Security vs usability

One of the challenges in designing security into systems is to maintain usability. the only way to make a system completely secure is to make it completely unusable, so you need to think carefully about the trade-offs.

This is true not only of information systems but of real world systems too. For example, we can stop people from being killed on the highways by mechanically limiting all vehicles to a top speed of five miles per hour (although I suspect that some idiot somewhere would find a way to kill someone - the world may one day run out of oil, but it will never run out of stupidity).

I experienced an excellent example of this recently when I was updated my credit card details with an ISP. I entered my name, the expiry date and card number and then got back a message something like this:

Please confirm the details you have entered are correct

Name: Dan Hill
Expiry Date: 11/11
Card Number: *****************1111

You'll probably recognise showing only the last four digits of the credit card as a widely implemented security design, so at one level the designer thought that he or she was doing the right thing. But at another level this is so totally clueless.