# Getting Rid of the Usability/Security Trade-Off: A Behavioral Approach
## 3 Usable Security
The consequences of mismanagement of this trade-off could result in procedures that are either at high risk of violation or, conversely, too complex. In the latter case, the excessive effort to engage in secure behaviors could lead to the emergence of less secure alternative behaviors [25]. Within companies and organizations, all these processes, which ensure information security, are designed according to a top-down perspective, generating security policies that are not centered on the end-users. Therefore, they obtain the paradoxical effect of being ignored by users who, while adhering to the policies, would perform their tasks with difficulty. In contrast, a desirable approach to ensuring usable security should be to understand the user's behaviors to generate viable security practices [26, 27]. For example, [PERSON] and colleagues studied the effect of habituation on security dialogue boxes, which leads users to ignore important messages due to repeated exposure to these dialogues. The user reports reading them (by automatically pressing a button) but without paying attention to the content [28, 29]. It seems clear that a \"fulfillment\" mode to the design of security features (i.e., security alerts must be presented, and the user must report having read them) does not work because it does not consider processes that involve the interaction between the system and the individual with their human characteristics, such as, in this case, the process of habituation to repeated stimulation. One of the most studied topics in usable security is the problem of passwords, which are constantly between usability and security. Interfaces for password creation and entry are the most implemented authentication methods in modern systems. Hundreds of thousands of websites and applications require users to enter a password to access a system [30]. The goal of passwords is twofold: the first is the security goal, which requires passwords to be complex, unique, and difficult enough to not allow hackers to identify them; the second is the usability goal, which requires passwords to be easy enough for the user to remember them [31, 32]. Nowadays, many online services request the adoption of passwords that have a certain degree of complexity (e.g., use at least one capital letter, a number, and a special character and are at least eight characters long), and security policies in organizations often demand password replacement after a certain time interval. Moreover, policies often require the user to use different passwords for different systems. They suggest not using the same password to access multiple services and storing the login credentials in a place inaccessible to others. Once again, this is an example of a top-down policy that is not based on a user-centered design rationale. When users feel overwhelmed by the system demands, they could dismiss the system itself [25]. People seem to carry out a cost-benefit analysis associated with safe behaviors [33]. Users will avoid spending too much cognitive and temporal resources on security if the perceived benefits are too low [34]. Consequently, system usability becomes a critical factor when analyzing why people behave unsafely in cyberspace [35]. Indeed, while ease of use seems to be correlated with security weakness, more secure systems are difficult to use. The challenge is to bring together security and usability, which are usually perceived as mutually exclusive [22]. In contrast to other contexts where usability can be addressed as an independent goal when security solutions are developed, it is paramount that usability is evaluated in relation to it [36]. Mechanisms designed to ensure security should never restrict the user from performing the main task but should be designed to recognize human limitations and prevent users from dealing with unusable systems [37].