Table 4.1 | Who Goes There? Authentication Through the Lens of Privacy | Committee on Authentication Technologies and Their Privacy Implications | Computer Science and Telecommunications Board | Division on Engineering and Physical Sciences | National Research Council of the National Academies | Stephen T. Kent and Lynette I. Millett, Editors

Principle	Practices
Build on what the user knows.	Do not tax the memory of users by having them learn too many new things. Use their words. Build the system interaction with a story or metaphor in mind that the user will easily understand.
Simplify.	Do not add features that aren’t useful. Package large feature sets in terms of clusters of things for a particular task, not jumbled together to cover all possibilities.
Allow users to do things in the order in which they think of them.	Do not make users do things in the order that the computer needs if it is different from what users would do naturally. (The computer can keep track of things better than the user can.)
Display information in clustered, meaningful visual displays.	Place things that go together conceptually near each other in the display and in an order that fits what users are trying to achieve.
Design for errors.	People make errors. Design so that errors are not costly to the user or difficult to correct. Allow each action to be undone once the user has seen the consequence of the error.
Pace the interaction so that the user is in control.	The user can be slow, but the system shouldn’t be. Slow reaction to a user action discourages acceptance of a technology.