Slashdot Mirror

← Back to Stories (view on slashdot.org)

Consumers Prefer Security Over Convenience For the First Time Ever, IBM Security Report Finds (techrepublic.com)

Posted by msmash on from the how-about-that dept.

A new study by IBM Security surveying 4,000 adults from a few different regions of the world found that consumers are now ranking security over convenience. For the first time ever, business users and consumers are now preferring security over convenience. From a report: TechRepublic spoke with executive security advisor at IBM Security Limor Kessem to discuss this new trend. "We always talk about the ease of use, and not impacting user experience, etc, but it turns out that when it comes to their financial accounts...people actually would go the extra mile and will use extra security," Kessem said. Whether it's using two factor authentication, an SMS message on top of their password, or any other additional step for extra protection, people still want to use it. Some 74% of respondents said that they would use extra security when it comes to those accounts, she said.

50 comments

  1. Not that it really matters... by supremebob · · Score: 5, Insightful

    Because you know that some dumbass in the home office is storing their admin passwords in cleartext for everyone to see.

    The security auditors always focus on things like crazy password policies and front end security scans, but it's always something stupid like what I mentioned above that screws it up for the rest of us.

    1. Re:Not that it really matters... by Anonymous Coward · · Score: 0

      Because you know that some dumbass in the home office is storing their admin passwords in cleartext for everyone to see.

      Qb~!{A]9L/FU;^U1yKz)

    2. Re:Not that it really matters... by Tom · · Score: 2

      Security auditors generally follow a script and the scripts are generally badly written. There are a lot of us security experts out there who have a wider perspective, who knew long before the 2017 NIST about-face that traditional password policies are bullshit, and who smile politely when the security auditors come.

      And if some dumbass stores the admin password in cleartext, or writes it on a post-it, then there's a 90% chance that your password policy is to blame.

      --
      Assorted stuff I do sometimes: Lemuria.org
  2. Really? by Obfuscant · · Score: 1
    This is the result of a survey. They asked people. Only 4000 of them. And who knows what the question was?

    The answers are meaningless -- actions speak louder than words. What these survey takers have done is found the right question to ask that 4000 people knew the "right" answer to, and they got the "right" answer even if it didn't match reality. It's called "push polling". The only true way to say that people prefer security over convenience is by counting the number of people who actually USE security that gets in the way of them doing what they want to do.

    For example, I am right now trying to recall the password for a gmail account. I can't remember when I created the account, I don't remember the only password the account has ever had so I can't tell them what one of the old passwords was, and even though I enter the code they send me by email they refuse to believe I am me. Right now, security is getting in the way of getting something done.

    1. Re:Really? by Anonymous Coward · · Score: 0

      No, you are getting in the way of getting something done. You are the one who forgot/lost the password. No system can guard against user stupidity.

    2. Re:Really? by geekmux · · Score: 3, Insightful

      For example, I am right now trying to recall the password for a gmail account. I can't remember when I created the account, I don't remember the only password the account has ever had so I can't tell them what one of the old passwords was, and even though I enter the code they send me by email they refuse to believe I am me. Right now, security is getting in the way of getting something done.

      They gave you multiple ways to protect yourself from security getting in the way, and the system is the problem?

      Hope this clarifies how much your "example", isn't.

    3. Re:Really? by Obfuscant · · Score: 3, Informative

      They gave you multiple ways to protect yourself from security getting in the way,

      If you don't remember the password, asking for the password doesn't protect you from the security. Do you remember when you created every account you have? And why bother sending a "secret code" to another email address if you're just going to ignore it? Those are the three ways they give me.

      Most of the "in the way" is the fact that the web page just hangs after you enter the code. So yes, that's their problem. Otherwise, I said "getting in the way", not whose fault it wasn't working was.

    4. Re:Really? by uvajed_ekil · · Score: 2

      If they're looking at this as an either/or question, they're doing it all wrong from the start. Of course most people are educated enough now that they expect some level of security without expecting it to be completely invisible. The trick is figuring out how obtrusive it can be before people will abandon it, and minimizing the user input and slowdown, without a need to completely eliminate either.

      --
      This is a hacked account, for which the owner can not be held responsible.
    5. Re:Really? by drinkypoo · · Score: 4, Insightful

      (. No system can guard against user stupidity.)

