Is a process secure if it's not perceived as such?

Question

We just finished research for an article on 2FA (Two-Factor Authentication) and, while writing the report on the insights, I got wondering on this particular finding: Our research indicates that most users don't perceive 2FA as added security but as an annoyance.

While having 2FA is undeniably more secure than not having it, the question arises: from a user expectation perspective, can a process using 2FA truly be considered secure if users don't view it as such?

---

Note: While this question focuses on 2FA, it can be framed in broader terms: Can a process that undeniably offers a specific feature be perceived as possessing that feature, even if users don't acknowledge it?

Answer 1

Note: While this question focuses on 2FA, it can be framed in broader terms: Can a process that undeniably offers a specific feature be perceived as possessing that feature, even if users don't acknowledge it?

It is true that if a feature is not perceived as a feature by a person, it is missing the affordance for that person. That means that that person will consider that feature to be non-existent.

But security is not an affordance, but the fact that you can enter your login details to get to your account is. Logging in is never a goal of a user, it's a necessary step to get to the goal. The actual goal is behind the security steps, on the account page of the user. And when you add an extra step it is only an extra distraction from that goal. We people have a very limited short-term memory and 2FA adds a few dangerously distracting actions to the login process: If you're not already working on your mobile, you'll need to pick that up first, then you have to open the authentication app and copy the code over or remember it and type it in elsewhere. It's probably more effort than most people are willing to do. And most people won't even understand why it's needed or why it makes the application more secure. But that misunderstanding doesn't make the application less secure.

The bottom line is that you don’t “use” security. It’s just there. If 2FA is proven to be more secure but people don’t perceive it as such, the feature of added security may not be there for them. But the application (or process) using 2FA can still be considered (and is still proven) to be secure. If 2FA is what you want to protect people’s accounts, you just need to find a more convincing way to sell it.

Answer 2

Can a process that undeniably offers a specific feature be perceived as possessing that feature, even if users don't acknowledge it?

While the specific question can't really be answered with specific details, the broader question of whether a feature can be perceived as possessing that feature even if the users don't acknowledge it is probably yes.

An example would be the captcha mechanism employed by websites to try and eliminate or minimize bots interacting with the content. Even if the users don't acknowledge that it is effective at validating human users, it does to some extent reduce the amount of bots crawling, scraping or submitting data on websites. And because the technology of captcha keeps improving and changing, there is always constant debate about whether the technology of validating human users is keeping up with the technology of bots that can impersonate human users.