Listen: how to secure software by caring about humans, not security / Boing Boing

A powerful tool you can adopt when talking to users is cognitive walkthrough.

In essence, you ask them to tell you what they’re thinking as they’re thinking it. So, if you’re going to do a cognitive walkthrough for an encryption program, you might say, ‘I’d like you to encrypt this email message. Please tell me what you’re doing as you’re doing it and all of the thoughts that occur to you.’ You might hear someone say, ‘Oh, wow, okay, so I’m going to encrypt. I don’t really know what I’m doing. I’m going to start by pushing this button because that looks good. That’s green. I’m going to push that.’ You can really hear the thought process that people are going through.

If you’re in a more formal user study context, it can be useful to get the user’s consent to videotape—not necessarily the person, but the screen—and see what they’re doing because then you can play it for your colleagues. This is one of the most convincing ways you can make a case that your tool has problems or your tool needs improvement. Thus, just by videotaping people trying to use a tool and showing the challenges they face, you can identify ways to improve the user experience.

http://boingboing.net/2017/03/15/humans-are-the-point.html