INFO2222 Computing 2 Usability and Security

How INFO2222 is assessed

What INFO2222 covers

INFO2222 runs as two connected halves: Weeks 1-5 build human-computer interaction (usability goals, user-centred design, prototyping, evaluation and human factors), while Weeks 6-12 build computer security and cryptography (symmetric and public-key crypto, authentication, network and software/web security, and professional ethics and privacy).

Every week feeds the final exam, which is worth 50% and tests both halves as 40 multiple-answer questions with negative marking. Continuous in-class quizzes (best 5 of 10 = 10%) and a 40% team project round out the assessment.

Weeks 1-5 are human-computer interaction and usability — the six usability goals (effectiveness, efficiency, safety, utility, learnability, memorability), user experience, user-centred design, prototyping, usability evaluation and the human factors (perception, memory, Fitts' law, accessibility) that constrain any interface.

Weeks 6-12 are computer security and cryptography — Kerckhoff's principle and hashing, symmetric and public-key cryptography, Diffie-Hellman key exchange, identification and authentication, TCP/IP and TLS, software and web security (XSS, SQL injection, static/dynamic/symbolic analysis), and the professional and legal frame of IT ethics and data-privacy law.

The whole unit of study feeds the final exam, which is worth 50%: a supervised 80-minute (plus 10 minutes reading) closed-book bring-your-own-device Canvas quiz of 40 multiple-answer questions totalling 100 marks (30 questions at 2 marks and 10 at 4 marks), with negative marking, sat in the formal examination period.

Continuous assessment is a set of in-class quizzes worth 10% (only your best 5 of 10 count, at 2% each) and a three-phase group project worth 40% (Phase 1 5%, Phase 2 10%, Phase 3 25%). Two hurdles govern the unit: you must score at least 40% on the final exam and reach an overall mark of at least 50 to pass, and each project has a report hurdle.

Confirm every weight, hurdle and permitted-materials detail on Canvas and the USyd unit outline, since exact dates shift each year; a steady semester here also protects the Weighted Average Mark (WAM) that later computer-science units build on.

Worked example · free

Diffie-Hellman: two parties agree a key over a public channel

Key terms

Usability goals (the six)

The measurable qualities that make an interface good to use: effectiveness (does what it should), efficiency (supports the task well), safety (protects the user from dangerous or unwanted states), utility (offers the right functionality), learnability (easy to learn) and memorability (easy to remember once learned). Not all can be maximised at once — designers trade them off.

User-Centred Design (UCD)

A design approach that places the user at the centre of every activity. Its three Gould & Lewis (1985) principles are an early focus on users and tasks, empirical measurement of real users with prototypes, and iterative design. The cycle runs Requirements → Design alternatives → Prototyping (lo-fi/hi-fi) → Evaluation, looping back.

CIA triad

The three core security properties. Confidentiality — data is accessible only to authorised parties; Integrity — data cannot be altered undetected; Availability — the system stays usable by legitimate users. Cryptography adds authentication and non-repudiation on top.

Kerckhoff's principle

A system's security should rest on the secrecy of the key alone, not on the design staying hidden. Algorithms should be public and openly reviewed; only the key is secret. The opposite — hoping attackers never learn the mechanism — is 'security through obscurity' and is unsafe.

Diffie-Hellman key exchange

A protocol letting two parties agree a shared secret over a public channel. With public g and prime p, Alice sends A = g^a mod p and Bob sends B = g^b mod p; each derives K = g^(ab) mod p by raising the received value to its own secret. Security rests on the hardness of the Discrete Logarithm Problem; the secret is never transmitted.

SQL injection

A web attack where malicious SQL is inserted through user input that is concatenated straight into a query — e.g. entering alice' OR '1'='1 makes the WHERE clause always true and bypasses login. Defended with parameterised (prepared) statements and input validation/sanitisation, never string concatenation.

INFO2222 FAQ

Questions students ask in each INFO2222 chapter

Why does INFO2222 teach usability and security together?

Because real systems must be both, and the goals often conflict — a heavily locked-down interface can become unusable, while a friendly one can invite mistakes. The unit's running example is that a secure system must not let a misleading UI cause a person to authorise something harmful (the Bybit incident, where approvers trusted a UI display instead of verifying what they were signing). Learning both halves lets you reason about the trade-off rather than optimising one pillar and breaking the other. Chapter 01 · Usability and Security: The Two Pillars

What is the difference between usability and user experience?

Usability is about whether an interface is effective and efficient to use — measurable qualities like task time or error rate. User experience is the subjective, felt side: whether the product is enjoyable, engaging, satisfying, or on the negative side frustrating or patronising. A product can be usable but unpleasant, or delightful but hard to use; good design attends to both. This distinction is a common early-quiz item. Chapter 02 · User Experience and User-Centred Design

When should I use a low-fidelity versus a high-fidelity prototype?

Use low-fidelity early, when many questions are open: paper sketches and wireframes are cheap and fast to change, so you can explore and discard alternatives quickly and still get real user feedback. Move to high-fidelity as the open questions shrink and you need to test interaction detail or technical feasibility. High-fidelity is more resource-intensive and slower to modify, and there is a risk that users and management treat it as finished and are reluctant to criticise it. Chapter 03 · Design and Prototyping

How do I choose an evaluation method?

Work from the taxonomy and your constraints. If you can involve users in a controlled setting, use usability testing or a controlled experiment; if you want real-world behaviour, run a field study in natural settings; if you cannot recruit users, use analytical methods (inspection, heuristic evaluation, walkthroughs, models/analytics). Then weigh reliability, validity (internal vs external), bias, scope and ethics. Early lo-fi designs favour cheap inspection or think-aloud; near-final products favour comparative usability tests. Chapter 04 · Usability Evaluation

Do I need to memorise the Fitts' law equation or receptor frequencies?

