Designing Account-Free Booking Systems: Trade-offsBetween Usability, Privacy, and Security

Sammanfattning

Modern commercial systems typically utilize user accounts to store personal in-formation, which aids in functionality, administration, and management. However,there has been limited research on how account-free architectures influence the re-lationship between usability, privacy, and security in these systems. While useraccounts facilitate traceability and personalization, they also introduce challengesrelated to privacy, security, and increased complexity in user interactions.This study investigates how a booking system can be designed without the needfor user accounts, examining the implications for system design and user interactionprocesses. The research was conducted in collaboration with a local paint anddecorating retailer that provides tool and equipment rentals as an additional service.Following User-Centered Design principles, a web-based booking system wasdeveloped using React, .NET, and PostgreSQL. Usability was evaluated throughinterviews, observations, and scenario-based user testing with both employees andpublic users. Security and privacy concerns were addressed through literature re-search, architectural analysis, qualitative risk assessments, and threat modelingusing OWASP Threat Dragon.The final system differentiated between public booking functionality and admin-istrative functions, eliminating the requirement for user accounts by implementingtoken-based booking management. This approach enabled customers to retain con-trol while minimizing the collection of personal data. The results indicated thatreducing authentication requirements and simplifying workflows improved accessi-bility and reduced interaction friction. Key design and security features includedarchitectural separation, audit logging, automated personal data management, andbackend validation, supporting operational control and protecting customer data.The study identified several trade-offs between usability, privacy, and securityin the booking system. While the simplified workflows and reduced authenticationrequirements improved usability and data minimization, they also increased relianceon alternative control mechanisms, such as booking tokens, administrative oversight,and server-side validation. The findings suggest that account-free booking systemscan achieve both usability and privacy-oriented objectives if the design effectivelyincorporates architectural and organizational measures to address risks related toaccountability, misuse prevention, and the protection of personal information.