Re: [TLS] EU cards

[Peter Gutmann <[e-mail]>]

"Blumenthal, Uri - 0668 - MITLL" <[e-mail]> writes:

>Have you used CAC?

My own experience with CAC (or other smart card/PKI technology) is totally
non-representative of typical end users, which makes me useless for
determining how typical users deal would with it.  This is why I go to end
users for feedback, or reference studies of end users performed by others.

>Then what do you know about how they suck or not?

By talking to end users?  A rather novel concept, I agree, but quite useful
for assessing the impact of something.

>I on the other hand have been using them for quite a while -

You're about as representative of typical end users as I am.  Whether you or I
can use them is largely irrelevant, because we're not typical users.  This is
something that the usability study that I referenced took pains to point out,
the people deploying the technology were incapable of understanding that just
because they managed to use it didn't mean that a normal user could.  In fact
when the paper was peer-reviewed, other security researchers had trouble
believing the empirical results obtained because it couldn't possibly take
users that long to obtain and configure a certificate ("I'm sorry but your
facts just don't support our theory").  The researchers who set up the study
had themselves managed to complete the task in two-and-a-half minutes.  The
test users (IT professionals who were given screenshot-by-screenshot paint-by-
numbers instructions showing them what to do) took two hours and twenty
minutes, and rated it as the hardest computer task they'd ever been asked to
perform.  That's about how representative you and I are of real-world users.

It's funny, there seems to be quite some dissatisfaction with CAC out there,
but no-one wants to talk about it in public because they'd risk losing face,
or government money, or both, if they did.  Within a few hours of my "Man,
that stuff SUCKS!" post I got three off-list responses from people who'd
worked with it which included comments like "When we rolled out CAC, our
support costs skyrocketed. It cost us more to support the damn thing than to
roll it out" (quoted verbatim from email).

Peter.