4 ms·

This. The first thing I assume when I have a "good idea" related to security is that I'm missing something. The alternative is assuming that I'm smarter or hav

This. The first thing I assume when I have a "good idea" related to security is that I'm missing something. The alternative is assuming that I'm smarter or have more insight than everyone else who has thought about the same problem. And I know that's probably not true.

woah 14y ago
Do you think there's any chance that security researchers have disregarded UX factors?
- unimpressive 14y ago
  Many, sure. All, I am doubtful of. Social Engineering is one of the key methods of introducing security vulnerabilities into an otherwise secure system. A security researcher with this in mind would have to consider UX factors at least in the context of weather or not they could confuse the user into giving away vital data. (Example: People being unable to remember complex passwords and pasting them to their monitor with sticky notes.) So usability concerns are entirely in the realm of a security model.
- DanBC 14y ago
  At the moment we're in the good situation of having good security that's hard to use, which is much better than easy to use but broken security. UX stuff comes after the security stuff is sorted out. Having pretty but useless security is worse than no security. Unfortunately there is plenty of security stuff which looks nice but which is broken. None of this is any kind of comment on OPs scheme! I'm gently worried about malicious people being able to shut down all my accounts remotely. And it's a bit disturbing that a lost phone means all my accounts are now compromised - but I guess that most people save passwords anyway. I'd like to see other people prodding at this because passwords really do suck.
brennenHN 14y ago
We have done a lot of security research and have written a paper which we will be submitting for publication in security conferences in the Spring. We are not smarter than everyone else, and are following the work of several people who are smarter than ourselves. Everything we are doing uses current standards and best-practices that were established by other experts. What the security community hasn't done, though, is find a way to make all of those best-practices and security algorithms accessible and easy to use for a casual user. What Clef does is wrap up a lot of the security which we all know works for a consumer that doesn't have to understand it.
- unimpressive 14y ago
  I wanted to let you know that I read this comment, but knew I needed something to say to justify adding one: I would like to note for future reference, that my position here is not outright dismissal, but extreme skepticism. PS. That this appears to be a centralized solution is a deal breaker for me, at least for important accounts.

woah 14y ago

Do you think there's any chance that security researchers have disregarded UX factors?

unimpressive 14y ago
Many, sure. All, I am doubtful of. Social Engineering is one of the key methods of introducing security vulnerabilities into an otherwise secure system. A security researcher with this in mind would have to consider UX factors at least in the context of weather or not they could confuse the user into giving away vital data. (Example: People being unable to remember complex passwords and pasting them to their monitor with sticky notes.) So usability concerns are entirely in the realm of a security model.
DanBC 14y ago
At the moment we're in the good situation of having good security that's hard to use, which is much better than easy to use but broken security. UX stuff comes after the security stuff is sorted out. Having pretty but useless security is worse than no security. Unfortunately there is plenty of security stuff which looks nice but which is broken. None of this is any kind of comment on OPs scheme! I'm gently worried about malicious people being able to shut down all my accounts remotely. And it's a bit disturbing that a lost phone means all my accounts are now compromised - but I guess that most people save passwords anyway. I'd like to see other people prodding at this because passwords really do suck.

brennenHN 14y ago

We have done a lot of security research and have written a paper which we will be submitting for publication in security conferences in the Spring. We are not smarter than everyone else, and are following the work of several people who are smarter than ourselves. Everything we are doing uses current standards and best-practices that were established by other experts. What the security community hasn't done, though, is find a way to make all of those best-practices and security algorithms accessible and easy to use for a casual user. What Clef does is wrap up a lot of the security which we all know works for a consumer that doesn't have to understand it.

unimpressive 14y ago
I wanted to let you know that I read this comment, but knew I needed something to say to justify adding one: I would like to note for future reference, that my position here is not outright dismissal, but extreme skepticism. PS. That this appears to be a centralized solution is a deal breaker for me, at least for important accounts.