As the flexibility of a system increases, the usability of the system decreases.

The flexibility-usability tradeoff is related to the well-known maxim, jack of all trades, master of none. Flexible designs can perform more functions than specialized designs, but they perform the functions less efficiently. Flexible designs are, by definition, more complex than inflexible designs, and as a result are generally more difficult to use.

Enterprise software configuration settings is a prime example of this maxim as demonstrated below with salesforce password configuration:

enter image description here

Without delving too much into the details, flexibility in this case is a business goal but users end-up paying the price..as UX designers we sometimes have limited leverage in changing this so in my opinion the best approach is to try and mitigate usability risks .

So my question is : would it be ok to recommend a specific security settings that will minimise user frustration?

I am thinking that these recommendations should be embedded next to configuration parameters so users can make an informed decision.

A good example here is to have default settings that never allow passwords to expire but also explain why it is also recommended to keep it this way.I want to show whoever is setting these parameters the human factor involved

  • For passwords I'd avoid specific rules, but I'd rather use a strength estimator zxcvbn and allow the admin to configure a lower bound on how strong the password needs to be. – CodesInChaos Jan 29 '15 at 15:02
  • Salesforce probably needs to allow all those silly settings so it can comply with existing IT security policies. – CodesInChaos Jan 29 '15 at 15:03
  • @CodesInChaos I absolutely agree but this is an enterprise solution and my hands are tied because each client has their own information security policies hence my question about mitigating usability risks. – Okavango Jan 29 '15 at 15:06

There's two things I would consider when choosing to provide defaults:

  • Courtesy for the user for convenience
  • Principal of libertarian paternalism - provide defaults and arrange options to encourage good choices

Provide defaults as a courtesy for the user for convenience

Take a e-commerce checkout process. Majority of shoppers would like to ship items to their home, which is also their billing address. Therefore as a courtesy, you pre-fill the shipping address for them. Same goes for site/app preferences. If you know majority of users would choose a given setting, then provide it as default for them.

e.g. Date/Time displays. If your app is mostly for North American usage, then default it to MM DD YYYY and use 12 hour AM/PM clock.

Provide defaults to encourage good choices (libertarian paternalism)

From Wikipedia:

The term libertarian paternalism was coined by behavioral economist Richard Thaler and legal scholar Cass Sunstein in a 2003 article in the American Economic Review.1 The authors developed their ideas in a longer article in the University of Chicago Law Review that same year.2 They propose that libertarian paternalism is paternalism in the sense that "it tries to influence choices in a way that will make choosers better off, as judged by themselves" (p. 5). It is libertarian in the sense that it aims to ensure that "people should be free to opt out of specified arrangements if they choose to do so" (p. 1161).

I think this principal makes a lot of sense when it comes to security. You and your company should be seen as experts in the market. Therefore it makes sense for you to be providing recommendations on best practices when it comes to what is "secure enough without hobbling users". The use of sensible defaults is one such approach. And you should be consulting SMEs (subject matter experts) to determine this list.

Each setting should be look at individually to determine whether it make sense to have a default. There'll be many in which what setting to use depends on the context (just like most UX problems). For those, don't provide a default, but provide enough explanation so users can make an informed decision for themselves. You should probably do this for most important settings anyways regardless of whether there's a default.

There may also be times in which it makes sense to have recommended grouping of settings set in a given way. If you hear that from the SMEs, then consider redoing the UI to make it easier for users to select the group.

| improve this answer | |

Everything which are not needed by your user base, does not have to be included in the final design for your customer, at least from the usability point of view.

For the user I'm quite sure it's ok to never change the password, but for the company? Security risks? For a software product you should also consider requirements from all stakeholders.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.