Re:NSA refused Clinton a secure BlackBerry like Obama, so sh...
by scott_s on Thursday March 17, 2016 @01:50PM
(#11306149)
I'll go against the grain and say yes.
The difficulty with the best protocols as designed by security professionals is that they are not necessarily designed based on how users actually work. And if they are not, it is likely that users will subvert them. This paper from 2010 is along those lines, "The True Cost of Unusable Password Policies: Password Use in the Wild" (http://www.cl.cam.ac.uk/~rja14/shb10/angela2.pdf).
I particularly like two of their observations from the introduction:
"Based on our results, we make three key observations:
1. When users cannot cope with the demands of strict
password policies, it a) reduces their productivity, and
b) leads them to adopt coping strategies - which usually
reduce security.
2. Although passwords are usually considered in terms of
authentication for a service or a device, today they are
encountered in many other ways in the workplace –
and existing password policies do not cover these. As a
result, users adopt ad-hoc solutions, which are usually
insecure."
The security we actually get is the result of the technology we use, and the human behavior that interacts with that technology. Sometimes, in order to get higher actual security, we may need to relax the technological security so that we get the human behavior we want.
The difficulty with the best protocols as designed by security professionals is that they are not necessarily designed based on how users actually work. And if they are not, it is likely that users will subvert them. This paper from 2010 is along those lines, "The True Cost of Unusable Password Policies: Password Use in the Wild" (http://www.cl.cam.ac.uk/~rja14/shb10/angela2.pdf).
I particularly like two of their observations from the introduction:
"Based on our results, we make three key observations:
1. When users cannot cope with the demands of strict password policies, it a) reduces their productivity, and b) leads them to adopt coping strategies - which usually reduce security.
2. Although passwords are usually considered in terms of authentication for a service or a device, today they are encountered in many other ways in the workplace – and existing password policies do not cover these. As a result, users adopt ad-hoc solutions, which are usually insecure."
The security we actually get is the result of the technology we use, and the human behavior that interacts with that technology. Sometimes, in order to get higher actual security, we may need to relax the technological security so that we get the human behavior we want.