Usable security research to date has focused on making
users more secure, by identifying and addressing usability
issues that lead users to making mistakes, or by persuading
users to pay attention to security and make secure choices.
However, security goals were set by security experts, who
were unaware that users often have other priorities and
value security differently. In this paper, we present examples
of circumventions and non-adoption of secure systems
designed under this paternalistic mindset. We argue that
security experts need to identify user values and deliver
on them. To do that, we need a methodological framework
that can conceptualise values and identify those that impact
user engagement with security. We show that (a) engagement
with, and adherence to security, are mediated by user
values, and that (b) it is necessary to model those values
to understand the nature of security’s failures and to design
viable alternatives