      Users sometimes do stupid things. If you don't account for that, you are failing.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    6. Re:Really? by ShanghaiBill · · Score: 1

      Only 4000 of them.

      I generally agree with what you wrote, but not this. A sample size of 4000 people is PLENTY. There are a lot of things you can do to make surveys and polls more accurate, like ensuring the respondents are representative of the population, and asking unbiased questions, but "asking more people" makes very little difference.

      Asking a few dozen people would have got them within 5% of the "real" answer, and a few hundred would have an error of less than 1%. So asking 4000 people is way overkill. The problems with this survey lay elsewhere.

    7. Re:Really? by postbigbang · · Score: 1

      Users DO do stupid things. They're users.

      And now, so many organizations have been breached, public, private, corporate, even small operations that people try to think about security because:

      Most everyone in the USA (I'll take my home country as an example) knows someone who's credit info has been snarfed (Equifax), military security/secrets info (OPM breach), health (how many insurers and hospitals now?) that it's almost impossible to be an American without having the taint of having your privacy for sale somewhere behind Tor.

      The average civilian knows little about what to do, and leaves security trust to others. Now they trust them as much any more, and for good reason. We as a professional community have failed at security, and we're being laughed at, and for good reason.

      --
      ---- Teach Peace. It's Cheaper Than War.
    8. Re:Really? by Anonymous Coward · · Score: 0

      They gave you multiple ways to protect yourself from security getting in the way, and the system is the problem?

      If the multiple ways are all shit, then yes.

  3. Consumers prefer steaks over shitpies by Anonymous Coward · · Score: 0

    News at 11. Who comes up with these dumb ass studies?

  4. BS by Anonymous Coward · · Score: 1

    I've worked with end users for 25 years. Security over convenience? 100% BULLSHIT. Not a chance.

    1. Re:BS by geekmux · · Score: 2

      I've worked with end users for 25 years. Security over convenience? 100% BULLSHIT. Not a chance.

      Exactly. Security has never been a priority over convenience, and asking 4,000 people sure as shit isn't proof.

    2. Re:BS by umghhh · · Score: 4, Insightful

      It means something still if public sentiment changes. Even if the difference between what people do and they say is huge if what they now say changes this much the chances are the masses move a bit and some less reckless and more competent of us will maybe prevail few % points more often than before. OC that will not be enough even if it is move in proper direction but better than nothing.

  5. They will finally stop using IE 6? by jfdavis668 · · Score: 3, Funny

    Does this mean people will move on from Windows XP and IE 6? About time.

  6. If this were true by OrangeTide · · Score: 1

    Then people wouldn't use the same damn password on most of their accounts.

    --
    “Common sense is not so common.” — Voltaire
    1. Re:If this were true by Anonymous Coward · · Score: 0

      And change the password on my luggage!

    2. Re:If this were true by skids · · Score: 2

      ...and demand SSO solutions from the IT department. If the trend ever does really reverse, we'll see requests for separating password realms from users... and then end up with an even more complicated SSO solution to accommodate that functionality since apparently so many of them neglected to think to implement that feature in their rush towards "one password that works everywhere."

      Oh, BTW, TFA needs to get a clue. SMS texts are not a NIST approved 2FA mechanism anymore, for good reason.

      --
      Someone had to do it.
  7. complete bullshit by gravewax · · Score: 1

    complete and utter bullshit. They will happily say that in a survey but when push comes to shove the majority choose convenience over security. this applies to passwords, device configurations and just about any aspect where their is an option that allows convenience.

  8. define security by Anonymous Coward · · Score: 0

    if its security of your data then yes if its the gov/big business reading and using your data to "make" you sucure. i am sure most if you explain it to them would want the former and not the latter

  9. Never believe what people say. by petes_PoV · · Score: 3, Insightful

    Some 74% of respondents said that they would use extra security

    I'll believe this when that actually start doing it.

    People in surveys say all sorts of things. What they actually do is often entirely different. And what they will do in the long term is entirely different again.

    --
    politicians are like babies' nappies: they should both be changed regularly and for the same reasons
    1. Re:Never believe what people say. by Anonymous Coward · · Score: 0

      Yeah, what they probably meant was "someone should protect me better."

