7

There have been a few questions which actually all partially or completely boil down to the issues with Security vs Usability. I was wondering if we might need to make one canonical question and answer detailing the issues and common caveats?

  • 7
    That looks like a good topic for a blog post. – Hendrik Brummermann Jun 26 '13 at 11:02
  • I'm interested what specific questions you're referring to. – Darius Jahandarie Jun 27 '13 at 14:48
  • 3
    The interaction of usability and security is a complex and very interesting topic. I don't see how a single question could handle that. – CodesInChaos Jun 27 '13 at 20:11
10

Absolutely a false dichotomy. In fact, usability and security are almost the same exact thing. Everyone should read Guidelines and Strategies for Secure Interaction Design. Here's a snip:

At the heart of the apparent conflict between security and usability is the idea that security makes operations harder, yet usability makes operations easier. Although this is usually true, it’s imprecise. Security isn’t about making all operations difficult; it’s about restricting access to operations with undesirable effects. Usability isn’t about making all operations easy, either; it’s about improving access to operations with desirable effects.

Tension between the two arises to the extent that a system is unable to determine whether a particular result is desirable. Security and usability come into harmony when a system correctly interprets the user’s desires.

The interplay of usability and security is core to probably every design question that's asked on this site, so a canonical question/answer for it does not make sense to me -- you can't canonicalize such a core concept.

9

The problem with this, is that this is a false dichotomy.
Sure, there are specific situations where you would need to balance the two, and find the smart trade-offs, but then that by definition is specific and not generic enough for a canonical question.

Don't forget the famous AviD's Tenet of Usability:

Security at the expense of usability, comes at the expense of security.

But sure, if you think you can phrase a generic enough question on this, go right ahead - I'm sure it would be fascinating :-)

3

Nope. I do not think this is a good direction. Usable security is an entire subfield of computer security. It's a rich area with many complexities, challenges, and techniques. There's no way a single page is going to address everything within that domain. Treating every question that touches on usability and security as out of scope would be unreasonable and harmful to the site.

If you still are in favor if this, I suggest you start by trying to create one question and posting some answers, then when you have that, come back with a more specific proposal. Nothing stops you from creating a new question now that you think addresses common elements. (Personally, I think it's going to be hard to create a single specific question that is both narrowly scoped enough to be a good fit for this site and yet broad enough for what you have in mind -- but feel free to give it a try and see what you come up with. Maybe when I see something specific, you'll change my mind; I'll try to keep an open mind.) Once you have a specific question and some concrete answers, then if you still think your proposal is a good idea, you could come back to us with a specific proposal about what questions you think should be marked as a duplicate of that one, and we could discuss it by looking at the specific questions. But at this point, I think it would be premature to adopt your proposal.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .