One User, Many Hats; and, Sometimes, No Hat: Towards a Secure Yet Usable PDA

How can we design a PDA that is at the same time secure and usable? In current implementations the two properties are mutually exclusive. Because normal users find password entry inconvenient, the balance usually shifts away from security, leaving the PDA vulnerable if lost or stolen. We begin by envisaging what an ideal PDA authentication mechanism might look like and by carefully examining alternatives to passwords such as tokens and biometrics. We then expose another aspect of the security vs. usability problem. In many cases, when we turn on our PDA, we only access functionality (dictionary, calculator, web browser. . . ) that requires no access to private data stored in the machine; why, then, should we pay the usability penalty of authentication in such cases? Moreover, we may want to grant another person temporary access to such “harmless” functionality, but without being forced to grant them unrestricted access to the whole machine. To solve this problem we describe a syst...

• Type: Conference
• Year: 2004
• Where: SPW
• Authors: Frank Stajano
• Keywords: PDA Authentication Mechanism, Person Temporary Access, SPW 2004, Users find Password