1

When looking at the internet for ways to secure yourself, I normally see that people use weak security because the more secure you become, the lower the usability is.

enter image description here

Weak passwords trump strong security
-- Law 5 of Microsoft's 10 Immutable Laws of Security

I would like to argue that this is not the case any longer. Here are the reasons why I think that you can have high security along with high usability.

  • Password managers
    Managers such as Dashlane mean that you only need to remember one password, even though you have a uneque password on every site.
    This allows for high security with high usability.

  • Two step verification
    This means that the user could have a week password, however, it improves security since the hacker would need the 'somthing you have' element as well as 'something you know'.

  • YubiKey
    This allows you to enter two step verification numbers automatically without needing to know the code at all. This improves on the usability of the above point, while still keeping the same security.

There may be more points than this. As you can see, you can have high security along with high usability if you use the correct tools.





Sorry if this is classed as an 'opinion' based question. I have backed it up with some facts to try and make it less opinion based and more fact based. If this is an opinion based question, please let me know and I will delete it.

closed as primarily opinion-based by Stephane, Rory Alsop Dec 9 '16 at 13:38

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • What is your question ? This isn't a discussion forum: open-ended "what's your opinion on ..." questions are out of scope here. – Stephane Dec 9 '16 at 13:21
  • @Stephane What I am asking is, is usability a reason to have week security any more. To me, you can have high usability with high security as mentioned in the post. – iProgram Dec 9 '16 at 13:33
  • @iProgram - there is still no real question here. It's discussion/opinion/debate, as you can see for yourself from the comments you have made on the two answers. – Rory Alsop Dec 9 '16 at 13:38
  • 1
    As noted, this is really a wide open area for much discussion, so I will just leave you with the well known AviD's Maxim of Usability: "Security at the expense of usability comes at the expense of security." If your security mechanisms get in the way of your user's comfort, they will simply shut it off. – AviD Dec 20 '16 at 23:03
2

Yes, security vs usability still exists, although perhaps to a diminished extent. Each of your examples is designed to reduce the complexity of maintaining strong security, but none of them completely remove the additional work for the users.

Even password managers, which I would consider the easiest step, are massively underused (outside the IT industry). Though it's easier once the manager is set up, it still requires a completely separate application be installed, and most password managers that I have encountered are complex enough to pose significant difficulties to less-technical users.

Why download another program and get "that one tech friend" to set it up for you when you can just reuse the same password you use for everything?

Meanwhile, two-factor authentication and YubiKey each have their own issues - 2FA requires several more steps in the login process, whereas YubiKey has all the issues of any physical device; I'm not familiar with it myself, but how well would it fare after a trip through the washer and dryer?

Of course, this may change; Dashlane is a great step in making a usable password manager, but for now increased security still results in lost usability.

  • That was one of the things which I wasnt sure about YubiKey, however they say that it survives a washimg machiene cycle and can also be runover by a car – iProgram Dec 9 '16 at 13:30
  • @iProgram that's pretty impressive actually - I might have to look into that more myself. Unfortunately, it's still a separate piece of hardware for the user to order and setup and carry with them, even if there's little to no risk of breakage. – Larkeith Dec 9 '16 at 13:35
1

It still holds true because each of the things you've described add complexity to a user. Most people already find computers too complex to use - one of the reasons for the popularity of Apple Mac's.

Even a password manager which would deal with lots of sites and passwords very simply is another app that people have to install and manage. Heck even I find them a pain often and I HAVE to use them to manage the hundreds of strong passwords I use!

  • All you have to do once you set it up is to click on the login form, select your user and type in your master password. This means that you do not need to enter in your username, or account password. I admit that setting them up for the first time is low usability, but after that, the useability is higher. – iProgram Dec 9 '16 at 13:03
  • 1
    But you aren't thinking like an average user. It isn't that it is particularly difficult but that it adds complexity to something that people already find complex. We deployed PasswordSafe to 8k users after ongoing complaints of too many passwords. We produced comms and training including short videos. But actually very few people use it. They prefer to go on complaining! So it isn't about the technology but about people and their attitudes. – Julian Knight Dec 9 '16 at 13:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.