No. The revision material is explicit that you will not be asked to write the Fitts' law equation, calculate statistics, or recall specific numbers, angles or frequencies (such as mechanoreceptor ranges). What you do need is the concepts and their design implications — larger, closer targets are faster; recognition beats recall; feedback should scale with the baseline stimulus (Weber's law). Confirm the exact scope in the Week 12 revision on Canvas. Chapter 05 · Human Factors and Accessibility

Why must encryption keys be uniformly random and high-entropy?

Because an attacker's job is to guess the key, and any bias or pattern shrinks the search. Uniform means no outcome is more likely than another; high-entropy means many possibilities (128 bits gives 2^128 options, whereas a 6-digit PIN is only about 20 bits and brute-forceable). The randomness must also be cryptographically secure — from a CSPRNG such as crypto.randomBytes() or /dev/urandom, never Math.random() or a timestamp, which are predictable given the seed. Chapter 06 · Cryptography Basics and Symmetric Crypto

Why do we need public-key cryptography at all?

Symmetric encryption and MACs require both parties to already share the same secret key, fully protected — but distributing that key, and managing a distinct key for every conversation pair, is a hard problem. Public-key cryptography solves it: you can publish an encryption (public) key so anyone can send you confidential messages, or use Diffie-Hellman so two parties derive a shared secret over an open channel without ever transmitting it. Chapter 07 · Public-Key Cryptography

What is the difference between identification and authentication?

Identification is the claim — you assert who you are, e.g. by entering a username, which must be unique, recognisable and persistent. Authentication is the proof — the system verifies the claim, needing proof of identity (something you know/have/are), a secure binding of that proof to the identity, resistance to spoofing, timeliness (recent or session-based), and privacy. Getting authentication right grants the corresponding privilege. Chapter 08 · Identification and Authentication

How does TCP guarantee ordered, reliable delivery over IP?

IP alone can lose, duplicate, corrupt or reorder packets. TCP numbers every byte with a sequence number and has the receiver acknowledge the next byte it expects, so the sender knows exactly what arrived and can retransmit anything missing. Out-of-order packets are reassembled by sequence number, corruption is caught by a checksum, and a window controls how much may be in flight before an acknowledgement is required. Chapter 09 · Network Security: TCP/IP and TLS

When should I use static, dynamic or symbolic analysis?

Use static analysis for structural and path-visible issues you can find without running the code — unused imports, obvious logic errors, potential division-by-zero — because it is fast and cheap. Use dynamic analysis for defects that only appear at runtime, such as memory leaks and crashes, by executing with instrumentation, but remember it needs good test inputs and an oracle. Use symbolic analysis when you need to reach a specific deep branch or prove a property: it collects path constraints and asks a solver for a witness input, at higher cost. Chapter 10 · Software and System Security

Why do SQL injection and XSS share the same root cause?

Both arise from trusting user input and letting it change how something is interpreted. In SQL injection, concatenated input becomes part of the query's structure; in XSS, unescaped input becomes executable markup in a page. The unifying principle is 'don't trust user input': validate it (expect data, not code) and, on output, either bind it as a parameter (SQL) or encode it to inert entities (HTML). Chapter 11 · Web Application Security

What are the ACS Code of Ethics core values?

There are six: the Primacy of the Public Interest (public good above personal or business interest), the Enhancement of Quality of Life (improve life for those affected by your work), Honesty (be truthful about your skills, services and products), Competence (work competently and diligently), Professional Development (grow your own and others' competence), and Professionalism (uphold and advance the profession's honour and integrity). Exam items usually describe a situation and ask which single value applies. Chapter 12 · Ethics, Privacy and Professional Responsibility

How to study for the exam

Treat INFO2222 as two linked subjects rather than one reading unit, and rehearse both every week instead of cramming through STUVAC.

For the Weeks 1-5 usability half, learn to apply and select rather than recite: be able to name the six usability goals, choose an evaluation method for a given constraint (with users vs without users; controlled vs natural vs analytical), justify a prototyping-fidelity choice, and reason qualitatively about Fitts' law and accessibility without writing any equation — the exam explicitly rewards understanding over recall.

For the Weeks 6-12 security half, drill the small mechanisms until they are automatic: a Diffie-Hellman shared-key computation, why a unique per-user salt forces per-user work on an attacker, the difference between the hash properties (pre-image, second-pre-image, collision resistance), the TLS and TCP handshakes in order, and how an SQL-injection or XSS payload works and is defended.

Because the final is 40 multiple-answer questions with negative marking, practise deciding when you actually know an option versus when you are guessing — on the 4-mark questions a wrong guess costs you. Build a one-page map linking each week to its examinable ideas and use it as your permitted A4 note sheet.

Keep up with the weekly in-class quizzes (best 5 of 10) and the three project phases, since the report hurdles and the exam hurdle both gate the unit. When a concept won't click, ask Sia to explain that single step a different way and set you a fresh practice question in the same style; it teaches the method and checks your reasoning, and never substitutes for your own graded work.

Confirm the exam date, permitted materials and hurdle rules on Canvas and the University of Sydney exam timetable.

Your AI Computer Science tutor for INFO2222

Stuck on a hard INFO2222 question? Sia is AskSia’s AI Computer Science tutor — ask any INFO2222 Computing 2 Usability and Security question and get a clear, step-by-step explanation grounded in how the course is actually taught and assessed. Read this whole study guide free, then take your hardest questions to Sia.