Bridging the Gap Between Usable Security Research and Open-Source Practice — Lessons From a Long-Term Engagement With VeraCrypt

Research Background and Issues

• What problems or challenges did the authors identify?
  This study identifies significant usability issues with VeraCrypt, an open-source encryption tool. In particular, the setup process for device encryption is overly complex for non-technical users, resulting in participants taking a long time to complete tasks or failing entirely. Experimental data show that participants took significantly longer to complete encryption tasks using VeraCrypt compared to its proprietary counterparts (e.g., Apple FileVault and Microsoft BitLocker). Many options caused confusion, such as selecting encryption algorithms and creating rescue disks.

• Why is this issue important?
  Device encryption is a critical method for protecting data privacy, but complex user interfaces reduce adoption and success rates among average users. Improving the usability of these tools can help non-technical users protect their data more easily, thereby reducing security vulnerabilities. Moreover, usability is closely tied to security in such tools, as it minimizes the likelihood of user errors.

• Research Motivation and Related Work
  Although the community and academic research have long recognized the usability issues of cryptographic tools (e.g., the challenges highlighted in Why Johnny Can't Encrypt), there is little empirical research on how to translate these findings into real-world open-source practices. Previous studies on VeraCrypt's predecessor, TrueCrypt, have already indicated concerns about interface complexity, and VeraCrypt has become even more complex. This study aims to explore the process of translating academic findings into open-source community practices through a four-year longitudinal case study, addressing the barriers to achieving this goal.

Solutions

• What methods or solutions did the authors propose?
  The authors designed a series of improvements based on user research and cognitive analysis, including redesigning the user interface (UI) and enhancing documentation readability. They also introduced more secure default configuration options, reduced unnecessary user decisions, and hid complex options to simplify the workflow.

• What is innovative about this solution?
  The innovation lies in combining user research with security standards (e.g., using AES and SHA-512 as default encryption and hashing algorithms) to propose specific design improvements. Additionally, this project uniquely attempts to apply academic usability recommendations to open-source software practices, which is a relatively underexplored area.

• What are the implementation steps and key techniques used?

  1. User Experiments (US-1, US-2, US-3): The experiments were conducted in phases to evaluate the usability of the original and redesigned UIs.
     • The Think-Aloud method was used to understand users' thought processes when facing challenges.
     • A user feedback button was provided to capture failure points and design bottlenecks.
  2. UI Redesign: Removed unnecessary pages (e.g., the mouse random movement page), set default encryption algorithm options, added beginner guidance pages, and included checklists to reduce operational risks.
  3. Community Interaction and Code Improvements: Submitted code improvement suggestions (Pull Requests, PRs) to the VeraCrypt community and engaged in discussions. Security experts from the industry were involved to help implement the technical changes.
  4. Compilation Support: Created a compilation guide to lower the entry barrier for developers contributing to the open-source project.

Research Outcomes

• What specific outcomes were achieved?

  1. The redesigned interface reduced the time required for users to set up device encryption by nearly 50%, and the success rate of completing tasks increased from 2/21 to 14/21.
  2. A more user-friendly version of the interface was implemented, along with the submission of five related PRs to the community.
  3. A compilation guide was published, significantly improving the feasibility of developers compiling the latest version of VeraCrypt.

• What advantages does it have compared to existing solutions?
  The proposed design significantly reduced users' time and learning costs while improving user experience scores. The provided compilation guide was also regarded as a valuable contribution by the community and project maintainers.

• What were the experimental or evaluation results?

  • In the third user study (US-3), although the new UI improved task efficiency, the rescue disk creation page, which was not modified, still consumed a significant amount of time and caused confusion.
  • Task completion times were significantly reduced, and success rates further improved.
  • The average usability score (SUS) increased from 53/100 to 81/100.

• Limitations and Future Directions

  • Limitations:
    1. The community expressed concerns about the potential security impact of usability improvements (e.g., issues related to random entropy).
    2. The PRs were not merged into the main branch due to code complexity and lack of trust, with modifications archived in a separate branch.
    3. The user study sample size was limited and lacked diversity, being primarily composed of students.
  • Future Directions:
    1. Explore generalizable patterns for reducing barriers to translating academic findings into practice through collaborations with other open-source communities.
    2. Develop stronger communication frameworks to align goals with OSS communities and address trust and security belief discrepancies.
    3. Redesign the code architecture to improve overall code quality, including front-end and back-end separation.

Through this four-year case study, the authors revealed the gap between academic research and open-source practice while proposing targeted improvement recommendations. This provides valuable insights for future researchers and practitioners in areas such as collaborative goal-setting, process transparency, and strategies for developer engagement.