When UI design kills security?

Published 15 July 2015 · Last updated 4 September 2026 · Author: Franck Martin

"Internet users are idiots"
"Only 20% of Microsoft Word/Excel is ever used"
"There is not much room for Mobile User Interfaces"

Common sentences I sometimes hear to justify keeping security functions out of User Interface design...

Email as an attack vector

We want to protect the users from spam and phish. We develop special filters, authentication methods, reputation systems to remove 99% of the spam trying to reach people's mailbox, but there is still some malware that reaches the inbox. For instance the FBI estimates that US businesses lost 180 Million dollars this year, 215 Million dollars worldwide through Business Email Compromise (BEC). Whatever is your protection, there are ways to get through it. The miscreants know the ways around security and build tools for other miscreants to use.

The rest of this post is for subscribers. Log in or subscribe (it's free) to keep reading.