The Emperor has no clothes!

I hope MIT, Harvard, et al, don't mind me using their play on words.  Jeremy Kirk's article Study: Users ignore bank security features points us to the actual study entitled The Emperor's New Security Indicators.  This is a working paper that was been accepted at the 2007 IEEE Symposium on Security and Privacy, May 20-23, 2007, Oakland, California, USA.

Here's what I think is important about this.  First, someone in academia is taking a close look at the actual results of providing banking customers with a more secure means of accessing their personal bank accounts.  While this is a very small study and based only on the actions of 67 bank customers, the percentages are astounding.  You will have to read it for yourself.

The paper's findings, hopefully, will have a profound effect on how financial institutions are designing website authentication and security.  I hope they don't throw their hands up in despair and blame the lack of foolproof security solutions on the dumb End Lusers.  Website security has got to be idiot proof. 

Security, in general, has to be idiot proof.  We cannot rely on our End Users to "get it" when they are doing something stupid.  We can't allow them to do something stupid.  It's like not letting your kids play in front of the house if you live on a busy street.  You don't leave your baby in the car when you run into the store.  I could go on and on.  What I'm trying to say is that security is the responsibility of the security professionals.  End User security awareness will help you do your job and is critically important.  But, you cannot ever depend upon your End Users to understand what they should and should not be doing all the time. 

I think about how we in IT talk in geek.  People outside our profession do not understand what we are talking about a lot of the time.  It's the same in security.  You can tell people to look for the https:// and you can tell them to pick a picture, and you can tell them to create better passwords, but if they don't understand what goes on behind the scenes, they are just performing a ritual they don't understand.  So, let's stop trying to get them to understand and come up with something that works.  I dunno.  Any ideas?