History of Human-Computer Interaction and Usable Security
Introduction to Usable Security and Human-Computer Interaction (HCI)
Usable Security and Privacy is a specialized sub-discipline situated under the broader umbrella of Human-Computer Interaction (HCI).
The history of HCI represents a progressively greater attunement between machines and the human mind, leading to an increasing augmentation of human capacities.
Understanding the chronological development and key milestones of HCI provides a necessary foundation for studying how security can be made usable for people.
The Core Philosophy of HCI
The primary motivation driving computing forward is the concept that computers augment our abilities.
While physical tools extend physical abilities, computers are designed primarily to extend mental and cognitive abilities, allowing people to think more effectively than previously possible.
HCI is fundamentally defined as the practice of fitting computers to people.
The goal is to make computers speak the language of human goals. This involves creating systems that can anticipate what a user wants and communicate in a way that is understandable, allowing users to enhance their own capabilities through the machine.
HCI functions as both a science and an engineering discipline:
As a science, it studies how people use computers and investigates methods to improve that interaction.
As an engineering discipline, it applies scientific principles to create more usable systems.
Historical Origins: World War II and Human Factors
The modern origins of HCI emerged around World War II, driven by a specific military necessity regarding aviation.
Prior to this era, the military could be highly selective, choosing only individuals with exceptional spatial and perceptual abilities to be pilots. These gifted individuals could learn to operate almost any complex system.
In the 1940s, the demand for pilots increased dramatically. The goal shifted to designing airplane controls so that nearly anyone could fly a plane with sufficient training.
This era birthed the fields of Human Factors and Ergonomics, which formalized the study of designing systems for human use.
Fitts's Law and Interface Design
One of the earliest and most enduring findings in HCI is Fitts's Law.
Fitts's Law states that the time required to move to a target depends on the target's size and its position (distance).
A famous implementation of this law is the Windows Start button. By placing the button in the bottom corner of the screen, the target effectively becomes infinitely large. A user can whip their hand down toward the corner and be guaranteed to hit the target accurately without precise aiming.
When the Start button was moved toward the center in more recent versions of the OS, it caused user frustration because it removed this "infinite target" benefit.
The Cognitive Revolution and HCI
There is a deep, historical connection between HCI and Cognitive Science, both of which began taking shape in the 1940s.
The Paradigm Shift from Behaviorism to Cognitivism:
Behaviorism: Prior to the cognitive revolution, scientists focused on stimulus and response. It was believed that rewards and punishments dictated behavior, and the internal workings of the mind were considered irrelevant or unobservable.
Cognitive Revolution: Scientists began to posit that internal processing significantly affects behavior. Researchers started viewing the mind as a machine with parts and functions that could be studied to deepen the understanding of human nature.
Key Cognitive Science Models in HCI:
Broadbent’s Early Filter Model: Describes how the mind filters information.
The Magic Number Seven: The finding that humans have a hard limit on working memory, typically holding only items at once. If a computer interface requires a user to hold 12 items in their head simultaneously, the system is fundamentally designed for failure.
The Era of Punch Cards (1960s)
In the 1960s, interaction with computers was extremely non-interactive.
Programs were written on stacks of punch cards and fed into massive machines.
The execution process took a very long time (e.g., six hours). If a bug was found after completion, the user had to fix the card and wait another six hours for the results.
During this time, only one user was allowed to use the machine at a time.
Licklider’s Vision of Man-Computer Symbiosis (1960)
In 1960, J.C.R. Licklider published a strikingly predictive paper describing a more interactive future for computing.
Key Predictions:
Computers should help users explore hypotheses and identify problems.
Computers should offload "menial" routine work. Licklider estimated that as a scientist, of his time was spent on menial tasks like finding literature, calculating, generating graphs, and filing. He argued computers are better suited for these tasks, freeing humans to make higher-level decisions.
Moving from long waits (like punch cards) to real-time collaboration between human and machine.
The creation of a shared language based on user goals.
The Blending of Human and Machine: Licklider envisioned an arrangement where human and computer operations blend so completely that they cannot be separated. This is analogous to how modern users interact with Large Language Models (LLMs), where the computer suggests actions that align with the user's intuitive judgment.
Early Interactive Systems (1960s)
Sketchpad (1962):
Developed by Ivan Sutherland, this was the first system to feature a "window."
It allowed users to draw on a virtual sheet of paper (theoretically a third of a mile wide).
It used non-procedural programming to solve complex constraints. For example, a user could sketch rough lines and command the system to make them parallel or perpendicular, and the system would perform the calculations.
NLS (1968):
Developed by Douglas Engelbart and known as the "Mother of All Demos."
It featured the first demonstration of the computer mouse, hypertext, multiple windows, graphics, real-time editing, and video conferencing.
