This question has started to preoccupy since read Stevey's Google Platforms Rant by Steve Yegge. (The original post was removed.) Among many other things he asserts that usability is more important than security. Personally I agree that the safest way of keeping your data is yanking any cable out of your machine, completely powering it off and locking it away into a safe... Still, what do you think is the right mix of security measures vs usability?
closed as not constructive by Patrick McElhaney Dec 2 '11 at 17:11
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.
I hit this question constantly and almost always have to make adjustments during testing sessions.
The post is correct that if the product isn't usable or accessible, then there is no product since it'd be a digital rock. Though the argument I think is flawed a little bit.
Looking at the argument a different way...the user doesn't care what happens at a systems level after they click the "add to cart" button or even login. They only care that their assumed expectations (i.e. the correct product, at the correct price and quantity, is added to the cart) are met. To the majority of users that's I've talked to through tests and interviews, only consider security when there's something that triggers the response such as a Social Security Number or similar field, a SSL warning from the browser, or even a picture of a lock for example.
So at a broad level, usability and security are fairly stand alone since you can have a very secure system that is still usable. When they collide is when the user becomes aware of a security concern and you have to test to see how to best address the concerns of the system and the concerns of the user at the same time. There'll always need to be a compromise.
When compromises need to be made, I start with the following rules and then tweak after testing/review.
Again, all of this needs to be tested and reviewed for your scenarios; however, this is what I usually start with. It's amazing how many conflicts these 3 rules can smooth out for developers and users alike.
Don't forget that depending on the situation, better usability actually yields more security:
Security and Usability - Designing Secure Systems That People Can Use