Users Rejecting Security Advice Considered Rational

WeeBit writes "Researchers have different ideas as to why people fail to use security measures. Some feel that regardless of what happens, users will only do the minimum required. Others believe security tasks are rejected because users consider them to be a pain. A third group maintains user education is not working. [Microsoft Research's Cormac] Herley offers a different viewpoint. He contends that user rejection of security advice is based entirely on the economics of the process." Here is Dr. Herley's paper, So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users (PDF).

Comments

Re:This is not a "new" interpretation

[luckyXIII]

Not always. Sometimes they're dumber than you think they are.

Want security? Buy a Mac

[WillAffleckUW]

Want security? Buy a Mac.

Want s/w that breaks? Buy Windows.

Want to roll your own and get every ounce of power out - use a Linux distro.

At one point I was the acting security officer for Pacific Region. If people can subvert security they will.

Not much has changed in the security sphere for a long time, and difficult security just begs to be subverted.