Secure Interaction Design

Pingster writes "Next week, ICICS 2002 will take place in Singapore. Out of 40 papers at the conference, there will be just one paper that looks at human factors. Though many people know that usability problems can render even the strongest security useless, the security community has only recently started paying attention to usability issues. More serious thinking about usability and security is desperately needed. The paper proposes ten interaction design principles. Maybe you'll find them obvious; maybe you'll disagree with them entirely. Great! Let's have a discussion."

Comments

Just use the big words...

[isaacwith2as]

and other confusing concepts and they'll quickly go into Dummy mode and do whatever you tell them to. For this reason we should make it all more complex, so that those who understand will have an easier time controlling those who don't.

My top concern

[CySurflex]

I already communicated to my sysadmin that my top security usability concern is that the post-it note with my password on my monitor peels off after about two months. We need better adhesives on our post-it notes.

Re:Security vs. Usability

[Anonymous Coward]

> (This might not be very funny, but not everyone can be a good humorist)
> Save a tree. Eat a beaver

Obviously not: you failed twice.

Necessary but not sufficient for security

[El]

The seem to have forgotten at least one principle: The user must NOT be an idiot.

Re:Outlook exploits have been doing this for years

[Bruce Losis]

Is this like clicking on that attachment that says "I_love_you.vbs" in Outlook? Or should the computer produce some sort of audible warning on mouse-over?

In many cases I'd say it would have to involve a mouse mod that gives a 60kV shock, rather than just a beep.