Does OS security equals "perceived" security for users?

Question

While this question originated primarily in MacOS Catalina and its new security features, I want to know how security measures are leveled with UX options so poor in the user's vision.

Catalina's experience

Just so you understand what I mean, I have 10 Apple devices. A couple of weeks ago, with the iOS update before Catalina, everything broke down due to iTunes sync issues. I finally ended up resetting all 3 iOS devices to factory default, and I lost a lot of information, but hey ... despite the trouble, I thought it was over, so I didn't care much.

Now, after 48 hours of using Catalina, I get more and more upset. Everything (and I mean ABSOLUTELY EVERYTHING) requires permits. Sometimes, they are hidden behind active screens. As an example of HORRIBLE UX something that just happened to me: while I was sure I was capturing the screen for a client for a period of 3 hours, once I closed the active application window, I saw a notification that I had to Give permission for my iMac to capture the screen. When I checked the catches, I saw that I had 3 hours of nothing more than Catalina's welcome image.

For those who do not use Catalina, here is an example of Catalina UX (taken from this article):

In a case like this, the user's obvious behavior will be "accept, close, close, close, stop bothering me, do whatever you want", which is the definition of anti-security and an obvious UX anti-pattern.

Other systems

Of course, Catalina is not the only one, Windows had a good amount of UX nightmares. The same with banking applications, ATM user flows, 2FA that prevents users from taking an action, etc. The conclusion is that legitimate security concerns are generally overshadowed by the horrible user experience to the point that users engage in unsafe behaviors. I can confirm that this is becoming a really worrying trend after working on usability surveys for a well-known antivirus: most users hated security features and simply disabled the antivirus or ignored the warnings.

Thus, here's my question (s):

• Is there any acceptable threshold to define a compromise between security and user experience? If so, how is that threshold measured?
• Are there independent studies that show how users react to such security measures that do not favor their own experience?

Answer 1

Don't worry, it will get better. You are understandably upset because the update was released and you encountered all the issues with programs that are not adapted to the update (yet). As you can see in the screenshot, there are many ways the programs take to ask for permissions and some are bad, some are worse and all are targeted wrong (yes, none of them are "good" or even "okay").

For example:

• Alfred 3 makes pop ups for each permission needed - worst.

• Parallels presents a combined dialog for requesting permissions but also wants "Full Disk Access" - bad.

• A responsible user would deny any program a "Full Disk Access". This would include "formatting and deleting everything" judged by the wording. While the program just asks for accessing "everything" because it wants to allow the user to load and save data on any place on the disk the user likes. There would be no need to ask for such permissions, if the operating system would link those "permissions" to the dialogs used for loading and saving. Of course no user wants to allow a program deleting or overwriting a file, but on the other hand a user surely wants to allow the program to store a file which was specified by path and filename in a dialog already. Maybe programs need to be adjusted to use a new API for that provided by the OS (hopefully there is a new API).

Measuring the negative impact by security in terms of performance of certain tasks can easily be captured by time consumption for example. The use case would be designed to accomplish some tasks and the time needed for dealing with the permissions can be a measure of hampering the anticipated workflow.

As for a threshold when it is "too much", this gets trickier. It is fairly subjective. Measuring levels of annoyance could be performed when having a questionnaire at hand where a user can note the subjective level of annoyance or stress and maybe something like heart rate or sweat (skin conductivity) can bring some data points, but it would need some extensive research to filter correlations and optimizations and a larger test group. Until this is done and evaluated the situation on the software level will have changed so much that the results are obsolete already.

Edit: Whoops. The question is some five years old soon (2024). Would be interesting to know if the situation has changed by now.