terriko

Yet another crosspost. Been a little while for the security blog, but there's always neat stuff coming out of ACM CCS. I expect I'll hear more about it when I head in to work this week.


I've heard a lot of arguments as to why expiring passwords likely won't help. Here's a few:

• It's easy to install malware on a machine, so the new password will be sniffed just like the old.
  
• It costs more: frequent password changes result in more forgotten passwords and support desk calls.
  
• It irritates users, who will then feel less motivated to implement to other security measures.
  
• Constantly forcing people to think of new, memorable passwords leads to cognitive shortcuts like password-Sep, password-Oct, password-Nov...
  

And yet, many organizations continue to force regular password changes in order to improve security. But what if that's not what's really happening? Three researchers from the University of North Carolina at Chapel Hill have unveiled what they claim to be the first large-scale study on password expiration, and they found it wanting.

(Read the rest here.)

In the course of doing some thesis research, I stumbled across this fascinating paper in aesthetics and usability.

I'm not sure I've ever read a paper where the researcher seems so thoroughly flummoxed by his/her results.

The idea of the study was to test whether objects rated as more beautiful would also be rated as more functional. The author, I suspect, found this idea faintly ridiculous, but previous work in Japan had shown that people did indeed rate prettier banking machine interfaces as more usable. He suspected that perhaps this was just an effect related to Japan and its "culture is known for its aesthetic tradition." He would repeat the study in Israel, where the culture has a stronger emphasis on action over form. Surely, he thought, the practical Israeli people would not be as affected by aesthetics.

But what happened? "Unexpectedly high correlations" The author says, "usability and aesthetics were not expected to correlate in Israel" but they did. Oh, they did.

Even though I'd not read this paper until this week, it's something I'd noticed in doing basic testing of my web projects (back when I made more of a living writing web code rather than deconstructing and mocking... errr... inspecting its security). I used to test designs on clients, friends and invariably, I'd get more positive results (and useful!) feedback if I spent the bit of extra time to make the first draft look clean, if still aesthetically simple. Pretty matters.

It's kinda nice to have a couple of scientific papers to back up one's gut feelings, eh?

---

Want more than a gut instinct to explain why attractive things work better? Don Norman suggests an answer in his book, Emotional Design: Why We Love (or Hate) Everyday Things. (I noticed it when seeing who had referred to this study and am working my through it. Research is fun!)

The theory goes like this: pretty things change your emotions in a positive way, make you happy, less stressed. Your emotional state changes your perceptions and ability to work. When you are happier, you often find things easier to use. Thus, pretty things are easier to use. And ugly things make you more easily annoyed, stressed out. Stress makes you perform poorly. Thus, ugly things are harder to use.

And in honour of the new Star Trek movie, I'll finish with a single word:

Fascinating.