Security
by(e)
Design?

Benedek Gagyi

Leaves / water
ratio

Water
temperature

Steeping
time

Leaves / water
ratio

Water
temperature

Steeping
time

Devs

UX

Security

How is software made?

Dev

Features

Performance

Accessibility

Quality

UX

UX Design

Security

Security

User research

User flows

Look & feel

AppSec

DevSecOps

Audits

Dev

UX

Security

USER EXPERIENCE

UX

Security

Broken UX

Broken Security

Broken UX

Broken Security

=

BROKEN
USER
EXPERIENCE

EXAMPLES

Passwords are a mess

The experience of passwords is a mess

What's a strong password?

  • 8 characters
  • capital letters
  • special characters
  • 16 characters
  • passphrases
  • leet (1337) encoding
  • 12 characters
  • numbers
  • special characters
  • emoticons

How do I introduce that password?

Autofill is not quite "auto"

If good security has bad UX, your app is
not
secure

User education is hard

User miseducation is easy

3D Secure

Collect card info

Redirect to provider

Additional security check

Redirect back to shop

Security through text

DON'T
PUSH

If you encourage bad habits,
they will come back to haunt you.

AND
WHY
SHOULD
I CARE

?

DX

UX
for devs

UX
for users

EXAMPLES

ROUND II

npm audit
subtle.crypto

"It's very easy to misuse them, and the pitfalls involved can be very subtle."

If good security has bad UX, your app is
not
secure

If good security is hard to achieve you'll app will
never
be secure

Convenience

vs

Security

<?php

$offset = $_GET['offset'];
$query  = "SELECT * 
    FROM products 
    ORDER BY name 
    LIMIT 20 
    OFFSET $offset;";
$result = pg_query($conn, $query);

?>

If it's easier to write vulnerable code than secure, you will
never
have a secure application

As a developer

Development

Security

DX

EXAMPLES

POSITIVE

The road to better log-in experiences

Credentials API

Web OTP API

WebAuthn

Passkeys

The road to better payment experiences

Browser autofill

3D Secure

Secure Payment Confirmation API

SOLUTIONS

Communication

  • Awareness

  • Knowledge sharing

  • Learn from the past

Empathy

  • Understand the user

  • Remove obstacles for others

  • Open up

Focus on resiliency

  • Design security based on how people actually behave

  • Aim to remove the hazards entirely

  • Human attention is a finite resource

kellyshortridge.com

Paved roads concept

Ensure that the easiest thing to do is the
right thing to do

Made with Slides.com