Security by(e) Design?
summary
Argues that security and UX routinely clash with concrete consequences: password rules and hidden input fields push users to weak passwords; 3D Secure flows train users to enter bank credentials on phishing pages; npm audit spams teams with hundreds of alerts; SubtleCrypto API is so fiddly developers avoid it; easy SQL string interpolation keeps SQL injection alive. Tracks progress through Credentials API, WebAuthn and Web OTP toward passkeys and passwordless logins, and recommends communication, shared postmortems and the PVE rule: make the easiest path the secure one.
AI-written summary · about
chapters (9)
- 0:00Introduction and tea analogy
- 3:11How software is made today
- 6:02Security breaking user experience
- 11:17UX breaking security
- 14:05Developer experience matters
- 17:40Security and DX balance
- 20:12Positive evolution in login
- 23:43Solutions and teamwork
- 28:15PVE road concept summary
related talks
28mSecurity Through Design - Making Security Better By Designing for People
40mSecurity by UX Design
38mSecurity Styles
37mSecurity Doesn’t Have To Be a Nightmare
43mSecurity By Design
01h 03mWhy Don't Users Do What They are Supposed to Do? A look at users and security
01h 17mSecure by Design - Security Principles for the Working Architect
29mSecurity is not a Feature!