3 ms·
RSAC: “Users Are Not Stupid, So Don't Treat Them Like They Are”
- jfengel 4y agoUsers are stupid. And in security contexts, your system is as secure as its stupidest user. If there is any context in which you absolutely have to assume that your user is a complete and utter moron, it's security. Because "Well, we didn't expect users to do that" during a crisis is not an answer. Users will do that. It's actually true in every other context as well, but there you've got more flexibility to target only, say, the dumbest 25th percentile. You have to pick how much you want to balance the really smart users against the ones who are merely not-so-bright. A great design minimizes the conflict, but some days you have to make hard choices. Not in security, medical devices, or nuclear power plants.