Usability versus complexity – striking the balance in end-user security

It is often suggested that security should be as usable and convenient as possible. However, there are some scenarios in which this can be taken too far (potentially to the extent that security is weakened as a consequence). Users will sometimes take reassurance from security being explicitly visible and having an apparent level of complexity, as this enables them to see that it is operating and providing a tangible level of deterrent. This article examines these perspectives, using illustrative examples from a range of tools and related features. It also highlights cases in which security seems over-complex or less usable without good reason, with the likely consequence that it becomes an unnecessarily negative experience for its users.