More Than Skin Deep: Measuring Effects of the Underlying Model on Access-control System Usability

Robert W. Reeder, Lujo Bauer, Lorrie F. Cranor, Michael K. Reiter, Kami Vaniea

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract / Description of output

In access-control systems, policy rules conflict when they prescribe different decisions (allow or deny) for the same access. We present the results of a user study that demonstrates the significant impact of conflict-resolution method on policy-authoring usability. In our study of 54 participants, varying the conflict-resolution method yielded statistically significant differences in accuracy in five of the six tasks we tested, including differences in accuracy rates of up to 78%. Our results suggest that a conflict-resolution method favoring rules of smaller scope over rules of larger scope is more usable than the Microsoft Windows operating system's method of favoring deny rules over allow rules. Perhaps more importantly, our results demonstrate that even seemingly small changes to a system's semantics can fundamentally affect the system's usability in ways that are beyond the power of user interfaces to correct.
Original languageEnglish
Title of host publicationProceedings of the SIGCHI Conference on Human Factors in Computing Systems
Place of PublicationNew York, NY, USA
Number of pages10
ISBN (Print)978-1-4503-0228-9
Publication statusPublished - 2011

Keywords / Materials (for Non-textual outputs)

  • access control, home computing, human factors, privacy, security


Dive into the research topics of 'More Than Skin Deep: Measuring Effects of the Underlying Model on Access-control System Usability'. Together they form a unique fingerprint.

Cite this