Usability vs. Security [closed]

Question

This question has started to preoccupy since read Stevey's Google Platforms Rant by Steve Yegge. (The original post was removed.) Among many other things he asserts that usability is more important than security. Personally I agree that the safest way of keeping your data is yanking any cable out of your machine, completely powering it off and locking it away into a safe... Still, what do you think is the right mix of security measures vs usability?

Answer 1

I hit this question constantly and almost always have to make adjustments during testing sessions.

The post is correct that if the product isn't usable or accessible, then there is no product since it'd be a digital rock. Though the argument I think is flawed a little bit.

Looking at the argument a different way...the user doesn't care what happens at a systems level after they click the "add to cart" button or even login. They only care that their assumed expectations (i.e. the correct product, at the correct price and quantity, is added to the cart) are met. To the majority of users that's I've talked to through tests and interviews, only consider security when there's something that triggers the response such as a Social Security Number or similar field, a SSL warning from the browser, or even a picture of a lock for example.

So at a broad level, usability and security are fairly stand alone since you can have a very secure system that is still usable. When they collide is when the user becomes aware of a security concern and you have to test to see how to best address the concerns of the system and the concerns of the user at the same time. There'll always need to be a compromise.

When compromises need to be made, I start with the following rules and then tweak after testing/review.

1. Challenge the security requirements (e.g. can just the last 4 digits of a social security number be used instead of the entire thing?).

2. Give the user more control and visibility of their security (e.g. don't restrict password patterns but make sure there's a security warning or password strength indicator so they know how insecure the password they use for everything really is).

3. Legal wins - if there's a legal requirement in terms of some security requirement that impacts the user, inform the user and implement the security measure.

Again, all of this needs to be tested and reviewed for your scenarios; however, this is what I usually start with. It's amazing how many conflicts these 3 rules can smooth out for developers and users alike.

Answer 2

Don't forget that depending on the situation, better usability actually yields more security:

• If the security mechanisms are too complicated to use, users will often choose not to use it at all. (To put it bluntly: Why is Blackberry less used than iPhone?)
• If bad usability hinders the understanding what the security mechanism protects, the user will find a way to circumvent it. (E.g., if you require a 20-char password, they will definitely write it down. Is this desirable?)
• A of security also can decrease usability, namely, if malfunctioning comes from being exploited. (The user of a hacked phone will blame the manufacturer, not himself.)
• Bad usability may create a false sense of trust. (If I need to log in to see my content, I will assume that everybody else needs to do the same, even if it is nowhere "promised" explicitly.)

Recommended Reading:

Security and Usability - Designing Secure Systems That People Can Use (O'Reilly)
It tries to reframe IT security (Authentication, Privacy, ...) from a psychological, Usability point of view.