Users are not the enemy

Subscribe (Full Service)


	Search: The ACM Digital Library The Guide

	Feedback

Users are not the enemy

Full text

Html (35 KB), Pdf

Pdf (99 KB)

Source

Communications of the ACM archive
Volume 42 , Issue 12 (December 1999) table of contents

Pages: 40 - 46

Year of Publication: 1999

ISSN:0001-0782

Authors

Anne Adams	Univ. College of London, London, UK
Martina Angela Sasse	Univ. College of London, London, UK

Publisher

ACM New York, NY, USA

Bibliometrics

Downloads (6 Weeks): 109, Downloads (12 Months): 801, Citation Count: 98

Additional Information:

references cited by index terms review collaborative colleagues

Tools and Actions:	Request Permissions Review this Article Save this Article to a Binder Display Formats: BibTeX EndNote ACM Ref

DOI Bookmark:	Use this link to bookmark this Article: http://doi.acm.org/10.1145/322796.322806 What is a DOI?

REFERENCES

Note: OCR errors may be found in this Reference List extracted from the full text article. ACM has opted to expose the complete List rather than only correct and linked references.

	1	DeAlvare, A.M. A framework for password selection. In Proceedings of Unix Security Workshop II. (Portland, Aug. 29-30, 1998).
	2	DeAlvare, A.M. How crackers crack passwords or what passwords to avoid. In Proceedings of Unix Security Workshop II. (Portland, 1990).
	3	Davis, C. and Ganesan, R. BApasswd: A new proactive password checker. In Proceedings of the National Computer Security Conference '93, the 16th NIST/NSA conference. 1993, 1-15.
	4	Davis, D. and Price, W. Security for Computer Networks. Wiley, Chich-ester, 1987.
	5	FIPS. Password Usage. Federal Information Processing Standards Pub-lication. May 30, 1985.
	6	Warwick Ford, Computer communications security: principles, standard protocols and techniques, Prentice-Hall, Inc., Upper Saddle River, NJ, 1994
	7	Gordon, S. Social Engineering: Techniques and Prevention. Computer Security, 1995
	8	Hitchings, J. Deficiencies of the traditional approach to information security and the requirements for a new methodology. Computers and Security, 14, 1995, 377-383.
	9	Donn B. Parker, Restating the Foundation of Information Security, Proceedings of the IFIP TC11, Eigth International Conference on Information Security: IT Security: The Need for International Cooperation, p.139-151, May 27-29, 1992
	10	Strauss, A. and Corbin, J. Basics of Qualitative Research: Grounded The-ory Procedures and Techniques. Sage, Newbury Park, 1990.
	11	Wickens, C.D. Engineering Psychology and Human Performance, 2d ed. Harper Collins, NY, 1992.

