liveBook · Manning

Usable security

As explained in Real-World Cryptography

Usable security is the field of designing security mechanisms and interfaces so that people can use them correctly with minimal opportunity for error or misuse.

Usable security designs security mechanisms and interfaces so people can handle cryptography correctly with minimal opportunity for misuse. It treats user error as a design problem rather than a reason to blame users. section 16.5 section 16.8

Practical strategies include:

  • Make security features transparent and reduce the number of decisions users must get right. section 16.5
  • Replace fragile expectations, such as strong unique passwords, with mechanisms such as second-factor authentication. section 16.5
  • Use conservative, tried-and-tested designs that are difficult to implement or configure badly. section 16.8

Warnings users click through

Browsers moved from simple invalid SSL/TLS certificate warnings toward making risky acceptance harder. Warning fatigue still matters: Google Chrome users clicked through common SSL errors at rates as high as 70.2%. section 16.5

How Real-World Cryptography covers it

How deep it goes
Explains the design goal and several failure patterns, but stops short of prescribing a complete evaluation method.
Examples
Uses browser certificate warnings, password replacement, and end-to-end encryption fingerprint verification as concrete examples.
What you can do after
Evaluate cryptographic interfaces by identifying user decisions, misuse opportunities, and warning designs that encourage risky behavior.
How it connects
Connects security warnings, warning fatigue, second-factor authentication, end-to-end encryption, and boring cryptography.
Cover of Real-World Cryptography
liveBookmanning.com
Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.