Security intent not reflected in system response
Security intent not reflected in system response
Enterprise
Security UX
Intent Mapping
Observation
Observation
What I Noticed
What I Noticed
What I Noticed
Google device and session management gives users two distinct options when reviewing account activity. They represent different levels of concern. One is routine maintenance: signing out of an old or recognised session. The other signals something more serious: the user does not recognise the device accessing their account.
Despite that difference in intent, both paths lead to almost the same response: sign out of the device and consider changing the password. The actions are labelled differently, but the system does not meaningfully change its response based on the level of concern the user expressed.
Google device and session management gives users two distinct options when reviewing account activity. They represent different levels of concern. One is routine maintenance: signing out of an old or recognised session. The other signals something more serious: the user does not recognise the device accessing their account.
Despite that difference in intent, both paths lead to almost the same response: sign out of the device and consider changing the password. The actions are labelled differently, but the system does not meaningfully change its response based on the level of concern the user expressed.
Scenarios
Scenarios
The Flow Collapse
The Flow Collapse
The Flow Collapse
Sign out
Sign out
Sign out
Sign out of device
Sign out of device
→
Sign out + suggest password change
Sign out + suggest password change
Routine account maintenance
Routine account maintenance
↓
Sign out of device
Sign out + suggest password change
Do not recognise this device
Do not recognise this device
Do not recognise this device
Don't recognise this device
Don't recognise this device
→
→
Sign out + suggest password change
Sign out + suggest password change
↓
Potential security concern, nearly the same resolution
Potential security concern, nearly the same resolution
Two different levels of concern. One generic resolution. No differentiated investigation path.
Two different levels of concern. One generic resolution. No differentiated investigation path.
Two different levels of concern. One generic resolution. No differentiated investigation path.
The Core Finding
The Core Finding
The Core Finding
When a user flags an unrecognised device, they are communicating more than an action. They are communicating risk. The interface acknowledges that concern in the label, but the response collapses it back into almost the same flow used for routine session management.
When a user flags an unrecognised device, they are communicating more than an action. They are communicating risk. The interface acknowledges that concern in the label, but the response collapses it back into almost the same flow used for routine session management.
When a user flags an unrecognised device, they are communicating more than an action. They are communicating risk. The interface acknowledges that concern in the label, but the response collapses it back into almost the same flow used for routine session management.
Reason
Reason
Why It Matters
Why It Matters
Why It Matters
Security interfaces are where user trust is most fragile. A user flagging an unrecognised device may be dealing with a potential security incident, not simply cleaning up an old session. Ending the interaction with a generic recommendation closes the immediate action, but it does not fully resolve the user’s uncertainty about what happened or what they should do next. The system response should reflect the level of concern the user expressed.
Security interfaces are where user trust is most fragile. A user flagging an unrecognised device may be dealing with a potential security incident, not simply cleaning up an old session. Ending the interaction with a generic recommendation closes the immediate action, but it does not fully resolve the user’s uncertainty about what happened or what they should do next. The system response should reflect the level of concern the user expressed.
Recommendation
Recommendation
What I Would Change
What I Would Change
What I Would Change
Give the unrecognised-device flow its own investigation path
Give the unrecognised-device flow its own investigation path
Give the unrecognised-device flow its own investigation path