CITED BY 98

	Blake Ives , Kenneth R. Walsh , Helmut Schneider, The domino effect of password reuse, Communications of the ACM, v.47 n.4, p.75-78, April 2004
	Anne Adams , Martina Angela Sasse, Taming the wolf in sheep's clothing: privacy in multimedia communications, Proceedings of the seventh ACM international conference on Multimedia (Part 1), p.101-107, October 30-November 05, 1999, Orlando, Florida, United States
	Paul Dourish , David Redmiles, An approach to usable security based on event monitoring and visualization, Proceedings of the 2002 workshop on New security paradigms, September 23-26, 2002, Virginia Beach, Virginia
	Dirk Weirich , Martina Angela Sasse, Persuasive password security, CHI '01 extended abstracts on Human factors in computing systems, March 31-April 05, 2001, Seattle, Washington
	Andrew S. Patrick , A. Chris Long , Scott Flinn, HCI and security systems, CHI '03 extended abstracts on Human factors in computing systems, April 05-10, 2003, Ft. Lauderdale, Florida, USA
	S. W. Smith, Humans in the Loop: Human-Computer Interaction and Security, IEEE Security and Privacy, v.1 n.3, p.75-79, May 2003
	D. K. Smetters , R. E. Grinter, Moving from the design of usable security technologies to the design of useful secure applications, Proceedings of the 2002 workshop on New security paradigms, September 23-26, 2002, Virginia Beach, Virginia
	Dirk Balfanz , Glenn Durfee , Rebecca E. Grinter , D. K. Smetters, In Search of Usable Security: Five Lessons from the Field, IEEE Security and Privacy, v.2 n.5, p.19-24, September 2004
	Carrie Gates , Jacob Slonim, Owner-controlled information, Proceedings of the 2003 workshop on New security paradigms, August 18-21, 2003, Ascona, Switzerland
	Dirk Weirich , Martina Angela Sasse, Pretty good persuasion: a first step towards effective password security in the real world, Proceedings of the 2001 workshop on New security paradigms, September 10-13, 2001, Cloudcroft, New Mexico
	Anne Adams , Ann Blandford , Peter Lunt, Social empowerment and exclusion: A case study on digital libraries, ACM Transactions on Computer-Human Interaction (TOCHI), v.12 n.2, p.174-200, June 2005
	Jeff Yan , Alan , Ross , Alasdair, Password Memorability and Security: Empirical Results, IEEE Security and Privacy, v.2 n.5, p.25-31, September 2004
	Jeff Yan , Alan , Ross , Alasdair, Password Memorability and Security: Empirical Results, IEEE Security and Privacy, v.2 n.5, p.25-31, September 2004
	Lynne Coventry , Antonella De Angeli , Graham Johnson, Usability and biometric verification at the ATM interface, Proceedings of the SIGCHI conference on Human factors in computing systems, April 05-10, 2003, Ft. Lauderdale, Florida, USA
	Lorrie Faith Cranor , Simson Garfinkel, Guest Editors' Introduction: Secure or Usable?, IEEE Security and Privacy, v.2 n.5, p.16-18, September 2004
	Ivan Flechais , M. Angela Sasse , Stephen M. V. Hailes, Bringing security home: a process for developing secure and usable systems, Proceedings of the 2003 workshop on New security paradigms, August 18-21, 2003, Ascona, Switzerland
	Alen Peacock , Xian Ke , Matthew Wilkerson, Typing Patterns: A Key to User Identification, IEEE Security and Privacy, v.2 n.5, p.40-47, September 2004
	Panagiotis Louridas, Some guidelines for non-repudiation protocols, ACM SIGCOMM Computer Communication Review, v.30 n.5, October 2000
	Susan K. Lippert, Humanware issues in a government management information systems implementation, Annals of cases on information technology, Idea Group Publishing, Hershey, PA, 2003
	Jens Riegelsberger , M. Angela Sasse , John D. McCarthy, The researcher's dilemma: evaluating trust in computer-mediated communication, International Journal of Human-Computer Studies, v.58 n.6, p.759-781, June 2003
	Erik Riedel , Mahesh Kallahalla , Ram Swaminathan, A Framework for Evaluating Storage System Security, Proceedings of the 1st USENIX Conference on File and Storage Technologies, January 28-30, 2002, Monterey, CA
	Tapan S. Parikh, Using Mobile Phones for Secure, Distributed Document Processing in the Developing World, IEEE Pervasive Computing, v.4 n.2, p.74-81, April 2005
	Antonella De Angeli , Lynne Coventry , Graham Johnson , Karen Renaud, Is a picture really worth a thousand words? Exploring the feasibility of graphical authentication systems, International Journal of Human-Computer Studies, v.63 n.1-2, p.128-152, July 2005
