Outrageous Opinion: Nothing We Do Can Improve Security

1
Outrageous OpinionNothing We Do Can Improve
Security

• Edward W. FeltenSecure Internet Programming
  LabDept. of Computer SciencePrinceton
  University

2
The Lesson of Anti-Lock Brakes

• Anti-lock brakes (ABS) were supposed tomake
  cars safer.But people with ABS just drove
  faster, and closer together.Result no real
  change in accident ratesUsers traded away
  safety for speed

3
Nothing We Do Can Improve Security

• Security mechanisms will always beconfigurable
  by users.Users trade off security vs.
  functionTypical user approachMaximum
  functionality good enough securityIf we
  provide better security, users willtrade it away
  for functionality.Ergo, security will not
  improve

4
ObjectionSecurity Isnt Good Enough Yet

• Not really an exception to the ruleturned
  off is a configuration choiceIf we improve
  base-level security, peoplewill find riskier
  uses for systemsInvariant most users operate
  at theragged edge of secure enough

5
                                                           

• Developers Make Tradeoffs Too

6
ObjectionWere Still Doing Good

• Even if users trade away security,
  theyretrading it for something they valueBut
  tradeoff makes it even harder tomeasure how
  were doingMaybe were actually doing a good
  job ?!?