It was the result of extensive user testing and study of how people work.
The Unix Revolution (1969)
Unix replaced the punch card paradigm by introducing multi-user capabilities and instant feedback.
Innovations:
Users could issue small commands and get immediate feedback.
Scripts were written in the same language as individual commands, making efficient use of memory and mental effort.
Piping: This allowed users to string together simple commands to create complex programs. This is analogous to human problem-solving, where a complex task is broken into smaller components and chained together.
Legacy: Unix remains the foundation for modern computing. Linux is a free clone of Unix. macOS is officially certified Unix, and iPhones run on Unix. Android runs on a Linux kernel.
Xerox PARC and the Graphical User Interface (GUI)
The Palo Alto Research Center (PARC) developed the modern graphical system in the 1970s and 80s.
The Alto: A research-only machine that featured a bitmap display. Unlike previous systems limited to a set character set, a bitmap display allows the machine to draw pixels and show any arbitrary image.
Smalltalk: This application was the debut of the WIMP paradigm: Windows, Icons, Menus, and Pointer.
The Xerox Star (1981):
The debut of the desktop operating system metaphor.
It used icons to represent files and folders and supported drag-and-drop operations.
The core idea was that objects on the screen should behave like objects in a physical office so users could intuitively understand interactions.
Despite its innovation (including multilingual and multimedia features), it was a commercial failure due to its high cost.
Direct Manipulation and the Apple Macintosh
Direct Manipulation: A paradigm where users treat screen objects like real-world entities—grabbing things, adjusting sliders, and resizing windows directly instead of typing textual commands.
Apple Macintosh (1984):
Apple visited Xerox, saw the Alto and the mouse, and developed their own version.
The Macintosh brought the WIMP interface to an affordable price point ( in 1984).
Apple's marketing emphasized human factors: "Why don't we teach a computer how people work instead of teaching people how computers work?"
The mouse was marketed as an extension of the user's finger.
The Formalization of HCI (1982)
HCI formally emerged as a field in 1982 with the first SIGCHI conference (commonly called CHI).
The 1983 book The Psychology of Human-Computer Interaction established the field as an applied psychology, using cognitive science to study user-computer interactions.
Cognitive Engineering: Influential figures like Don Norman and Jens Rasmussen applied psychology to design. Norman's "perception-action loop" describes how users achieve goals by checking available actions, executing them, and evaluating the result against their goals.
Mental Models: The theory that people build internal simulations of how external systems work. Mistakes occur when there is a mismatch between the user's mental model and the system's actual model. Designers should ensure systems allow users to build a model consistent with reality.
The Evolution of the Web and Search
The World Wide Web democratized information, moving research from the physical library to the home.
Mosaic (later Netscape Navigator) was the first browser to make web browsing user-friendly.
Google Search: Prior search engines required complex syntax. Google succeeded by allowing users to ask questions intuitively. The system understood the way people actually ask for information, making it instantly superior to competitors.
Smartphones and Modern HCI
Smartphones (2008): The iPhone introduced a major shift away from the desktop metaphor.
It utilized direct manipulation with the finger rather than a mouse.
It removed peripherals and became context-aware (location, orientation).
Key interactions, like scrolling through a list with a finger, were designed to be so natural and perfect that they were met with immediate widespread approval.
Large Language Models (LLMs): We are currently at the beginning of an LLM takeover. These systems close the "gulf" between computers and users because they genuinely understand human goals expressed in natural language.
Usability in Security
The first mention of usable security dates back to a 1977 paper, The Protection of Information in Computer Systems (Saltzer and Schroeder), stating that for security mechanisms to be effective, they must be usable.
While primary tasks (email, browsing) have become highly usable, security goals often lack usability.
The Identity Indicator Problem:
Browsers used Extended Validation (EV) certificates to verify website ownership.
The browser would display the legal name of the organization (e.g., BNZ for Bank of New Zealand) next to the URL.
Studies showed that users generally ignored or misunderstood this information. Because it failed to communicate effectively, most browsers eventually removed these indicators.
Questions & Discussion
Question regarding the necessity of informing users about security: Is it necessary to tell the user how to stay secure if we could guarantee only secure things happen?
Response: If we could guarantee security, user intervention wouldn't be necessary. However, there are many "in-between" cases where the system cannot prevent an action, so it must support the user in making an informed choice. Currently, many security choices are not informed because they are presented in a way that users cannot possibly understand. Our lives are more enmeshed in networked systems now than in 1994, which increases the attack surface and makes usable security research critical.
Question regarding administrative tasks: Is there a code for sign-up or a session code for today?
Response: There is no session code or tutorial today. Today consists only of the lecture. The schedule should be ignored regarding tutorials today; they will begin tomorrow.