[thelist] Security & general user acceptance

[Maurice Hendriks]

Dear Evolters,

I am working on a new site and a fairly new concept that involves online
highly confidential legal documents. Does anyone have experience / knowledge
in regards to general user acceptance, i.e. what does Joe Bloggs perceive as
being secure?  A secure site is always susceptible to intruders.

SSL will be functional throughout the entire site. I have been recommended
to not deal with VeriSign because they are very expensive, and alternative
solutions are available and cheaper. My experience is that VeriSign is a
reliable and respected provider of secure solutions. Is this your opinion as
well?
I avoid using email, as email without added security such as PGP is very
un-secure. Username and passwords can be retrieved by completing a list of
keywords specific to each user.

Adding a thick layer of secure functionality's (such as digital signatures
and additional software on local machines) will scare users away, especially
our audience who are legal practitioners who are reluctant to use IT related
technologies such as online services.

Where is the balance? Any tips?

<quote>
'A fence only keeps out the good people'
</quote>