Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

This question has started to preoccupy since read Stevey's Google Platforms Rant by Steve Yegge. (The original post was removed.) Among many other things he asserts that usability is more important than security. Personally I agree that the safest way of keeping your data is yanking any cable out of your machine, completely powering it off and locking it away into a safe... Still, what do you think is the right mix of security measures vs usability?

share|improve this question
add comment

closed as not constructive by Patrick McElhaney Dec 2 '11 at 17:11

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

I hit this question constantly and almost always have to make adjustments during testing sessions.

The post is correct that if the product isn't usable or accessible, then there is no product since it'd be a digital rock. Though the argument I think is flawed a little bit.

Looking at the argument a different way...the user doesn't care what happens at a systems level after they click the "add to cart" button or even login. They only care that their assumed expectations (i.e. the correct product, at the correct price and quantity, is added to the cart) are met. To the majority of users that's I've talked to through tests and interviews, only consider security when there's something that triggers the response such as a Social Security Number or similar field, a SSL warning from the browser, or even a picture of a lock for example.

So at a broad level, usability and security are fairly stand alone since you can have a very secure system that is still usable. When they collide is when the user becomes aware of a security concern and you have to test to see how to best address the concerns of the system and the concerns of the user at the same time. There'll always need to be a compromise.

When compromises need to be made, I start with the following rules and then tweak after testing/review.

  1. Challenge the security requirements (e.g. can just the last 4 digits of a social security number be used instead of the entire thing?).

  2. Give the user more control and visibility of their security (e.g. don't restrict password patterns but make sure there's a security warning or password strength indicator so they know how insecure the password they use for everything really is).

  3. Legal wins - if there's a legal requirement in terms of some security requirement that impacts the user, inform the user and implement the security measure.

Again, all of this needs to be tested and reviewed for your scenarios; however, this is what I usually start with. It's amazing how many conflicts these 3 rules can smooth out for developers and users alike.

share|improve this answer
add comment

Don't forget that depending on the situation, better usability actually yields more security:

  • If the security mechanisms are too complicated to use, users will often choose not to use it at all. (To put it bluntly: Why is Blackberry less used than iPhone?)
  • If bad usability hinders the understanding what the security mechanism protects, the user will find a way to circumvent it. (E.g., if you require a 20-char password, they will definitely write it down. Is this desirable?)
  • A of security also can decrease usability, namely, if malfunctioning comes from being exploited. (The user of a hacked phone will blame the manufacturer, not himself.)
  • Bad usability may create a false sense of trust. (If I need to log in to see my content, I will assume that everybody else needs to do the same, even if it is nowhere "promised" explicitly.)

Recommended Reading:

Security and Usability - Designing Secure Systems That People Can Use (O'Reilly)
It tries to reframe IT security (Authentication, Privacy, ...) from a psychological, Usability point of view.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.