On Windows Vista: Security that requires end user attention is not security

Lot of blog posts lately (like this post on Steve Lamb's blog or this one on SilverStr's blog, for example) on Windows Vista's User Account Protection and how Vista deals with security in general. In particular people are complaining about all the popups that Vista puts up when a change to the system is requested that may be harmful.

I'm of the opinion that any security scheme that requires the end user to read and participate is inherently insecure. As we've seen with phishing attacks and other social engineering efforts, most of us, geeks included are very fallible.

Most people just want to get on with the task at hand and will tend to click whatever button they think will allow them to get back to work fastest. Joel Spolsky and others have talked again and again on how any UI that requires someone to read something in order to make a decision is a poor UI. Why? Because we tend not to read things that are uninteresting to us and for the most part, verbose statements about security or some instructions on what not to enter into a UI box are very uninteresting to people when they are focused on a seemingly unrelated task.

And with the number of PCs out in the wild these days, any security effort that is doomed to even as much as a 1% failure rate is an abysmal failure as this will lead to tens, if not hundreds, of thousands of zombied PCs...in fact it already has.

But Vista was supposed to fix much of this, and while I think that some of the other initiatives put in place with Vista will make things better, the features that require user intervention to work, by design, won't work as most of us just want to get on with what we are doing.

Instead of asking the user to figure out if something is OK, the Operating System itself needs to figure out on the vast majority of situations. Yes this is a steep climb to make, but I feel that if Windows is able to keep the user queries to the bare minimum, that when they do pop up users will get that it's important and hopefully be mindful of their input.

The more Windows pops up queries for the user the less effective such a system will be.

Perhaps instead, a better method would be in most instances to just inform the user that a change had been made and to pop up a bubble in the lower right hand side of the desktop informing them that such and such was done and if they didn't mean for this to be done then click in the bubble to reverse the change. And only in the case of high risk activities ask the user if they are sure they want to continue and make them enter their password if they click Yes regardless of whether or not they are logged in as an admin.

What do you think?