“Security breaks usability”

Reality: Most security has no interface to break.

Crumple zones, collapsible steering columns, and safety glass changed nothing a driver touches. Removing a class of coding error is the same: invisible to users, expensive for attackers.

As for the features users do complain about, ask what that development team had. A UX expert? A mandate to refine it on usage data, like every other feature?

The real tradeoff isn't security vs. usability. It's shortcuts vs. craftsmanship.

Discussion prompts

• Which security work in your product has no user-facing surface at all?
• When has a security feature led to a better user experience in your products?
• What would it take to make your most painful security friction point invisible to users?