	Haidong Xia , José Carlos Brustoloni, Hardening Web browsers against man-in-the-middle and eavesdropping attacks, Proceedings of the 14th international conference on World Wide Web, May 10-14, 2005, Chiba, Japan
	Scott Flinn , Steve Stoyles, Omnivore: risk management through bidirectional transparency, Proceedings of the 2004 workshop on New security paradigms, September 20-23, 2004, Nova Scotia, Canada
	Tara Whalen , Kori M. Inkpen, Gathering evidence: use of visual security cues in web browsers, Proceedings of the 2005 conference on Graphics interface, May 09-11, 2005, Victoria, British Columbia
	Susan Wiedenbeck , Jim Waters , Jean-Camille Birget , Alex Brodskiy , Nasir Memon, Authentication using graphical passwords: effects of tolerance and image choice, Proceedings of the 2005 symposium on Usable privacy and security, p.1-12, July 06-08, 2005, Pittsburgh, Pennsylvania
	Richard M. Conlan , Peter Tarasewich, Improving interface designs to help users choose better passwords, CHI '06 extended abstracts on Human factors in computing systems, April 22-27, 2006, Montréal, Québec, Canada
	Maria Nilsson , Anne Adams , Simon Herd, Building security and trust in online banking, CHI '05 extended abstracts on Human factors in computing systems, April 02-07, 2005, Portland, OR, USA
	Anne Adams , Ann Blandford, Bridging the gap between organizational and user perspectives of security in the clinical domain, International Journal of Human-Computer Studies, v.63 n.1-2, p.175-202, July 2005
	Bruce Beckles , Von Welch , Jim Basney, Mechanisms for increasing the usability of grid security, International Journal of Human-Computer Studies, v.63 n.1-2, p.74-101, July 2005
	Roy A. Maxion , Robert W. Reeder, Improving user-interface dependability through mitigation of human error, International Journal of Human-Computer Studies, v.63 n.1-2, p.25-50, July 2005
	Shirley Gaw , Edward W. Felten , Patricia Fernandez-Kelly, Secrecy, flagging, and paranoia: adoption criteria in encrypted email, Proceedings of the SIGCHI conference on Human Factors in computing systems, April 22-27, 2006, Montréal, Québec, Canada
	Rogério de Paula , Xianghua Ding , Paul Dourish , Kari Nies , Ben Pillet , David F. Redmiles , Jie Ren , Jennifer A. Rode , Roberto Silva Filho, In the eye of the beholder: a visualization-based approach to information system security, International Journal of Human-Computer Studies, v.63 n.1-2, p.5-24, July 2005
	Susan Wiedenbeck , Jim Waters , Jean-Camille Birget , Alex Brodskiy , Nasir Memon, PassPoints: design and longitudinal evaluation of a graphical password system, International Journal of Human-Computer Studies, v.63 n.1-2, p.102-127, July 2005
	Tony Clear, Design and usability in security systems: daily life as a context of use?, ACM SIGCSE Bulletin, v.34 n.4, December 2002
	Sacha Brostoff , M. Angela Sasse, Safe and sound: a safety-critical approach to security, Proceedings of the 2001 workshop on New security paradigms, September 10-13, 2001, Cloudcroft, New Mexico
	Shirley Gaw , Edward W. Felten, Password management strategies for online accounts, Proceedings of the second symposium on Usable privacy and security, July 12-14, 2006, Pittsburgh, Pennsylvania
	Christina Braz , Jean-Marc Robert, Security and usability: the case of the user authentication methods, Proceedings of the 18th international conference on Association Francophone d'Interaction Homme-Machine, p.199-203, April 18-21, 2006, Montreal, Canada
	Susan Wiedenbeck , Jim Waters , Leonardo Sobrado , Jean-Camille Birget, Design and evaluation of a shoulder-surfing resistant graphical password scheme, Proceedings of the working conference on Advanced visual interfaces, May 23-26, 2006, Venezia, Italy
	Ivan Flechais , Jens Riegelsberger , M. Angela Sasse, Divide and conquer: the role of trust and assurance in the design of secure socio-technical systems, Proceedings of the 2005 workshop on New security paradigms, September 20-23, 2005, Lake Arrowhead, California
	Cynthia Kuo , Sasha Romanosky , Lorrie Faith Cranor, Human selection of mnemonic phrase-based passwords, Proceedings of the second symposium on Usable privacy and security, July 12-14, 2006, Pittsburgh, Pennsylvania
