4 ms·

Unfortunately usability doesn't necessarily coincide with security. If you have to choose between the two, security always wins.

fcr 17y ago
I have to disagree. Who wins between usability and security depends on the application you're using/building. Rarely there is one good solution to fit all problems.
- mgrouchy 17y ago
  While this is true. In the general case, if your application is required to be secure, its not a choice. Don't get me wrong, usability is very important, but if your application has to be secure(and not having someone look at your password over your shoulder is a requirement), then how can you choose usability over security?
  - fcr 17y ago
    not having someone look at your password over your shoulder is a requirement What I say is that sometimes this is not a requirement even if the website offers a login feature. I guess that for my online mail client I would prefer to have a masked password field. Now for my account at an online rss reader I actually don't care that much because there is nothing to protect (at least in my opinion) and no value for someone to steal and remember my password. Maybe however I still want to be protected against someone on the web who happens to have the same name as I do and wants to steal my account... However the probability for this guy to be over my shoulder is quite low. Maybe this is all a question of personal interest. Some users will prefer usability over security while others will prefer the opposite no matter the application. If this is the case then I would vote for having the option to toggle between one and the other...
    - mgrouchy 17y ago
      I think being able to mask and unmask your password with a checkbox is certainly viable(as long as the masking is the default). The problem lies not with users like you who have different passwords for different applications, the problem lies with users who have the same password for all applications. That being said, that is probably beyond the scope of what the author is trying to address but is still always something to consider.
      - fcr 17y ago
        Fair enough. I agree that the website may expose a "global" password as you and another person said. I guess I'll design my future login boxes with security enabled by default and unmask option for the responsible user who would need it...
    - ErrantX 17y ago
      Dont forget many people use the same password all over the place (silly I know - but it is something every site should assume and plan for!). So in essence if you leave a password field open then your potentially exposing the "global" password of your user to anyone walking past. That seems an even bigger consideration than just exposing the pass to your site. Your taking away any security the user expects when typing a password in :)
mooism2 17y ago
If the security is only protecting my cat photos, then usability wins.
CWuestefeld 17y ago
The programmer thinks that security trumps usability. Unfortunately, he's not the one who decides how the security facilities will be used. Consider systems that require long passwords, and even go as far as to scan them against a dictionary, ensuring that the p/w must be a jumble. Users will always subvert such a hard-to-use system by writing down the password, completely undermining the whole thing. My netbook doesn't have hard CAPS and NUMLOCK lights, I need to look at the display's status bar to see it. When I log on, the status bar isn't shown. I can't tell if my keyboard is in numeric mode, so I can't tell if I'm typing my password. This frequently becomes very frustrating -- and this isn't hypothetical, it happens to me all the time.

fcr 17y ago

I have to disagree. Who wins between usability and security depends on the application you're using/building. Rarely there is one good solution to fit all problems.

mgrouchy 17y ago
While this is true. In the general case, if your application is required to be secure, its not a choice. Don't get me wrong, usability is very important, but if your application has to be secure(and not having someone look at your password over your shoulder is a requirement), then how can you choose usability over security?
- fcr 17y ago
  not having someone look at your password over your shoulder is a requirement What I say is that sometimes this is not a requirement even if the website offers a login feature. I guess that for my online mail client I would prefer to have a masked password field. Now for my account at an online rss reader I actually don't care that much because there is nothing to protect (at least in my opinion) and no value for someone to steal and remember my password. Maybe however I still want to be protected against someone on the web who happens to have the same name as I do and wants to steal my account... However the probability for this guy to be over my shoulder is quite low. Maybe this is all a question of personal interest. Some users will prefer usability over security while others will prefer the opposite no matter the application. If this is the case then I would vote for having the option to toggle between one and the other...
  - mgrouchy 17y ago
    I think being able to mask and unmask your password with a checkbox is certainly viable(as long as the masking is the default). The problem lies not with users like you who have different passwords for different applications, the problem lies with users who have the same password for all applications. That being said, that is probably beyond the scope of what the author is trying to address but is still always something to consider.
    - fcr 17y ago
      Fair enough. I agree that the website may expose a "global" password as you and another person said. I guess I'll design my future login boxes with security enabled by default and unmask option for the responsible user who would need it...
  - ErrantX 17y ago
    Dont forget many people use the same password all over the place (silly I know - but it is something every site should assume and plan for!). So in essence if you leave a password field open then your potentially exposing the "global" password of your user to anyone walking past. That seems an even bigger consideration than just exposing the pass to your site. Your taking away any security the user expects when typing a password in :)

mooism2 17y ago

If the security is only protecting my cat photos, then usability wins.

CWuestefeld 17y ago

The programmer thinks that security trumps usability. Unfortunately, he's not the one who decides how the security facilities will be used. Consider systems that require long passwords, and even go as far as to scan them against a dictionary, ensuring that the p/w must be a jumble. Users will always subvert such a hard-to-use system by writing down the password, completely undermining the whole thing. My netbook doesn't have hard CAPS and NUMLOCK lights, I need to look at the display's status bar to see it. When I log on, the status bar isn't shown. I can't tell if my keyboard is in numeric mode, so I can't tell if I'm typing my password. This frequently becomes very frustrating -- and this isn't hypothetical, it happens to me all the time.