I’ve been buying my Calgary public transit passes via the online store and recently they launched a new version called CITYonline. It looks ok, and it’s definitely a step up from the previous version. But in the 10 minutes that took me to register and buy next month’s pass I found some glaring usability and security problems .

First: you broke my browser

Disabling copy and paste is the new “right click is disabled” (so, 1997).

Dear Calgary: people use copy and paste, they like it and rely on it. When the iPhone didn’t have copy and paste people complained.

So, why do you disable it?

If you are worried that your database will get filled with incorrect emails because of typos then check the SMTP response headers. Or just accept errors as a part of life, but don’t make your lives easier by dumping shit on your users.

Second: so many options

On any listing of products, Calgary chose to use a select input element (marked with the red arrows).

Select elements (combo boxes in corporate parlance) are meant to give the usersmore than one option to choose from.

Each of those select elements have only one option. There’s nothing to choose!

This is a small problem and can be solved easily, but still shows that the people who made the site didn’t know what they were doing.

Third: I say “Yes”, but I may mean “No”

When you create your account and confirm your email (more on that on the next problem) you are required to select a password, and a helpful message tells you that you have to use_at least_ 7 characters.

Then, I tried to use 44 using 1Password and noticed that it looked shorter than 44 characters.

We’ll it turns out they tell you to use at least 7 characters, but don’t tell you that you have a maximum of 20 available.

That’s a very bad usability problem, it’s like saying to your kid “yeah, go out and party all night and come whenever” and “forgetting” to tell them that you won’t open the door when they arrive at 3 in the morning =).

BTW: they do the same thing with emails, limiting them to 50 characters. The maximum length of an email address is actually 254 characters .

Fourth: here are the keys to my kingdom

Registering is a two step process in CITYonline:

1. You write your name and email (no copy/pasting!)
2. You receive a temporary password to your email.

When you go and login with said temporary password, it forces you to set a new password. Very safe.

And then they send you FRIGGIN’ PASSWORD TO YOUR EMAIL!!!

Never, ever send a password to the user’s email EVER!

1. Email is not a secure enclosure.
2. It potentially means that the City of calgary is storing the passwords in a readable way.

Good thing CITYonline doesn’t store your credit card information (or does it?).

Fouth plus one: the emails suck

This one is just a pet peeve.

The email I received from CITYonline has header image of 1029 pixels wide, this wreaks havoc with many email clients as you are forced to scroll back and forth to read the whole thing.

Just use an email template from the pro’s .