Re:Stop Trying to Fix the User (2016)
by antientropic on Wednesday October 18, 2017 @06:43AM
(#15498073)
> In other words, "lock the users up so they can't hurt themselves"?
No, it means that supposedly "dumb" actions by users like inserting a USB stick or opening a Word attachment shouldn't break the security of the system. (In fact, they're only "dumb" actions because our systems are designed without security in mind.) That's hardly authoritarian.
Actually it seems exactly the opposite. Considering the users "fixable" is authoritarian, adapting to their behaviour is not.
Re:Stop Trying to Fix the User (2016)
by WillReplyfFood on Wednesday October 18, 2017 @09:28AM
(#15498934)
How would you sandbox such dumb "actions"? Draw a copy of everything afflicted by the actions of the thumbdrive- and kick the container, once it touches the system in a bad spot?
We are talking about tradeoffs- and the truth is, we traded security for development speed and low price, because security has a tendency to arrive very, very late in the game, the moment people want to abandon the system or concept.
We must stop trying to fix the user to achieve security. We'll never get there, and research toward those goals just obscures the real problems. Usable security doesn't mean “getting people to do what we want.” It means creating security that works, given (or despite) what people do.
In other words, "lock the users up so they can't hurt themselves"?
Quite frankly, that's disturbingly authoritarian. In the real world, the analogy would be the government deciding a long time ago that crime can't be fixed, and enforcing complete control over everything the population does.
That's fortunately not how things turned out, although it now seems to be rapidly heading in that direction...
My personal view: people are going to continue do bad things either accidentally or maliciously, and trying to stop that completely means eliminating all personal freedom (and responsibility.) The ideal is somewhere in the middle between freedom and security.