmation that the choices we’d made actually made sense, that these were actual problems that needed solving rather than just navel gazing.”
For a project that has never once had UX capacity, that permission counts. Months on an interface are hard to justify to yourself when there’s backend work queued up behind them and no way of knowing whether the interface is really where the problem lives. A document from somebody who does this for a living, saying yes, it is, and here’s the order to take it in, is what makes the time defensible.
Morgan’s advice comes down to turning up prepared.
“You can’t just bring in an expert, drop a thing in their lap and leave. You have to have some problem you know exists, that you want to solve, and that you know the expert can help you with.”
It’s the same as a security audit, is the comparison Morgan draws. You already know where the scary parts of your code are, so point people at them.
Could Commons Caretakers help your project?
If you’re a maintainer of a free and open-source project, you don’t have to do everything yourself.
Commons Caretakers supports grantees of the NGI Zero programmes and the wider NGI ecosystem with practical, hands-on help in areas including testing, accessibility, technical writing, internationalisation, technical mentoring, and more.
Engagements typically start with a single conversation.
Leave a Reply