	Alain Forget , Robert Biddle, Memorability of persuasive passwords, CHI '08 extended abstracts on Human factors in computing systems, April 05-10, 2008, Florence, Italy
	Dinei Florêncio , Cormac Herley , Baris Coskun, Do strong web passwords accomplish anything?, Proceedings of the 2nd USENIX workshop on Hot topics in security, p.1-6, August 07, 2007, Boston, MA
	Morten Hertzum, Minimal-feedback hints for remembering passwords, interactions, v.13 n.3, May + June 2006
	Furkan Tari , A. Ant Ozok , Stephen H. Holden, A comparison of perceived and real shoulder-surfing risks between alphanumeric and graphical passwords, Proceedings of the second symposium on Usable privacy and security, July 12-14, 2006, Pittsburgh, Pennsylvania
	Xiang Cao , Lee Iverson, Intentional access management: making access control usable for end-users, Proceedings of the second symposium on Usable privacy and security, July 12-14, 2006, Pittsburgh, Pennsylvania
	Ann Nosseir , Richard Connor , Karen Renaud, Question-based group authentication, Proceedings of the 20th conference of the computer-human interaction special interest group (CHISIG) of Australia on Computer-human interaction: design: activities, artefacts and environments, November 20-24, 2006, Sydney, Australia
	Mark Keith , Benjamin Shao , Paul John Steinbart, The usability of passphrases for authentication: An empirical field study, International Journal of Human-Computer Studies, v.65 n.1, p.17-28, January, 2007
	Rachna Dhamija , Adrian Perrig, Déjà Vu: a user study using images for authentication, Proceedings of the 9th conference on USENIX Security Symposium, p.4-4, August 14-17, 2000, Denver, Colorado
	Supriya Singh , Anuja Cabraal , Catherine Demosthenous , Gunela Astbrink , Michele Furlong, Password sharing: implications for security design based on social practice, Proceedings of the SIGCHI conference on Human factors in computing systems, April 28-May 03, 2007, San Jose, California, USA
	Wendy Moncur , Grégory Leplâtre, Pictures at the ATM: exploring the usability of multiple graphical passwords, Proceedings of the SIGCHI conference on Human factors in computing systems, April 28-May 03, 2007, San Jose, California, USA
	Dinei Florencio , Cormac Herley, A large-scale study of web password habits, Proceedings of the 16th international conference on World Wide Web, May 08-12, 2007, Banff, Alberta, Canada
	Mohamed G. Gouda , Alex X. Liu , Lok M. Leung , Mohamed A. Alam, SPP: An anti-phishing single password protocol, Computer Networks: The International Journal of Computer and Telecommunications Networking, v.51 n.13, p.3715-3726, September, 2007
	R. Rukšėnas , P. Curzon , A. Blandford, Detecting Cognitive Causes of Confidentiality Leaks, Electronic Notes in Theoretical Computer Science (ENTCS), 183, p.21-38, July, 2007
	Gregory V. Bard, Spelling-error tolerant, order-independent pass-phrases via the damerau-levenshtein string-edit distance metric, Proceedings of the fifth Australasian symposium on ACSW frontiers, January 30-February 02, 2007, Ballarat, Australia
	E. Bardram, The trouble with login: on usability and computer security in ubiquitous computing, Personal and Ubiquitous Computing, v.9 n.6, p.357-367, November 2005
	Ryan West, The psychology of security, Communications of the ACM, v.51 n.4, p.34-40, April 2008
	M. Rejman-Greene, Biometrics — Real Identities for a Virtual World, BT Technology Journal, v.19 n.3, p.115-121, July 2001
	M. A. Sasse , S. Brostoff , D. Weirich, Transforming the 'Weakest Link' — a Human/Computer Interaction Approach to Usable and Effective Security, BT Technology Journal, v.19 n.3, p.122-131, July 2001
	Emmanuelle Vaast, Danger is in the eye of the beholders: Social representations of Information Systems security in healthcare, The Journal of Strategic Information Systems, v.16 n.2, p.130-152, June, 2007
	Lujo Bauer , Lorrie Faith Cranor , Michael K. Reiter , Kami Vaniea, Lessons learned from the deployment of a smartphone-based access-control system, Proceedings of the 3rd symposium on Usable privacy and security, July 18-20, 2007, Pittsburgh, Pennsylvania
	Delbert Hart, Attitudes and practices of students towards password security, Journal of Computing Sciences in Colleges, v.23 n.5, p.169-174, May 2008
