Security, Usability, and Why We Have Neither

Two decades after "Why Johnny Can't Encrypt" and a decade after "Users Are Not the Enemy," usable security is still the exception rather than the rule. Is it that there is something unique about usable security as opposed to usability in other domains? Or is this a cultural issue? This session argues for both sides of the argument, for security being a distinct problem that is ill-suited to the cultures of user-centered design.