Skip to main contentSkip to navigationSkip to navigation
A man uses an iris recognition scanner during the Biometrics 2004 exhibition and conference
Biometric technologies, such as iris recognition scanners, are making their way onto smartphones. Photograph: Ian Waldie/Getty Images
Biometric technologies, such as iris recognition scanners, are making their way onto smartphones. Photograph: Ian Waldie/Getty Images

Usability v safety: how to design our way to better security

This article is more than 8 years old

Does privacy protection have to get in the way of usability in technology? Not if the two talk to each other, writes Danny Bradbury

Angela Sasse really dislikes long passwords. The professor of human-centred technology heads up the Information Security Group at University College London and spends a lot of her time thinking about how we can make our computers and software both usable and safe. It certainly isn’t by making people remember long passwords, she said.

“In reality that means people stop using services, or work around the mechanism,” she said, blaming those who build the applications for not thinking smarter. “It’s bad design. The problem is that they don’t go back to ask what other protection goals there are – and then consider different ways of managing it.”

It would be nice to have computers and software that allow us to do our jobs quickly and easily, without leaving us open to online attacks. But can we have our cake and eat it? According to experts, the problem is that the people who design the user experience (UX) aren’t the same people who design security.

“UX designers and security consultants on the whole are still not working collaboratively together. From our experience, it’s still largely an ‘us and them’ dynamic,” said Jason Harris, managing principal consultant for the security business unit at IT and security consulting firm Dimension Data.

What happens when UX design and security don’t meet in the middle? One danger is that the user experience is great, but the security suffers.

Take a mobile app. It may have a great interface that allows you to add all of your contacts to your social network at the touch of a button, but it may send all of those contacts’ email addresses to the social networking service, unencrypted, to do it. That’s bad for privacy and security, even though it may make your experience seem fast and seamless.

At the other end of the scale is an app that is locked down to the point of being unusable. Harris recalled one situation where a company made users authenticate themselves so frequently to access their data that they gave up.

How to make it better

Peter Hesse has an idea to make things better. He ran his own cybersecurity consulting company before selling it to application development company 10Pearls, where he’s now chief security officer. As such, he straddles security and user interface design and is convinced that the two can co-exist. The key, he said, is to try to get the two teams together so they can thrash out what users themselves want.

“Security needs to learn from design by doing focus groups, having conversations and putting itself in the perspective of the people who will use this system,” he said, adding that it isn’t the security team’s job to make things harder for the user. “Rather than saying, ‘this is what you have to do for security’, you have to balance security and usability.”

If a combined security and development team can do this early enough in the design process, they can bake security into the product at a low level, he added, rather than try to add a ham-fisted measure at the end, such as a long password or an unfathomable array of warnings.

New approaches

Sasse heads up UCL’s productive security project. It finds technologies that can make computers simultaneously more secure and more usable. The basic assumption is that one does not have to be sacrificed for the other.

One example might be voice-based verification. This technology, pioneered by some banks, listens to a customer’s voice over the phone and analyses it to see if it’s really him or her. It can also be used to make the user’s experience more seamless, by recognising basic spoken commands without making the user dial through an annoying number-based menu.

Another technology that’s both secure and easy to use is fingerprint biometrics. Many phones are starting to include them, replacing those finicky passwords, explained Raluca Budiu, senior researcher with Nielsen Norman Group: “Biometrics do improve substantially the user experience of logging in and authenticating. It’s a shame that not all mobile apps take advantage of this feature.”

Smarter technologies

Tech in this space is getting smarter and may make security simpler still. Windows Hello, for example, is a new unlocking technology in Windows 10 that uses 3D cameras with infrared features to authenticate users just by looking at them. A similar feature with an iris-scanning component is making its way onto some new Windows phones.

A lot of good security happens behind the scenes without users having to make much of an effort, said Bruce Schneier, a security expert and fellow at the Berkman Center for Internet & Society. “Most email is secured behind the scenes, without the user being the wiser. So is part of your [mobile] phone call – the part between the handset and the tower,” he said. “Credit cards are pretty good at usable security; most people just don’t worry about it.”

There’s a pattern here. The technology to make security can increasingly be embedded into the system. The question is whether people are willing to pay for it. The EMV credit card technology that Schneier describes isn’t being adopted as widely in the US, where retailers are acutely aware of costs.

“Usable security is hard,” said Schneier. But it starts by getting as many stakeholders as possible in the same room to listen to the person who’s actually going to be struggling with the technology on an everyday basis. That takes maturity and forethought.

To get weekly news analysis, job alerts and event notifications direct to your inbox, sign up free for Media Network membership.

All Guardian Media Network content is editorially independent except for pieces labelled ‘Brought to you by’ – find out more here.

Comments (…)

Sign in or create your Guardian account to join the discussion

Most viewed

Most viewed