+8.1 Usability
---+8.1.1 General Usability Considerations
---+8.1.2 Specific Usability Considerations
------+8.1.2.1 User Perspectives on Online Identity
------+8.1.2.2 User Perspectives of Trust and Benefits
------+8.1.2.3 User Mental Models and Beliefs
|
8.1 Usability
Ergonomics of Human-System Interaction — Part 11: Usability: Definitions and Concepts [ISO/IEC9241-11] defines usability as the “extent to which a system, product or service can be used by specified users to achieve specified goals with effectiveness, efficiency and satisfaction in a specified context of use.” This definition focuses on users, goals, and the context of use as the key elements necessary for achieving effectiveness, efficiency, and satisfaction. A holistic approach that considers these key elements is necessary to achieve usability. From a usability perspective, one of the major potential benefits of federated identity systems is to address the problem of user fatigue that is associated with managing multiple authenticators. While this has historically been a problem with usernames and passwords, the increasing need for users to manage many authenticators — whether physical or digital — presents a usability challenge. As stated in Sec. 8.1 of [SP800-63A] and Sec. 8.1 of [SP800-63B], overall user experience is critical to the success of digital identity systems. This is especially true for federated identity systems, as federation is a less familiar user interaction paradigm for many users. Users’ prior authentication experiences may influence their expectations. The overall user experience with federated identity systems should be as smooth and easy as possible for legitimate users. This can be accomplished by following usability standards (e.g., the ISO 25060 series of standards) and established best practices for user interaction design. Guidelines and considerations are described from the users’ perspective. Section 508 of the Rehabilitation Act of 1973 [Section508] was enacted to eliminate barriers in information technology and require federal agencies to make electronic and information technology accessible to people with disabilities. While these guidelines do not directly assert requirements from Section 508, identity service providers are expected to comply with Section 508 provisions. Beyond compliance with Section 508, federal agencies and their service providers are generally expected to design services and systems with the experiences of people with disabilities in mind to ensure that accessibility is prioritized throughout identity system life cycles.
1. Übersicht
| Bezeichnung |
Standard |
|
8.1.1 General Usability Considerations
|
Federated identity systems should:
Minimize user burden (e.g., frustration, learning curve)
Minimize the number of user actions required.
Allow users to quickly and easily select among multiple subscriber accounts with a single IdP. For example, an account chooser [ACCOUNT-CHOOSER] allows users to select from a list of subscriber accounts that they have accessed in the recent past rather than start the federation process by selecting their IdP from a list of potential IdPs. Balance minimizing user burden with the need to provide sufficient information to enable users to make informed decisions.
Minimize the use of unfamiliar technical jargon and details (e.g., users do not need to know the terms IdP and RP if the basic concepts are clearly explained, and users do not need to know the specific FAL value if its effects are clearly communicated).
Strive for a consistent and integrated user experience across the IdP and RP, particularly when in a single security domain.
Help users understand identity by providing resources, such as graphics, illustrations, frequently asked questions (FAQs), tutorials and examples. Resources should explain how users’ information is treated and how transacting parties (e.g., RPs, IdPs, proxies) relate to each other.
Provide clear, honest, and meaningful communications to users (i.e., communications should be explicit and easy to understand).
Provide users with online services that are independent of location and device.
Make trust relationships explicit to users to facilitate informed trust decisions. Trust relationships are often dynamic and context-dependent. Users may be more likely to trust some IdPs and RPs with certain attributes or transactions more than others. For example, users may be more hesitant to use federated identity systems on websites that contain valuable personal information (e.g., financial or health). Depending on the perceived sensitivity of users’ personal information, some users may be less comfortable with commercial IdPs since people often have concerns about advertising and the data usage of such companies. Conversely, some may have more confidence in commercial IdPs than in government IdPs based on a general mistrust of government services or because they are more familiar with commercial offerings. Either way, it is critical to be clear to end users about the entities involved in a federation transaction and, ideally, provide options that support the broadest set of stakeholder perceptions possible.
Follow the usability considerations specified in [SP800-63A] Sec. 8 for any user-facing information.
Clearly communicate how and where to acquire technical assistance. For example, provide users with a link to an online self-service feature, chat sessions, or a phone number for help desk support. Avoid redirecting users back and forth between transacting parties (e.g., RPs, IdPs, and proxies) to receive technical assistance.
Perform integrative and continuous usability evaluations with representative users and realistic tasks in an appropriate context to ensure the success of federated identity systems from the users’ perspectives.
|
|
8.1.2 Specific Usability Considerations
|
This section addresses the specific usability considerations that have been identified with federated identity systems. This section does not attempt to present exhaustive coverage of all usability factors related to federated identity systems. Rather, it is focused on the larger, more pervasive themes in the usability literature, primarily users’ perspectives on identity, user adoption, trust, and perceptions of federated identity space. In some cases, implementation examples are provided. However, specific solutions are not prescribed. The implementations mentioned are examples to encourage innovative technological approaches addressing specific usability needs. See standards for system design and coding, specifications, APIs, and current best practices for additional examples. Implementations are sensitive to many factors that prevent a one-size-fits-all solution.
|
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
- NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.
DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.
|