Who Is Responsible for Using Security?
We put a lot of responsibility on the user: Apply these patches, don’t download unknown code, keep sensitive material private, change your password frequently, don’t forget your umbrella. We are all fairly technology savvy, so we take in stride messages like “fatal error.” (A neighbor once called in a panic, fearing that her entire machine and all its software data were about to go up in a puff of electronic smoke because she had received a “fatal error” message; I explained calmly that the message was perhaps a bit melodramatic.)
But that neighbor raises an important point: How can we expect people to use their computers securely when that is so hard to do? Take, for example, the various steps necessary in securing a wireless access point: Use WPA or WPA2, not WEP; set the access point into nonbroadcast mode, not open; choose a random 128-bit number for an initial value. Whitten and Tygar [WHI99] list four points critical to users’ security: users must be
• aware of the security of tasks they need to perform
• able to figure out how to perform those tasks successfully
• prevented from making dangerous errors
• sufficiently comfortable with the technology to continue using it
Whitten and Tygar conclude that the popular PGP product, which has a fairly good user interface, is not usable enough to provide effective security for most computer users. Furnell [FUR05] reached a similar conclusion about the security features in Microsoft Word.
The field of human–computer interaction (HCI) is mature, guidance materials are available, and numerous good examples exist. Why, then, are security settings hidden on a sub-sub-tab and written in highly technical jargon? We cannot expect users to participate in security enforcement unless they can understand what they should do.
