Designing Effective Interfaces For ­Usable Privacy and Security

I often cringe when I hear highly technical engineers talk about people.

I usually hear broad generalizations tossed about, like "people are lazy, that's why they can't use the system", or "people don't understand security". The worst is "people are just stupid".

With this kind of attitude, it's no surprise that there are so many complicated user interfaces in the world, let alone in privacy and security. Failing to try to understand things from the user's point of view is the cardinal sin in user interface design.

With this in mind, I thought it would be good to shift focus in this blog entry away from individual case studies of usable privacy and security, and look at the bigger picture of how to design better user interfaces in this space.

Now, how to craft an effective user interface is a very involved topic that one can study for years, and there are lots of great web sites and books out there. Effective user interface design combines our understanding of aesthetics, technology, and human behavior to develop artifacts that are useful, usable, and desirable for a specific target audience.

What makes usable privacy and security different from designing other interfaces is that privacy and security are often secondary tasks. People don't go into an e-commerce site explicitly wanting to protect their credit cards and email addresses, they go there to buy things. Security and privacy are obvious things they want while accomplishing their main goal, in the same manner that they want the web site to also be fast and usable.

Roughly, there are three broad strategies for usable privacy and security (note that these aren't mutually exclusive):

• make the interface invisible
• make the interface more understandable
• train the users

A good example of better security by making the interface invisible is SSL. End-users don't have to do anything special, and all of their network traffic is transparently encrypted.

Often times, we just need to make the user interface more understandable to end-users. This might be accomplished through better layout, simplified task flows, better visualizations, or more appropriate metaphors (why do we sign digital documents using keys, anyway?).

Finally, some user interfaces may also require training the users. One common misconception about user interfaces is that they should be "intuitive" (a description that always raises a red flag with me). If you're a Star Trek fan like I am, you might remember that famous scene in Star Trek IV where Montgomery Scott, the ship's engineer, is trying to use a Macintosh computer. After trying to talk to the computer and getting no response, he then picks up the mouse and tries talking into it. Intuitive indeed.

Applications are always designed for a specific context, for specific purposes, and for a specific target audience. The best designs will empower people and let them get started quickly, while also providing a way for them to get better. Minutes to learn, a lifetime to master, as the old saying goes.

As such, there will be some applications will require some level of training. The training might range from a basic understanding of how to zoom in and out on the iPhone (where Apple cleverly trained people how to use with their television ads), all the way to learning how to drive a car (something we actually start training our children to do since birth, given how ingrained cars are in society).

Now, this doesn't mean that you can get away with a disastrous user interface and expect people to have to train how to use it, but it also doesn't mean that all user interfaces should be walk up and use either. You have to balance ease-of-use with power and flexibility for your specific audience and your specific goals. As Silicon Valley pioneer Doug Engelbart once noted, if ease of use was all that mattered, we'd all still be riding tricycles.

In my next few blog entries, I'll discuss some more thoughts on how to design effective interfaces for usable privacy and security.