Hacker News Reader

Comment by blfr | Hacker News Reader

> Reality: most end users make fully rationale [sic] decisions to optimize their time and energy to get their work done.

Not true in my experience. Most end users act in ways that are both less secure and less convenient than they could.

Either because they don't want to make the upfront investment (in setting up a password manager for example) or because they simply don't know any better.

Wore still, surprisingly many more advanced end users believe in security through inconvenience: rotating passwords, timed logouts, etc.

View on HN

Not using a password manager is completely consistent with “optimizing time and energy”.

If you already know how to use a password manager, yes, it will easily improve productivity.

But for a non-technical end-user who has never used a password manager before, learning to use one is neither straightforward nor is it convenient.

Not only is it learning a skill which is not critical to their core deliverables — which virtually no one has time for — it also has the worst kind of failure mode: if the user needs technical support, it’s likely that they are locked-out of a service and at a standstill until they receive that support.

Learning to use a password manager to improve your productivity is the "optimal" path, so I'd disagree with this. It is optimal if the time spent learning it is saved by using what you've learned, which is almost certainly the case over the span of even a moderate amount of time.

The irrational thing to do would be to refuse to learn about a password manager. Your argument works if you focus narrowly, but when you see a fuller picture, your argument falls apart.

The optimal path is for companies to have single sign on.

Password managers are a poor substitute. They don't work well and they are not consistent across websites.

100% SSO coverage is impossible.

Let's say you're part of the marketing team and need to sign up to some ad platform or do a one-off order for branded goods. They will most likely not support SSO, and even if they do you won't have the necessary privileges to actually set it up.

Very little about work is universally optimal. Work is made out countless compromises so that people can function together. “Optimizing time and energy” is not the same as doing the universally optimal thing.

Optimizing for time and energy has to do with how one uses their waking/working hours.

At some point in my career I worked at a private Catholic college where many of the professors were 60 to 80 year-old nuns.

They were very smart people but their predisposition to learning computer technology was minimal. Something that might take me hours to learn might take them weeks of frustrating, unintuitive trial and error. Frequently, they couldn’t pick up certain new computer skills at all.

I could not imagine teaching the nuns how to use a password manager. It would be a disaster.

This is an extreme example, but somewhere in every skill there’s an inflection point where it becomes impractical to learn that skill if it’s not part of your core competency as a worker.

Many, if not most, users who would benefit from a password manager simply can’t develop that skill if they are expected to finish the normal duties of their work. They are optimally using their limited time and energy because learning a new skill would impact their functionality in their primary responsibilities too much.

If you can’t imagine users from your work-life that would have this problem... I feel like you just don’t know very many users.

I understand your point, I just think you're letting those nuns off the hook too easily! "Can't" is getting thrown around here in ways I don't think is totally accurate.

I assure you, I have anecdotes indicating that I am not. :-)

Yep, the good ol' "if this feature annoys the hell out of me it should probably also annoy the hell out of the attacker"

(Which is not even remotely true)

Reply on news.ycombinator.com