CWE-655 — Insufficient Psychological Acceptability
CWE-655: Insufficient Psychological Acceptability
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Class |
| Status | Draft |
| Likelihood of exploit | — |
Description
The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.
Common consequences
- Access Control: Bypass Protection Mechanism
Mitigations
Testing — Where possible, perform human factors and usability studies to identify where your product's security mechanisms are difficult to use, and why.
Architecture and Design — Make the security mechanism as seamless as possible, while also providing the user with sufficient details when a security decision produces unexpected results.
References
- CWE page: https://cwe.mitre.org/data/definitions/655.html
- CWE list: https://cwe.mitre.org/data/index.html