3 ms·

We both seem to have a different view of what a "fatal flaw" is. For me (especially when talking about a computer security tool), it means a very serious securi

by dvdkon 10y ago

We both seem to have a different view of what a "fatal flaw" is. For me (especially when talking about a computer security tool), it means a very serious security vulnerability and nothing less. You seem to have a more relaxed view, accepting things that create a bad user experience as fatal flaws, too.

the_af 10y ago
Regardless of whether it's "fatal" or not, usability is crucial. If it's impractical or impossible to use in common scenarios, that's a huge flaw.
bascule 10y ago
Security isn't an end in and of itself, it's a means to an end. A tool which delivers on security but isn't usable still fails to fulfill its purpose, in the same way an unplugged computer is both secure and useless. I know there's a group within the security community willing to tolerate poor user experiences, or wear them as a badge of honor, "the price of security" or so to speak. But often I find these are the same people scratching their heads wondering why OpenPGP encrypted email hasn't seen more widespread adoption, or why the Web of Trust failed (or perhaps they think it succeeded), while at the same time bemoaning successful encrypted chat systems like WhatsApp and Signal. I would argue that user experience is just as important a consideration as the security properties of a tool.
- Gruselbauer 10y ago
  I couldn't agree more. Getting smart but non-nerd friends set up with OpenPGP is truly an eye opener. The rate of adoption is terrible because of that and nothing else. Even with a GUI like Enigmail, I needed hour long explainathons to make it work for these friends. Smart, borderline brilliant folk. The same people now use WhatsApp with encryption and don't even know it. That's what a good crypto UX looks like. I'd love for a google-free, proprietary-free, facebook-free alternative to exist but if the alternative is painful hours of setting up encrypted mail only to have it cease working after two weeks because the user forgot their passphrase, I'm gonna say I don't care too much.
lemoncucumber 10y ago
"Bad user experience" implies it's still usable but inconvenient, but in fact it's completely unusable if it can't handle passwords for arbitrary sites. You might as well say that having a password manager that can only store one password is a "bad user experience."

by dvdkon 10y ago

the_af 10y ago

Regardless of whether it's "fatal" or not, usability is crucial. If it's impractical or impossible to use in common scenarios, that's a huge flaw.

bascule 10y ago

Security isn't an end in and of itself, it's a means to an end. A tool which delivers on security but isn't usable still fails to fulfill its purpose, in the same way an unplugged computer is both secure and useless. I know there's a group within the security community willing to tolerate poor user experiences, or wear them as a badge of honor, "the price of security" or so to speak. But often I find these are the same people scratching their heads wondering why OpenPGP encrypted email hasn't seen more widespread adoption, or why the Web of Trust failed (or perhaps they think it succeeded), while at the same time bemoaning successful encrypted chat systems like WhatsApp and Signal. I would argue that user experience is just as important a consideration as the security properties of a tool.

Gruselbauer 10y ago
I couldn't agree more. Getting smart but non-nerd friends set up with OpenPGP is truly an eye opener. The rate of adoption is terrible because of that and nothing else. Even with a GUI like Enigmail, I needed hour long explainathons to make it work for these friends. Smart, borderline brilliant folk. The same people now use WhatsApp with encryption and don't even know it. That's what a good crypto UX looks like. I'd love for a google-free, proprietary-free, facebook-free alternative to exist but if the alternative is painful hours of setting up encrypted mail only to have it cease working after two weeks because the user forgot their passphrase, I'm gonna say I don't care too much.

lemoncucumber 10y ago

"Bad user experience" implies it's still usable but inconvenient, but in fact it's completely unusable if it can't handle passwords for arbitrary sites. You might as well say that having a password manager that can only store one password is a "bad user experience."