Evil interfaces

The Electronic Frontier Foundation calls out Facebook for its deliberate attempts to compromise its users' privacy. Good for EFF for taking the fight to Facebook.

I've complained before about mis-designed interfaces that are used to extract money from consumers. This sort of stuff gives interface designers a bad name.

Blog: Schneier on security

Bruce Schneier became one of my favorite writers after I read his excellent Secrets and lies: digital security in a networked world. He was and is an expert security tech guy, but his focus has changed over time to the behavioral aspects of security. The chapter called The Human Factor explains why people are the weakest link in any security system. Good stuff.

He also posts often to his security blog. Timely and interesting. I liked the 4/30 article on the biometric fingerprint reader in the gym. I guess no one wrote a "sweaty guy with barbell indents on his fingertips" use case.

Security and usability

IT security people have a tough task. They need to provide systems that can't be accessed by outsiders but are easy for insiders to use and allow them to get their work done. The problem is, the outsiders who try to crack systems are much, much better at what they do then most computer users are at understanding security. Most people don't give security a thought unless their identities are stolen or their accounts are hacked. The recent news item about VP candidate Palin's Yahoo! account being hacked shows how easy it is to learn someone's security questions and use them to reset a password.

I attended one of the first meetings of IT security and usability engineers at the CHI conference in Ft. Lauderdale in 2003. It was two groups of people who hadn't given the other much thought before, but we all could clearly see the value of collaborating in the future. Part of this is an organizational problem, because people aren't rewarded for practicing good security behavior, and are rarely called on bad behavior because it's not monitored.