The Security Usability Challenge
Everyone wants to be more secure. They want their browsing, their money, their utilities, and their lives to be as safe as possible. When you ask users of any service about security in a vacuum, they always want the best.
Reality sets in when users see how complicated and tedious secure systems are, and this often leads to compromise, where some security is given up to make the service “secure enough” while allowing the user to utilize the service without much annoyance.
This problem spans every discipline of computing. Computers, mobile phones, programming environments, operating systems, even the regular old mail has security considerations that are waived away as inconveniences.
Developers of secure apps are starting to take notice. You can create apps with fantastic security that are useless to most of the world because they are hard to manage and hard to use on a daily basis.
Difficult to Use Apps Face Resistance
A great example of a hard to use system is PGP. Short for Pretty Good Privacy, it is a tried and true message encryption system that has had very little change in core mechanics since it was invented in 1991. PGP is reliable, and there’s evidence that if your PGP keys don’t get pilfered, even the NSA can’t break it.
The problem is that in order for PGP to work, you have to manage public and private RSA keys. You have to generate these keys yourself, store them securely, and keep a secure backup of those keys because if you lose them your messages are destroyed. You also don’t have the ability to search through your messages for keywords or to easily manage organizing your messages. This is further complicated in that if you want to send and receive messages through an email provider that you don’t trust, you have to do all of these things in a 3rd party app. Composing an email, signing it, encrypting it, and sending it is a 4-step process where users are used to just writing their messages and sending them. Scale these extra steps up to every single message that you send and receive, and then add the complications with no searching, and it is easy to see how usability suffers. Let’s not even get into attachments…
Easy to Use Apps Enjoy Rapid Adoption
A great example of an easy to use system is Signal Messenger ( iOS | Android ). Signal allows a user to send and receive messages with attachments, and verify the identity of the sender, but it doesn’t interfere with the user experience. This means that using the messenger is largely no different than regular texting. It requires the same number of steps to message someone, and adds the functionality of security, privacy, and integrity for “free” from a user experience standpoint.
This is crucial because it doesn’t create any technical nor annoyance hurdles that the user must overcome to use the app every day. I can convince my friends to install and use Signal. I feel like i’m annoying cryptographers and security researchers when I email them using PGP.
Secure App Development is Changing for the Better Under the Hood As Well As On the Surface
What is interesting is that this philosophy is also finding its way over into the development process for secure applications. There is a push for elegant, and easy to understand code that can be easily reviewed and understood by developers. The aim is to reduce configuration errors, and to reduce the complexity of the app to minimize the number of bugs.
One example of this is WireGuard, a VPN protocol that is in development. It is designed from the ground-up to be as simple as possible, with only 4000 lines of well documented code that is heavily researched and understood. ( Before you ask me about when Private Internet Access will have WireGuard servers, see this.)
OpenVPN, the current de-facto standard of VPN protocols, weighs in at over a hundred times the size of WireGuard. Now, to be fair, OpenVPN also provides a lot more functionality and uses a full crypto library, but the room for error is enormous. Even with auditing and fuzzing there’s likely errors lurking in the code, and the gnarled web of functions can have all sorts of unintended consequences for edge case configurations that are not regularly tested. This complicated code base allows a lot of room for error for admins and developers looking to use OpenVPN code for their projects as well, with the how-to documentation weighing in with as many lines as the entirety of the WireGuard app.
Usability is the key to getting worldwide adoption for security and privacy apps, and the world is waiting for them.
Private Internet Access is a proud sponsor of many open source initiatives that are solving real-world problems like these. We are working hard to make our own services easier to use and to push the boundaries of VPNs to new heights!
