4 ms·

> Good IT security is invisible and unobtrusive for your users, like magic Why is this a standard for "good" IT security but not any other security domain? Wo

> Good IT security is invisible and unobtrusive for your users, like magic Why is this a standard for "good" IT security but not any other security domain? Would you say good airport security must be invisible and magic? Are you troubled by having to use a keycard or fingerprint to enter secure areas of a building? Security is always a balance between usability and safety. Expecting the user to be completely unaffected through some magic is unrealistic.

graemep 2y ago
> Would you say good airport security must be invisible and magic? Very possibly. IMO a lot of the intrusive airport security is security theatre. Things like intelligence do a lot more. Other things we do not notice too, I suspect. THe thing about the intrusive security is that attackers know abut it and can plan around it. > Are you troubled by having to use a keycard or fingerprint to enter secure areas of a building? No, but they are simple and easy to use, and have rarely stopped me from doing anything I needed to. > Security is always a balance between usability and safety. Expecting the user to be completely unaffected through some magic is unrealistic. Agree entirely.
- Jcowell 2y ago
  I never quite understood the security theater thing. Isn’t the fact that at each airport , you will be scanned and possibly frisked a deterrent and you can’t measure what dissent occur so the only way to know if it works is observe a timeline where it doesn’t exist?
  - graemep 2y ago
    For one thing the rules adopted vary and different countries do very different things. It struck me once on a flight where at one end liquids were restricted, but shoes were not checked, and at the other we had to take our shoes off but there were no restrictions on liquids. So an attacker who wanted to use a shoe bomb would do it at one end, and one who wanted to use liquids would do it at the other. There are also some very weird things like rules against taking things that look vague like weapons. An example in the UK were aftershave bottles that are banned - does this look dangerous to you? https://www.fragrancenet.com/fragrances?f=b-spicebomb https://www.fragrancenet.com/fragrances?f=b-spicebomb Then there are things you can buy from shops after security that are not allowed if you bring them in before (some sharp things). Then things that are minimal threats (has anyone ever managed to hijack a plane with small pen knife? I would laugh at someone trying to carjack with one). > know if it works is observe a timeline where it doesn’t exist? Absolute proof maybe, but precautions need to be common sense and evidence based.
    - nvy 2y ago
      >has anyone ever managed to hijack a plane with small pen knife? Well, the 9/11 hijackers used box cutters. Might as well be the same thing.
    - Izkata 2y ago
      > An example in the UK were aftershave bottles that are banned - does this look dangerous to you? https://www.fragrancenet.com/fragrances?f=b-spicebomb https://www.fragrancenet.com/fragrances?f=b-spicebomb It's shaped like a grenade, so yes.
      - graemep 2y ago
        A very small grenade, made of glass, and fill with liquid? It looks like a grenade in the same way a doll looks like a human being.
        Izkata 2y ago
        In full color vision sure, but not to the machines used to scan the insides of bags. You pretty much just get a silhouette.
pc86 2y ago
If you have two security models that provide identical actual security, and one of them is invisible to the user and the other one is outright user-hostile like the TSA, yes of course the invisible one is better.
w10-1 2y ago
It is the standard for all security domains - police, army, etc. I would reword it to say that security should work for the oblivious user, and we should not depend on good user behavior (or fail to defend against malicious or negligent behavior). I would still say the ideal is for the security interface to prevent problems - like having doors so we don't fall out of cars, or ABS to correct brake inputs.

graemep 2y ago

> Would you say good airport security must be invisible and magic? Very possibly. IMO a lot of the intrusive airport security is security theatre. Things like intelligence do a lot more. Other things we do not notice too, I suspect. THe thing about the intrusive security is that attackers know abut it and can plan around it. > Are you troubled by having to use a keycard or fingerprint to enter secure areas of a building? No, but they are simple and easy to use, and have rarely stopped me from doing anything I needed to. > Security is always a balance between usability and safety. Expecting the user to be completely unaffected through some magic is unrealistic. Agree entirely.

Jcowell 2y ago
I never quite understood the security theater thing. Isn’t the fact that at each airport , you will be scanned and possibly frisked a deterrent and you can’t measure what dissent occur so the only way to know if it works is observe a timeline where it doesn’t exist?
- graemep 2y ago
  For one thing the rules adopted vary and different countries do very different things. It struck me once on a flight where at one end liquids were restricted, but shoes were not checked, and at the other we had to take our shoes off but there were no restrictions on liquids. So an attacker who wanted to use a shoe bomb would do it at one end, and one who wanted to use liquids would do it at the other. There are also some very weird things like rules against taking things that look vague like weapons. An example in the UK were aftershave bottles that are banned - does this look dangerous to you? https://www.fragrancenet.com/fragrances?f=b-spicebomb https://www.fragrancenet.com/fragrances?f=b-spicebomb Then there are things you can buy from shops after security that are not allowed if you bring them in before (some sharp things). Then things that are minimal threats (has anyone ever managed to hijack a plane with small pen knife? I would laugh at someone trying to carjack with one). > know if it works is observe a timeline where it doesn’t exist? Absolute proof maybe, but precautions need to be common sense and evidence based.
  - nvy 2y ago
    >has anyone ever managed to hijack a plane with small pen knife? Well, the 9/11 hijackers used box cutters. Might as well be the same thing.
  - Izkata 2y ago
    > An example in the UK were aftershave bottles that are banned - does this look dangerous to you? https://www.fragrancenet.com/fragrances?f=b-spicebomb https://www.fragrancenet.com/fragrances?f=b-spicebomb It's shaped like a grenade, so yes.
    - graemep 2y ago
      A very small grenade, made of glass, and fill with liquid? It looks like a grenade in the same way a doll looks like a human being.
      - Izkata 2y ago
        In full color vision sure, but not to the machines used to scan the insides of bags. You pretty much just get a silhouette.

pc86 2y ago

If you have two security models that provide identical actual security, and one of them is invisible to the user and the other one is outright user-hostile like the TSA, yes of course the invisible one is better.

w10-1 2y ago

It is the standard for all security domains - police, army, etc. I would reword it to say that security should work for the oblivious user, and we should not depend on good user behavior (or fail to defend against malicious or negligent behavior). I would still say the ideal is for the security interface to prevent problems - like having doors so we don't fall out of cars, or ABS to correct brake inputs.