	Paul Dourish , E. Grinter , Jessica Delgado de la Flor , Melissa Joseph, Security in the wild: user strategies for managing security as an everyday, practical problem, Personal and Ubiquitous Computing, v.8 n.6, p.391-401, November 2004
	Pamela Briggs , Patrick L. Olivier, Biometric daemons: authentication via electronic pets, CHI '08 extended abstracts on Human factors in computing systems, April 05-10, 2008, Florence, Italy
	Lorrie Faith Cranor, A framework for reasoning about the human in the loop, Proceedings of the 1st Conference on Usability, Psychology, and Security, p.1-15, April 14-14, 2008, San Francisco, California
	Pam Briggs , Patrick Olivier, Biometric daemons: authentication via electronic pets, Proceedings of the 1st Conference on Usability, Psychology, and Security, p.1-5, April 14-14, 2008, San Francisco, California
	Maritza L. Johnson , Chaitanya Atreya , Adam Aviv , Mariana Raykova , Steven M. Bellovin , Gail Kaiser, RUST: a retargetable usability testbed for website authentication technologies, Proceedings of the 1st Conference on Usability, Psychology, and Security, p.1-7, April 14-14, 2008, San Francisco, California
	Mohammed AlZomai , Bander AlFayyadh , Audun Jøsang , Adrian McCullagh, An exprimental investigation of the usability of transaction authorization in online bank security systems, Proceedings of the sixth Australasian conference on Information security, January 01-01, 2008, Wollongong, NSW, Australia
	Ivan Flechais , M. Angela Sasse, Stakeholder involvement, motivation, responsibility, communication: How to design usable security in e-Science, International Journal of Human-Computer Studies, v.67 n.4, p.281-296, April, 2009
	João Pedro Sousa, Challenges and architectural approaches for authenticating mobile users, Proceedings of the 1st international workshop on Software architectures and mobility, May 10-10, 2008, Leipzig, Germany
	Rosa Heckle , Wayne G. Lutters , David Gurzick, Network authentication using single sign-on: the challenge of aligning mental models, Proceedings of the 2nd ACM Symposium on Computer Human Interaction for Management of Information Technology, November 14-15, 2008, San Diego, California
	Alain Forget , Sonia Chiasson , Robert Biddle, Helping users create better passwords: is this the right approach?, Proceedings of the 3rd symposium on Usable privacy and security, July 18-20, 2007, Pittsburgh, Pennsylvania
	Vassilis Kostakos, Human-in-the-loop: rethinking security in mobile and pervasive systems, CHI '08 extended abstracts on Human factors in computing systems, April 05-10, 2008, Florence, Italy
	Ahmet Emir Dirik , Nasir Memon , Jean-Camille Birget, Modeling user choice in the PassPoints graphical password scheme, Proceedings of the 3rd symposium on Usable privacy and security, July 18-20, 2007, Pittsburgh, Pennsylvania
	Richard Shay , Abhilasha Bhargav-Spantzel , Elisa Bertino, Password policy simulation and analysis, Proceedings of the 2007 ACM workshop on Digital identity management, November 02-02, 2007, Fairfax, Virginia, USA
	Kevser Karaca , Albert Levi, Towards a framework for security analysis of multiple password schemes, Proceedings of the 1st European workshop on system security, March 31-31, 2008, Glasgow, Scotland
	Rosa R. Heckle , Wayne G. Lutters, Privacy implications for single sign-on authentication in a hospital environment, Proceedings of the 3rd symposium on Usable privacy and security, July 18-20, 2007, Pittsburgh, Pennsylvania
	Ivan Flechais , Cecilia Mascolo , M. Angela Sasse, Integrating security and usability into the requirements and design process, International Journal of Electronic Security and Digital Forensics, v.1 n.1, p.12-26, May 2007
	Philip Inglesant , M. Angela Sasse , David Chadwick , Lei Lei Shi, Expressions of expertness: the virtuous circle of natural language for access control policy specification, Proceedings of the 4th symposium on Usable privacy and security, July 23-25, 2008, Pittsburgh, Pennsylvania
	Kathryn Garson , Carlisle Adams, Security and privacy system architecture for an e-hospital environment, Proceedings of the 7th symposium on Identity and trust on the Internet, March 04-06, 2008, Gaithersburg, Maryland
	Paul Dourish , Ken Anderson, Collective information practice: emploring privacy and security as social and cultural phenomena, Human-Computer Interaction, v.21 n.3, p.319-342, Septemper 2006
