Appropriation and Principled Security
Steve Dodier-Lazaro · UCL Discovery (University College London) · 2015
Secure systems have a reputation of being unusable and demanding on users, a situation attributed to a lack of usability and human factors expertise among security experts. We argue that the issue of unusable security might have deeper roots. Indeed, the design principles security relies on are out of touch with the reality of nowadays’ computing practices. In particular, the security principles of least privilege and fail-safe defaults strip human users of their ability to reconfigure systems and leave them stranded when facing interaction breakdowns. Security principles therefore prevent the reppropriation of systems they mediate both in unexpected practices and by unexpected users. We propose several leads to lessen the negative impact of those principles on secure systems.