Why Johnny can’t encrypt: A usability evaluation of PGP 5.0

DMCA

Why Johnny can’t encrypt: A usability evaluation of PGP 5.0 (1999)

Cached

Download Links

by Alma Whitten , J. D. Tygar

Citations:

479 - 4 self

BibTeX

@MISC{Whitten99whyjohnny,
    author = {Alma Whitten and J. D. Tygar},
    title = {Why Johnny can’t encrypt: A usability evaluation of PGP 5.0},
    year = {1999}
}

OpenURL

Abstract

User errors cause or contribute to most computer security failures, yet user interfaces for security still tend to be clumsy, confusing, or near-nonexistent. Is this simply due to a failure to apply standard user interface design techniques to security? We argue that, on the contrary, effective security requires a different usability standard, and that it will not be achieved through the user interface design techniques appropriate to other types of consumer software. To test this hypothesis, we performed a case study of a security program which does have a good user interface by general standards: PGP 5.0. Our case study used a cognitive walkthrough analysis together with a laboratory user test to evaluate whether PGP 5.0 can be successfully used by cryptography novices to achieve effective electronic mail security. The analysis found a number of user interface design flaws that may contribute to security failures, and the user test demonstrated that when our test participants were given 90 minutes in which to sign and encrypt a message using PGP 5.0, the majority of them were unable to do so successfully. We conclude that PGP 5.0 is not usable enough to provide effective security for most computer users, despite its attractive graphical user interface, supporting our hypothesis that user interface design for effective security remains an open problem. We close with a brief description of our continuing work on the development and application of user interface design principles and techniques for security.

Keyphrases

usability evaluation effective security case study user interface standard user interface design technique consumer software cryptography novice laboratory user test security program effective electronic mail security user interface design computer security failure user test brief description user error attractive graphical user interface test participant user interface design technique security failure cognitive walkthrough analysis open problem computer user good user interface user interface design principle user interface design flaw different usability standard general standard

DMCA