	Serge Egelman , A.J. Bernheim Brush , Kori M. Inkpen, Family accounts: a new paradigm for user accounts within the home environment, Proceedings of the ACM 2008 conference on Computer supported cooperative work, November 08-12, 2008, San Diego, CA, USA
	Paul Dunphy , James Nicholson , Patrick Olivier, Securing passfaces for description, Proceedings of the 4th symposium on Usable privacy and security, July 23-25, 2008, Pittsburgh, Pennsylvania
	Alexander P. Pons , Peter Polak, Understanding user perspectives on biometric technology, Communications of the ACM, v.51 n.9, September 2008
	Ye Chen , Divakaran Liginlal, Bayesian Networks for Knowledge-Based Authentication, IEEE Transactions on Knowledge and Data Engineering, v.19 n.5, p.695-710, May 2007
	Alain Forget , Sonia Chiasson , P. C. van Oorschot , Robert Biddle, Improving text passwords through persuasion, Proceedings of the 4th symposium on Usable privacy and security, July 23-25, 2008, Pittsburgh, Pennsylvania
	Roman Weiss , Alexander De Luca, PassShapes: utilizing stroke based authentication to increase password memorability, Proceedings of the 5th Nordic conference on Human-computer interaction: building bridges, October 20-22, 2008, Lund, Sweden
	Marc Langheinrich, Secure localised storage based on super-distributed RFID-tag infrastructures, Journal of Location Based Services, v.1 n.3, p.208-230, September 2007
	Anthony J. Nicholson , Mark D. Corner , Brian D. Noble, Mobile Device Security Using Transient Authentication, IEEE Transactions on Mobile Computing, v.5 n.11, p.1489-1502, November 2006
	Debi Ashenden, Information Security management: A human challenge?, Information Security Tech. Report, v.13 n.4, p.195-201, November, 2008
	Alain Forget , Sonia Chiasson , Robert Biddle, Lessons from brain age on persuasion for computer security, Proceedings of the 27th international conference extended abstracts on Human factors in computing systems, April 04-09, 2009, Boston, MA, USA
	Mirko Fetter , Tom Gross, Beyond the Dyad: understanding sharing in instant messaging, Proceedings of the 27th international conference extended abstracts on Human factors in computing systems, April 04-09, 2009, Boston, MA, USA
	Mohammed Misbahuddin , P. Premchand , A. Govardhan, A user friendly password authenticated key agreement for multi server environment, Proceedings of the International Conference on Advances in Computing, Communication and Control, January 23-24, 2009, Mumbai, India
	Sarah Spiekermann, RFID and privacy: what consumers really want and fear, Personal and Ubiquitous Computing, v.13 n.6, p.423-434, August 2009
	Antonella De Angeli , Mike Coutts , Lynne Coventry , Graham I. Johnson , David Cameron , Martin H. Fischer, VIP: a visual approach to user authentication, Proceedings of the Working Conference on Advanced Visual Interfaces, May 22-24, 2002, Trento, Italy
	Katherine M. Everitt , Tanya Bragin , James Fogarty , Tadayoshi Kohno, A comprehensive study of frequency, interference, and training of multiple graphical passwords, Proceedings of the 27th international conference on Human factors in computing systems, April 04-09, 2009, Boston, MA, USA
	Rajesh Krishna Balan , Narayan Ramasubbu , Komsit Prakobphol , Nicolas Christin , Jason Hong, mFerio: the design and evaluation of a peer-to-peer mobile payment system, Proceedings of the 7th international conference on Mobile systems, applications, and services, June 22-25, 2009, Kraków, Poland

INDEX TERMS

Primary Classification:
K. Computing Milieux
K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS

Additional Classification:
D. Software
D.4 OPERATING SYSTEMS

E. Data
E.3 DATA ENCRYPTION

H. Information Systems
H.1 MODELS AND PRINCIPLES
H.1.2 User/Machine Systems
Subjects: Human factors

J. Computer Applications
J.4 SOCIAL AND BEHAVIORAL SCIENCES
Subjects: Sociology

General Terms:
Design, Human Factors, Security

REVIEW

"Jaak Tepandi : Reviewer"

Computer security is vital to many organizations that depend on their information resources. Complex and expensive security mechanisms are useless if users compromise security measures such as password protection. This useful short article inv more...

Collaborative Colleagues:

Anne Adams: colleagues

Martina Angela Sasse: colleagues

Adobe Acrobat

QuickTime

Windows Media Player

Real Player