Retrofitting user-centric security model onto an OS and application ecosystem that wasn’t designed for it and has grown up without it was always going to be a g

Retrofitting user-centric security model onto an OS and application ecosystem that wasn’t designed for it and has grown up without it was always going to be a giant ballache. There’s no way around the pain. The old “fortress wall” model is worse than useless now that the user’s desktop is itself an untrusted environment. The problem I see with these current changes is that they appear to be reactive—“X, Y, and Z are potential threat vectors, so we need to lock those down”—rather than taking the long view—“what does the future security model need to look like and do?”—and plot a clear, reasoned course to that from where we are now. The result is an Application-level security model, when what users need is Task-level security. Users still get all of the pain of change, yet none of the intended benefits—all that’s happened is we’ve gone from one unfit-for-purpose platform to another. For instance, just consider high-security operations such as internet banking. No way on Earth should we be using the same web browser application for sensitive financials as we use for reading all the daily gossip, browsing teh prawns, etc. Split that out into a dedicated, hardened version with no support for extensions, external automation, and its own isolated password managment. Whitelist security-sensitive URLs so that they open in that version, and restrict opening common-or-garden URLs to the low-security version only. Isolating sensitive User Tasks within their own “high-security desktop” environment would take a lot of the security pressures off individual apps, obviating the need for these endless “Do you want to grant permission for X to access Y to do Z?” requests. Which, as any security fule kno, are worse than useless at protecting users; protecting only the platform vendor from taking the blame when the inevitable fuckups occur (aka Blame the Luser). That’s the user-security model Apple ought to pursue, but they’ve been stuck so long in their classically atomic Application-centric view of the universe I don’t think they can imagine a platform where atomic Apps are subservient to the big smooshy probability cloud of user tasks that surrounds them. Partly because that nice simple neatly-packaged atomic App model is what generates revenue, but also partly because it requires giving up control; and both developers and marketeers like keeping control very much, and fear very much ceding it to anyone else. That takes courage, and Apple hasn’t had that sort of courage for a decade. But putting Control into the hands of Users, in a form that those users can use, is the very core of UX, and nowhere more important than protecting users from “themselves”.