Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0 (1999)
Seminal 1999 USENIX study finds most novice users cannot correctly sign and encrypt email with PGP 5.0 in 90 minutes.
Whitten and Tygar's USENIX Security Symposium paper evaluates whether cryptography novices can use PGP 5.0 effectively, using cognitive walkthrough analysis and a laboratory user test. The majority of test participants failed to successfully sign and encrypt a message within 90 minutes, despite PGP 5.0 having a well-regarded graphical interface. The authors argue that security requires usability standards beyond those of general consumer software and propose domain-specific UI design principles for security. The paper is a foundational reference in usable security research.
- Majority of novices failed to sign and encrypt a message in 90 minutes using PGP 5.0
- Cognitive walkthrough plus lab user test identified multiple security UI design flaws
- Argues security usability demands domain-specific design principles, not consumer software standards
- Foundational work that shaped the usable security research field
- Products
- PGP 5.0
From the original article
14 min read at usenix.orgUser errors cause or contribute to most computer security failures, yet user interfaces for security still tend to be clumsy, confusing, or near-nonexistent. Is this simply due to a failure to apply standard user
By usenix.org via typesanitizer · usenix.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.