  10. What they say by plopez · · Score: 1

    versus what they will do. Anyone can say they prefer A over B. But when the time comes will they really choose A. There are many companies out there that have been burned when market research said one thing, but what the customer did was something else. I guess what it comes down to is marketing and advertising. A fear campaign would work. Maybe.

    --
    putting the 'B' in LGBTQ+
  11. Actually by Brockmire · · Score: 1

    They asked a guy named Bob Consumers and he thought security should be more important than convenience. Bob Consumers is an only child.

  12. Smartphones destroy security by Anonymous Coward · · Score: 0

    Smartphones destroy security.
    Stop using them just because they are convenient.

  13. allies, not enemies by Tom · · Score: 1

    Been preaching this for 10+ years: Usability and security are allies, not enemies.

    If your usability is good, your users make less mistakes, which leads to less unintentional issues.
    Phishing is largely a usability thing. I have a couple slides about that, the very short version is that all the info you need to spot a phishing mail is typically hidden, while all the info that lures you in is prominent.
    Proper decision making by users can be guided through usability, to prevent them from doing stupid things.
    User feedback of most security apps is abysmal, to say it nicely.

    There are great examples of usability and security working together. I still wonder why nobody picked up the Chamaeleon concept, for example (basically: A set of user-configurable domains running under one windowing system, with colored borders indicating for every window which domain it belongs to).

    Usability needs to be designed into security. We are failing our users with this bullshit 80s attitude of blaming their stupidity.

    --
    Assorted stuff I do sometimes: Lemuria.org
    1. Re:allies, not enemies by Obfuscant · · Score: 1

      Been preaching this for 10+ years: Usability and security are allies, not enemies.

      "Usability" is not "convenience". Convenience and security truly are enemies; usability and security are orthogonal concepts.

      You can have a website with the best UX in the world, but if the access controls to get there are inconvenient, users will often opt for more convenience in place of security.

      I could PGP sign every piece of email I send from my tablet. The UX is there. It's not convenient, so I don't. (Set up a key pair, publish the right half, teach all my corespondents how to decrypt it, etc. None of this is in the email client UX.) I could go for better security on my airline account, but I've chosen to reduce security so I don't have to write down all the answers to the multiple security questions they ask at the most inconvenient times. I could use a unique password for every account I have, but I choose to create passwords in a similar way, thus reducing security. And I choose convenience over security because I have my web browser remember both login and password for me, which is the only reason I have been able to recover my forgotten gmail password. (Google reduced the security of their own system by remembering that I HAD the account, telling me the login, which makes it more convenient for me.)

  14. Sure. by rsilvergun · · Score: 1

    And they like a bold, rich roast too (Yeah, it's Malcolm Gladwell, but the ideas aren't his so it's all good).

    --
    Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
  15. First time ever by Anonymous Coward · · Score: 0

    Consumers Prefer Security Over Convenience For the First Time Ever, IBM Security Report Finds

    No consumer ever put a lock on a door?

    Because we know that fumbling for a key on a dark cold rainy night is more convenient than walking through an unlocked door.

    1. Re: First time ever by Zero__Kelvin · · Score: 1

      That is an incredible analogy fail. What you are talking about is security vs no security. A correct analogy would be do they prefer a lock that is easier to use and trivial to bypass over one that is slightly harder to use but nontrivial to bypass. That being said the study only tells us what they say, not what they do. Ask any Christian if they prefer to go to Heaven or Hell and they will say Heaven. An analysis of their behavior will often uncover an incongruence however.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  16. And yet IBM doesn't recommend APK's work either by Anonymous Coward · · Score: 0

    And yet IBM doesn't even recommend APK's work. I guess they must know like everyone else that his work doesn't offer security and is bested by any number of other solutions.

  17. Security at the expense of usability... by Anonymous Coward · · Score: 0

    comes at the expense of security.

  18. Security pros say hosts = good security by Anonymous Coward · · Score: 0

    Aryeh Goretsky/ESET/NOD32: hosts = good security http://it.slashdot.org/comments.pl?sid=7442373&cid=49747129/

    ZD NET http://www.zdnet.com/article/how-to-use-a-hosts-file-to-improve-your-internet-experience/ "Hosts files really shine by letting you block ads, spyware sites, malware sites, & tracking sites"

    Steve Gibson on hosts https://www.grc.com/sn/sn-045.htm/

    "classic Windows hosts trick to block the Coinhive or Crypto-Loot domains" - https://www.bleepingcomputer.com/news/security/a-new-player-joins-coinhive-on-the-browser-cryptojacking-scene/ - BLEEPING COMPUTER

    Oliver Day (SYMANTEC/SECURITYFOCUS) http://www.securityfocus.com/columnists/491/ "Host file browsing the Web - is actually faster

    Spybot S&D add a layer of defense against trojans & other forms of malware to hosts

    Malwarebytes hpHosts hosts & RECOMMENDS my program.

