Users are not ungrateful: Making sense of user resistance to well-intentioned innovation

We explore the paradox of users simultaneously complaining about the pain of passwords and at the same time rejecting user-centric prototypes of a more usable and more secure alternative. From our experience with the Pico project we distil unexpected insights about user inertia, mismatched user and researcher expectations, entrenched habits and ecological validity of user studies. The lessons learnt extend beyond authentication to any security usability initiative seeking real-world adoption.