Data Level Protection
Interface design and security
Software interface design can make software easier to use, but some features that save time or protect privacy can also reduce security. A designer has to weigh up how convenient a feature is against the risk it creates.
| Feature | How it helps | How it can reduce security |
|---|---|---|
| Obscuring data entry | Hides characters as they are typed, so people nearby cannot read sensitive data | The user cannot check what they typed, so errors go unnoticed |
| Autocomplete | Stores data entered before and offers it again, speeding up forms | On a shared or stolen device it can reveal sensitive information |
| Stay logged in | Keeps you signed in after closing the browser or app | Anyone with access to the device may be able to use your account |
Obscuring data entry
When a field is obscured, each character usually shows as a dot or an asterisk, so a password or PIN is not visible to the person standing behind you. The trade-off is that you cannot spot your own typing mistakes: a player signing in to a games console cannot see that they mistyped their password, and repeated failed attempts can lock the account. Obscuring only hides the characters on screen; it does not encrypt the data.
Autocomplete
Autocomplete remembers values typed into a form, such as a name, email address or postcode, and suggests them again, for example a shopping app offering an address you used last year. This is quick and reduces typing errors, but the saved list sits on the device. If that device is shared with other people, or is lost, the suggestions can expose personal details that were never meant to be seen again.
'Stay logged in'
A 'stay logged in' option keeps an account signed in after the browser or app is closed, so you avoid retyping a password each time. The risk is that the device stays trusted. On a family tablet that is passed around, or a device that is stolen, the next person to open the app may find the account already open and usable.
Practise this
Pearson BTEC Digital Information Technology · Data level protection