Hacker News Reader

Comment by ianstormtaylor | Hacker News Reader

It's not hard to think of examples...

1. HTTPS everywhere has zero impact on the usability of a website, but makes visiting those sites much more secure.

2. Apple's App Store model for installing applications improves security and is also easier to use for the average user.

3. 1Password with Touch/Face ID can actually be easier these days than entering emails and passwords manually.

4. And more…

Security doesn't always have an immediate effect on usability, and even when it does it isn't always negative.

View on HN

> 1. HTTPS everywhere has zero impact on the usability of a website, but makes visiting those sites much more secure.

You have to install a plugin on every browser and device. That's not user friendly. Also some sites break and you have to understand why.

> 2. Apple's App Store model for installing applications improves security and is also easier to use for the average user.

You have to have an account on the app store. You can't log into the same account on more than five machines. You have to put your password in every time you install an app.

That's all a lot harder than clicking on a link in an email.

> 3. 1Password with Touch/Face ID can actually be easier these days than entering emails and passwords manually.

You have to install 1password on all your devices. You have to mange your passwords with 1password. I'm an expert and even I have a hard time getting it to catch every update and every password field. 1password is a usability nightmare. Having the same password everywhere is a lot easier (and obviously less secure).

You're looking at one aspect after the initial setup and ignoring maintenance.

It's not really much of a comparison if you pick things like 'the security mechanism breaks in some way' and no similar failure modes of the 'no security' variant. It's a serious usability problem if an insecure interaction gives you bogus information or if all your accounts are compromised because you use the same password everywhere.

But that’s the point. Security introduces new failure modes that make usability worse.

Again I’m not saying it’s bad, quite the opposite. I’m just saying we have to acknowledge it’s always a trade off.

If that's the point it seems like a particularly inaccurate and cherry-picky one. Security is not what's introducing the failure modes, the adversarial universe is. The no-security solutions have catastrophically worse usability in that reality. You're comparing the usability of things with security features with the usability of things without security in a hypothetical non-adversarial environment. I can posit a world in which security features never fail or introduce usability friction, that wouldn't be a useful starting point for a comparison either.

Generalizing your point, introducing or expanding on any feature or functionality always implies proportional degradation of some other feature via new failure modes. (“Security feature” being a special case.)

First, does that always hold true?

Second—if we pretend it’s an axiom—careful and competent approach may allow to shift such degradation to aspects orthogonal to usability (instead of being perceivable by end user, failure modes could cause overhead, say, to maintenance or engineering teams).

You're assuming that an extra step always implies a usability penalty, but that's not true.

"Usability can be described as the capacity of a system to provide a condition for its users to perform the tasks safely, effectively, and efficiently while enjoying the experience." (https://en.wikipedia.org/wiki/Usability)

Notice the presence of "safely" there. You should be penalizing the alternative in each of these examples for the non-zero risk of data breaches and getting pwned. Then we can have a more productive debate about which cost is greater.

Reply on news.ycombinator.com