1999 study finds PGP 5.0 unusable for cryptography novices despite good UI design

The 1999 paper 'Why Johnny Can't Encrypt' presents a usability evaluation of PGP 5.0, a cryptographic tool with a graphical user interface. The study employed cognitive walkthrough analysis and laboratory user testing to assess whether novices could effectively use the software for email security. The results were stark: despite the interface being considered well-designed by general standards, most participants failed to complete basic encryption tasks within the allotted time. This suggests that even intuitive interfaces may not bridge the gap between complex security mechanisms and untrained users.

The authors argue that security software demands a different usability standard than general consumer applications. While automation and training can address some security challenges, they are insufficient for tasks like access control or key management, where user decisions directly impact security outcomes. The study posits that security usability is not merely about reducing errors but ensuring users can reliably perform critical actions without misunderstanding the underlying concepts. This distinction is crucial for engineers designing tools that require non-expert interaction.

The findings imply that security tools cannot rely solely on traditional UI design principles. The paper identifies properties unique to security, such as the need for users to understand abstract concepts like keys or encryption, that complicate usability. For engineers, this means that designing secure systems requires addressing usability as a core security concern, not an afterthought. The study’s conclusion, that PGP 5.0 was not usable enough for most users, serves as a cautionary tale for modern security tooling, where similar usability challenges persist.

The study’s methodology, combining cognitive walkthroughs and user testing, provides a framework for evaluating security usability. For engineers, this approach can be adapted to test whether new tools or protocols are accessible to their intended users. The paper also hints at ongoing work to develop domain-specific design principles for security, which could inform future tooling. However, the lack of follow-up studies in the provided material limits insights into whether these principles have been adopted or refined in the decades since.