Usability and Security

Don Norman has written a thoughtful essay on usability and security. He writes:

The more secure you make something, the less secure it becomes. Why? Because when security gets in the way, sensible, well-meaning, dedicated people develop hacks and workarounds that defeat the security.

Security and usability often seem to be at odds. But if you want to make a system secure, you also have to make it usable. If security makes a system less usable, people will find a way to disable or impede it. They will habitually ignore popup warnings, disable firewalls, type passwords into normal text fields and then paste them into password fields, use the same simple password on every site, stick post-it notes with their login information to the screen, and avoid updating the operating system and their anti-virus software.

You can't make a system secure without also making it so usable that people won't actively defeat the system's security.