Usable Security

Let's start with a new password experiment.

Authority

Grant/request the least amount of authority necessary to accomplish the task, and make sure users know what authority they have granted.

• Do I really have to supply all this information, Budweiser?
• Why was Social Reader such a terrible idea?

  

• If you grant authority to a system, you should be able to easily know what that is. For example, What happens if I download this? (don't worry - you won't download anything by clicking on this link)
• Want to Take this lollipop?

Authentication

Biometrics

Consider the usability of each

• Fingerprint

• Voice Recognition

• Gestures

  Here's a colleague's experiment on making good, secure gesture-based passwords.

Test: With a partner or small group, have someone time you logging in to your phone using as many of the following as are set up for you:

• PIN
• Fingerprint
• Gesture

Enter your results in this form.

View the results here