    APK

    P.S.=> SEE SUBJECT STUPID: Security pros BOTH past & present say hosts = good security... apk

  19. What two-factor?? by Anonymous Coward · · Score: 0

    You mean when they use the same factor twice, and implement it badly on top of it, and then call that two-factor?

    Because that was the case with all "two-factor" that I ever saw.

    1. Re: What two-factor?? by Zero__Kelvin · · Score: 1

      That is because you don't know what two factor means.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  20. dysfunctional child by bigtreeman · · Score: 1

    I used to be a dysfunctional child and now prefer reduced functionality caused by tight security. Privacy Badger is my latest ally in fighting 'the man'.
    When you get to a web page full of blanks that doesn't make a lot of sense you get to realise how much we are being taken for a ride.
    Pictures, videos, tables can be tracking us, they used to be called viruses.
    Now it is just accepted as normal for companies to automatically provide us with what we want to experience.

    --
    Go well
  21. 18 trackers by bigtreeman · · Score: 1

    Your link to TechRepublic also leads to 18 potential trackers
    and yes, my blocking broke the video which probably says no more than the text.

    --
    Go well
  22. Can blind people have a preference of color? by Anonymous Coward · · Score: 1

    If the people with preferences do not have the ability to assess if their preferences are being met, they will still use shitty products.

  23. Stop keeping them there then!! by Anonymous Coward · · Score: 0

    You types will repeat and assume that people are careless and stupid *until they are*.

    And then when some *finally* manage to get a mindset that is better ... you keep pushing them back into it!

    Like meeting old friends that you left preecisely because they never let you leave the mold of a role they have reserved for you ... You're instantly the same loser again, and stumble and stutter again like back then.

    The entire industry is *working their assrs off* to breed the mindset of people being that way.
    Like you never even heard of the concept of the self-fulfilling prophecy.

    People generally are NOT morons, nor careless about their privacy!
    They just grew into a world with that social conditioning effect, and were shaped by it.
    Most people coast through that life in a permanent appplication of those pre-conditioned patterns. Hoping there never comes an unknown situation whete they actually have to wake up, be aan actual person, and think.

    If you actually manage to wake them up ... which is hard, because it is foreign, which makes them afraid, which makes them hate it, and hence you ... they are nearly always surprisingly wise, and care for their privacy!
    (You can tell they are thinking for themselves, when they actively reject *all* ideology.)

    1. Re: Stop keeping them there then!! by Anonymous Coward · · Score: 0

      In further news, Microsoft will provide an OS inconvenient but 'secure' against the owner of the machine. Security!
      I'm sure people are also working hard on a platform that is BOTH insecure and inconvenient.

    2. Re:Stop keeping them there then!! by gravewax · · Score: 1

      The problem is they ARE NOT in the mindset. They simply know what to say on a survey or think they are really in the mindset. In actuality while they care about security it simply is not as important as having an easy to remember password or being able to access that phone faster to get to their urgent game/tweet/facebook post. I would truly love people to actually get it and would celebrate if they did but I work in security every day and I see people even in IT and security that don't get it. convenience is just more important to them up until something goes wrong.

  24. I don't believe it by Anonymous Coward · · Score: 0

    IT companies are offering us security now? That really is news!

    They've been selling us out to anyone who slips them a few bucks under the table for years. Why stop now?

  25. Poor Retarded APK by Anonymous Coward · · Score: 0

    Poor retarded Alexander Peter Kowalski.

    Lets look at what you posted shall we.

    First up you have a link to some random post you made with some words you claim are from someone who worked at McAfee. Seems sketchy at best and given McAfee's reputation not something to be proud of. Also it looks like you got spanked pretty hard in that thread as well but you are apparently too retarded to know when you have lost.

