Many people allow colleagues to 'impersonate' them to log on to computers and networks. Many people use the same PIN for multiple purposes. People decide for themselves what level of security they will accept. Design implications Don't assume that people follow your current security regime Find out what people do in the real world before devising a security system Don't try to impose an unrealistic security system. Consider allowing people to use their real names or email addresses Provide a mechanism for people to retrieve lost user names and passwords.
Humans are busy Most people have a task in mind when they approach a web site.
It is unlikely that they will be interested in watching a video or animation if it prevents them from completing their task. They may go elsewhere or abandon the task if it takes too long. It is not possible to quantify what 'too long' means. Design implications Don't assume that people follow your current security regime Find out what people do in the real world before devising a security system. In humans, no great evolutionary leaps have occurred in the last 10 years, nor are they likely in the next 10.