Web Commerce Security Design and Development

Security and Usability

Usable security does not have to be an oxymoron. The old cliché “security multiplied by usability is a constant,” meaning that increasing security will automatically result in decreasing usability, is not always true. In fact, some of the most creative security mechanisms won't have a direct impact on usability at all: The majority of effective risk-driven security such as location-based security measures is designed to have close to no impact on usability. It is true that there is always a cost associated with security; however, usability doesn't always have to pay that cost. We, the security professionals, have not done such a great job in implementing usable security, especially for the world full of connected devices that we live in now. Let's take the case of passwords as an example.

Usability of Passwords

It is one of the simplest and most basic forms of security to require users to have a piece of information that is private to them. For passwords to be called “strong,” they have to be long (the longer the better), difficult to guess by an adversary, peppered with non-alphanumerical characters (e.g. all those unpronounceable, IKEA-like characters: ~!@#$%^&*_+), mixed with upper and lower cases in them, and be changed frequently. Now obviously, the human's memory capacity is limited. Furthermore, people's capability, their attention and interest when it comes to strings of strong passwords such as P@$sw0r4, varies a lot. The fact is that most people ...