1. Outrageous Opinion: Nothing We Do Can Improve Security Edward W. Felten Secure Internet Programming Lab Dept. of Computer Science Princeton University

2. Anti-lock brakes (ABS) were supposed to make cars safer. But people with ABS just drove faster, and closer together. Result: no real change in accident rates Users traded away safety for speed The Lesson of Anti-Lock Brakes

3. Security mechanisms will always be configurable by users. Users trade off security vs. function Typical user approach: –Maximum functionality; “good enough” security If we provide better security, users will trade it away for functionality. Ergo, security will not improve Nothing We Do Can Improve Security

4. Objection: Security Isn’t “Good Enough” Yet Not really an exception to the rule –“turned off” is a configuration choice If we improve base-level security, people will find riskier uses for systems Invariant: most users operate at the ragged edge of “secure enough”

5. Developers Make Tradeoffs Too

6. Objection: We’re Still Doing Good Even if users trade away security, they’re trading it for something they value But: tradeoff makes it even harder to measure how we’re doing Maybe we’re actually doing a good job ?!?