Safe by design: the UX of secure banking
summary
Mobile banking authentication is reframed as continuous risk management rather than a fixed feature: device binding, biometrics, and PINs are combined into layered independent factors with progressive escalation so recovery uses the weakest adequate step. Real examples include Dropbox 2012 and Uber 2022 failures and competitor patterns like Revolut versus Wise. Design decisions reduce complexity by splitting flows into separated scenarios and implementing progressive assurance, which preserves availability while protecting confidentiality and integrity.
AI-written summary · about
chapters (21)
- 0:00Secure banking UX intro
- 1:32Authentication balancing security and usability
- 3:19CIA triad in banking auth
- 5:05Layered independent factors in auth
- 6:08Credential reuse risks
- 8:57Biometrics failure and recovery
- 12:35Biometric auth uncertainty
- 14:45Retries and lockouts vulnerabilities
- 17:13Device reinstall and binding loss
- 20:05Stress and secure access impact
- 22:13Cost of complex auth flows
- 26:31Wrong mental model in auth
- 27:36Auth as continuous risk management
- 31:05Risk tolerance and UX impact
- 33:17Security controls and UX coordination
- 33:59Designing for failure in security
- 35:24Roles in secure systems
- 39:38Adaptive authentication flows
- 42:45Key takeaways for secure design
- 45:17UX in security from start
- 47:27Security and human behavior
related talks
29mSecurity by(e) Design?
43mSecurity By Design
52mPhilosophizing Security In A "Mobile-First" World
22mGuarding the Gate: Strategies for High Security with Passkeys
42mChallenges in User Authentication: Balancing Security & User Experience
44m(in)Security is eating the world
28mAuthentication Digital Financial Services
24mState and Future Remote Authentication