Why Don't Users Do What They are Supposed to Do? A look at users and security
summary
Argues that developers share blame for poor user security and cites the 2017 NIST change to don't expire passwords and allow long, Unicode passwords; shows real failures (Therac‑25 radiation deaths, Hawaii false alarm, hotel open Wi‑Fi, router 2.4/5 GHz mismatch). Builds a prototype security first aid kit dashboard with videos, smiley colors and links to fixers; tests with 10 non‑expert users and reports clear knowledge gains and intent to install tools. Recommends design that is secure but not annoying.
AI-written summary · about
chapters (38)
- 0:00Introduction
- 0:58Who am I
- 2:08Agenda
- 2:21Network sniffing
- 3:18Security
- 5:54HumanComputer Interaction
- 6:38Statistics
- 7:44Business threats
- 11:34Keeping people happy
- 11:57Knowledge Ignorance
- 17:37Fake usability
- 19:41Password policies
- 23:11Whats bugging users
- 24:15Users dont understand
- 26:10Why dont they use them
- 28:56Security is the weakest link
- 29:13Aesthetics
- 30:15AI vs ML
- 30:51VPN
- 31:57Best way to scare away users
- 32:39Old Windows Defender
- 34:51How to change
- 38:18My mom
- 41:10The same principles
- 46:18Quality management
- 47:59The big picture
- 48:44The context
- 49:16Example
- 50:18What technologies do you use
- 51:13Usability and encouragement
- 51:43Success factors
- 51:57Data
- 52:50Results
- 55:21First Aid Kit
- 57:14User Feedback
- 57:30Pictures
- 57:57VPNs
- 58:24Firewall
related talks
29mSecurity by(e) Design?
40mLike, Share and Subscribe: Effective Communication of Security Advice
28mSecurity Through Design - Making Security Better By Designing for People
46mDesigning Like a Hacker
31mAn Ant in a World of Grasshoppers
29mThe Importance of Design: maybe the users aren't wrong?
45mBuilding Trust with UX Design: Examples from IoT and Beyond
42mReal-World Security Implementations and Key Lessons