This is also an issue in the medical field. e-prescribe lets doctors order medications directly from the EHR, including—in some states—controlled substances. Th

This is also an issue in the medical field. e-prescribe lets doctors order medications directly from the EHR, including—in some states—controlled substances. The software ensures it's the doctor by requiring the password to be entered. The doctor gets tired of typing the same password 50 times a day—compounded by a login sequence that is not most user-friendly—and the result is that the staff enters the order on behalf of the doctor. (I should note this is being improved, with more and more doctors getting comfortable with documenting things themselves and therefore being logged when they need to order something.) This is just to say that usability / UX is a very important component to security, or insecure workarounds flourish. As software makers, we need to make it easiest for the user to do the right thing from a security perspective, not just merely possible.