CWE-655: Insufficient Psychological Acceptability

What is Insufficient Psychological Acceptability?

• Overview: Insufficient Psychological Acceptability occurs when security features in a software product are too difficult or inconvenient for users, leading them to disable or bypass these features intentionally or unintentionally.

• Exploitation Methods:

Attackers may exploit this vulnerability by predicting that users will disable security mechanisms, thus gaining easier access to the system.
Common attack patterns include social engineering tactics that encourage users to bypass security protocols or exploiting known weaknesses in systems where security is often disabled.

• Security Impact:

Direct consequences include users inadvertently leaving systems more exposed by disabling protective features.
Potential cascading effects include an increased attack surface, making it easier for attackers to compromise other parts of the system.
Business impact can range from data breaches to loss of customer trust and potential legal liabilities.

• Prevention Guidelines:

Code-level fixes might involve simplifying user interfaces to make security features more accessible and less intrusive.
Security best practices include user experience testing on security features to ensure they are intuitive and do not hinder regular use.
Recommended tools and frameworks might involve using user behavior analytics tools to understand how users interact with security features and adjusting accordingly.

Corgea can automatically detect and fix Insufficient Psychological Acceptability in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

// This code enforces a complex CAPTCHA that is difficult for users to solve, causing frustration.
// The CAPTCHA is a static string that users must match exactly, making it challenging and not user-friendly.
function verifyCaptcha(userInput) {
    const captchaCode = "3xYz7wQ"; // Complex static CAPTCHA
    return userInput === captchaCode;
}

// Usage example
console.log(verifyCaptcha("3xYz7wQ")); // Returns true, but users find it hard to solve due to complexity

How to fix Insufficient Psychological Acceptability?

The issue here is a CAPTCHA mechanism that is too hard for users to solve, leading to frustration and potential circumvention. A balance is needed between security and user experience.

Fix Approach:

Use a Human-Friendly CAPTCHA: Implement CAPTCHAs that are easy for humans but hard for bots, such as image-based or simple math challenges.
Alternative Solutions: Consider using behavioral analysis or invisible CAPTCHAs that do not require user interaction but still verify human presence.

Fixed Code Example

// This code implements a user-friendly CAPTCHA system using simple math problems.
// This approach balances security and usability, reducing user frustration while still preventing automated attacks.
function generateCaptcha() {
    const num1 = Math.floor(Math.random() * 10);
    const num2 = Math.floor(Math.random() * 10);
    return {
        question: `What is \${num1} + \${num2}?`, // Simple math question
        answer: num1 + num2
    };
}

function verifyCaptcha(userInput, correctAnswer) {
    return parseInt(userInput) === correctAnswer; // Validates user input against the correct answer
}

// Usage example
const captcha = generateCaptcha();
console.log(captcha.question); // Outputs a simple question like "What is 3 + 5?"
console.log(verifyCaptcha("8", captcha.answer)); // Returns true, easy for users to solve

The fixed code examples demonstrate how to create security mechanisms that are effective yet accessible, encouraging users to follow security best practices willingly rather than circumventing them due to frustration or difficulty. By using simple math problems, the CAPTCHA remains effective against bots while being user-friendly.