I carry no phone An aspiring Luddite In a wired world. Mastodon Verification Link	Jeff Berry is an early adopter of the Internet and the Web, a late adopter of Twitter, and declines to adopt Facebook. With the death of Google+, he migrated to the Fediverse. He admins a medievalist Mastodon instance. He hates cell-phones.

Which brings us to another important point about security and convenience. While they are always going to involve a trade-off, some of the trade-offs are far more worth-while than others. Locking your front door seems like a fairly minimal decrease in convenience for a fairly significant increase in security, for instance.

What this means, naturally enough, is that we are searching for that point where we can live with the amount of insecurity and have enough convenience to keep us happy. Sometimes, someone else makes that decision for you, and if their idea of the sweet spot on the curve doesn't match with yours, then you tend to get cranky. At least, I certainly do. This is the case at many institutions where passwords need to be of a certain length and complexity, and might need to be changed every sixty days. If you think that's overkill, the policy annoys you.

And so we come to the real problem, articulated very nicely in this XKCD comic, to wit: when actual increase in security does not match perceived increase in security, bad things happen. Bad things can happen in one of two ways, both of them, well, bad.

If the security improvement is not perceived as sufficient to balance the decrease in convenience, it's hard to convince people to do it. For years, this was the problem with virus-scanners, and still is to some extent to this very day. Virus scanners can break other software, and if you think that other software is "mission critical" (or mission convenient enough), you don't run the scanner.

The flip-side is when the perceived security increase is greater than it is, such as in the XKCD example. Another prime example of this is the tendency of many Mac users to feel like they don't need to worry because Macs are "secure." That they are, perhaps, more secure than Windows is true, but that does not make them "secure" in any absolute sense. Mac users are waking up to this problem and starting to take security a bit more seriously, which is comforting. Linux users have, in some cases, now taken over as the "security-through-obscurity" flag-bearers, and as Linux becomes more and more available and more ready for prime-time, they'll come under attack more and more often ...

None of the above is particularly earth-shattering. False-sense of security - bad. Underestimating the threat - also bad. Computer security, generally I would say, tends to fall on the more-convenience rather than more-security side of the over-reaction scale. Perhaps it is because the threat seems distant. Perhaps it's because, as a species, we aren't particularly good at analyzing long-term and somewhat abstract risk. Perhaps it is because the risk seems, like so many things on the Intarwebz, not quite real. Perhaps it's just that we're not good at probability analysis, as the thriving lottery industry would suggest.

I invite you now to think about the above in terms of the real world. Here, I think, we tend to err on the side of too much, and in some cases, massively too much, lack of convenience in favor of incremental or non-existent increase in security - and, yes, the TSA screening policies are the first thing that comes to mind. How much safer are we now that we have to take off our shoes before going through a scanner? Does the fact that my wife had the nail file broken off her nail clipper before she could take it on the plane contribute measurably to national security? Inconvenient, to be sure! More secure? I wonder ... Here, is it because the stakes are higher that we over-react? Death, after all is on the line ...

But, in 2008 (according to the US Census Bureau), there were 39,000 US motor vehicle related fatalities. (Stats are here) There were no US airline fatalities. But still we speed on the highways. So it's not just "death on the line" at play. It's perception of risk, perception of security and perception of convenience.

Drive safely ...