    Then you bring up a ZD net article that doesn't mention you or your work. I would never go to ZD NET for security advice why don't you post a WIRED or NY Times article instead it would carry the same weight.

    Next up you have a link to an AOL radio interview. Yet another thing I wouldn't let out as AOL is where the retards like you hung out. Also I don't call that an endorsement of your work since you shit isn't mentioned anywhere there.

    BleepingComputer again it falls into the same category as ZD NET and they don't recommend your work either.

    Up next you have someone else who you claim supports your ideas but in looking at that he points out all the problems with blacklists instead. Not a ringing endorsement of hosts and clearly not an endorsement of your work by Oliver Day.

    Who still runs Spybot S&D anymore it was always behind and required manual interaction. It might catch some malware that is installed but there are better solutions for that task. Its hosts file management methodology still shows all the problems mentioned by Oliver Day and even then was a rather small list. Here again we find something that doesn't endorse or recommend your work yet showcases all of its failings.

    As stated numerous times your shit appearing in the Misc. software section of some website doesn't count as an endorsement.

    So after all that the only thing of any potential value is some words spammed up on a /. post made by you that cannot be corroborated by anyone. Sorry retard that smells like a whole pile of APK failure.

    I also see above all that you are spamming quotes from /. users again which is sad considering how many of those people you have taken out of context, misquoted, or have retracted their statements. It is really funny when they tell you that while pointing out your near endless failures and you spam them with quotes of their own that they recant those statement in front of you. So again you offer up more failure.
    I'm sure some day your parents will stop regretting not aborting your but today isn't that day, the rest of the century isn't looking so good either.

    I guess Alexander Peter Kowalski just hates it when people point out his ceaseless failures and spread the truth that he is in fact a retard.

    Now why don't you go over to Reddit and spam there as there are plenty of retards there who haven't heard your tired defective claims before don't know that you are a total failure.

  26. What about security from tech companies? by Anonymous Coward · · Score: 0

    Windows 10, Google, Roomba, Samsung TVs, etc all spy on you. How about that?

  27. NOT SO FAST by Anonymous Coward · · Score: 0

    Security is a relative term.

    I was security of my personal information over some corporation trying to harvest or sell it. I am not interested in tighter controls and censorship in order to "protect me" from terrorist.

    They need to be very VERY clear about what they mean by security.

  28. You = a retarded nobody that can't read, lol by Anonymous Coward · · Score: 0

    LMAO - trying to twist things or are you just the ILLITERATE RETARD you PROJECT you are?

    I say security pros etc. say hosts = good security & they do.

    ZDNet's article states fact (it does miss hosts have value vs. dns security issues).

    Bleeping Computer is USED HERE ON /. AS A NEWS SOURCE (yet a 'security pro' like you who CLAIMS HE HAS WRITTEN "real securityware" (where is it then liar? It's not)).

    Oliver Day said what he said on hosts value & nothing YOU (or "your kind" in UNIDENTIFIABLE do-nothing "ne'er-do-wells" online can change it).

    Plenty use Spybot S&D!

    Malwarebytes not only HOSTS my work but the site owner of hpHosts (malwarebytes employee) RECOMMENDS my work too (& not your non-existent 'vaporware').

    I don't note McAfee (see subject)!

    I don't see "AOL" in what I wrote either. Learn to READ moron.

    APK

    P.S.=> /.'ers do USE & PRAISE my work as do countless 1,000's worldwide. That just KILLS YOU, doesn't it, "jealous jowie"?... apk

  29. Quoted registered /.'ers like & use it... apk by Anonymous Coward · · Score: 0

    I'm going to continue using the Host File Engine. Your software is well written, functional. The Host File Engine performs exactly as promised by mmell February 16 2017

    (APK's work), I've flat out said it's good by BronsCon February 11 2016

    his hosts program is actually pretty good by xenotransplant August 10 2015

    his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg September 25 2015

    I like your host file system by Karmashock September 09 2015

    I do use APK's host file on all my systems at home by OrangeTide December 01 2017

    I personally use a HOSTS file blocker produced from a genius called APK by 110010001000 October 27 2017

    * See you 'downmod hid' those last time I posted 'em https://it.slashdot.org/comments.pl?sid=11736289&cid=56111713/

    APK

    P.S.-> NOBODY recommends YOUR non-existent 'vaporware'... apk