Alice and Bob are Really Confused

User Experience Failures in Operational Cryptography

David Huerta examines the persistent disconnect between cryptographic tool design and the mental models of everyday users, activists, and journalists. Traditional operational security software often relies on hostile user interfaces, confusing terminology, and counterintuitive key management workflows that actively induce dangerous user errors.

Deconstructing the PGP Key Lifecycle

Huerta dissects the usability pitfalls inherent in the OpenPGP/GPG ecosystem, from key generation and subkey configuration to public key server distribution and web-of-trust validation. The cognitive overhead required to maintain and verify keys correctly causes even experienced security practitioners to make catastrophic operational mistakes.

Human-Centered Security Design Principles

The presentation demonstrates how security software can incorporate modern human-computer interaction (HCI) methodologies. By prioritizing empathetic UX design, eliminating cryptographic jargon, and providing clear, actionable warnings during security-critical decisions, developers can build tools that encourage safe behavior.

Fostering Accessible Privacy Tools

Huerta argues that security and privacy should be universal rights accessible to all users, not privileges reserved for technical elites. Designing accessible cryptographic interfaces requires continuous user testing with non-technical audiences, empathetic threat modeling, and moving past elitist assumptions in the hacker community.

(AI summary — Gemini 3.8 Flash)