Lorrie Cranor - Usable Privacy & Security
Download as PPTX, PDF0 likes1,544 views
1) Usable privacy and security research bridges the fields of privacy/security and usability/HCI by considering both human and technical factors. It views humans as both users and potential adversaries. 2) When examining areas like passwords and access control, considering usability and security together is important because efforts to increase one can undermine the other if not designed carefully. 3) Making secure systems usable involves principles like invisible security, understandability through visibility and intuitive design, and training users. The fields must be studied together to develop solutions that achieve both security and usability.
Lorrie Cranor - Usable Privacy & Security
- 1. Usable Privacy and Security Engineering & Public Policy Lorrie Faith Cranor 1
- 2. Usable privacy and security research bridges privacy/security and usability/HCI Usable Privacy& Security/Privacy Usability/HCI Security Humans are a secondary Humans are the primary Human factors and constraint to constraint, security are both primary security/privacy security/privacy rarely constraints constraints considered Humans considered Concerned about human Concerned about both primarily in their role as error but not human normal users and adversaries/attackers attackers adversaries Involves threat models Involves task models, Involves threat models mental models, cognitive AND task models, models mental models, etc. Focus on security Focus on usability Considers usability and metrics metrics security metrics together User studies rarely done User studies common User studies common, often involve deception + 2 active adversary
- 3. User-selected graphical passwords Usable Privacy& Security/Privacy Usability/HCI Security What is the space of Howdifficult is it for a All the security/privacy possible passwords? user to create, and usability HCI remember, and enter a questions How can we make the graphical password? password space larger to How long does it take? How do usersselect make the password graphical passwords? harder to guess? How hard is it for users How can we help them to learn the system? choose passwords How are the stored harder for attackers to passwords secured? Are users motivated to predict? put in effort to create Can an attacker gain good passwords? As the password space knowledge by observing increases, what are the a user entering her Is the system accessible impacts on usability password? using a variety of factors and predictability devices, for users with of human selection?
- 4. How can we make secure systems more usable? • Make it “just work” – Invisible security – Automation • Make security/privacy understandable – Make it visible – Make it intuitive – Use metaphors that users can relate to – Human-centered design • Train the user 4
- 5. Better together • Examining security/privacy and usability together is often critical for achieving either • Examples – Passwords • Users cope with some measures to increase password security by behaving in predictable ways • Some efforts to make passwords easier also make it much easier for an attacker to guess a password – Access control • The way access control settings are visualized in a user interface and the underlying semantics of how rule conflicts are resolved both contribute to users’ ability to configure the system to accurately enforce the desired policy – Privacy tools • Users who misunderstand how to use privacy tools don’t configure them properly • Some simple privacy tools don’t provide much protection 5
- 6. References • S. Komanduri, R. Shay, P.G. Kelley, M.L. Mazurek, L. Bauer, N. Christin, L.F. Cranor, and S. Egelman.Ofpasswords and people: Measuring the effect of password-composition policies.CHI 2011. • R.W. Reeder, L. Bauer, L.F. Cranor, M.K. Reiter, and K. Vaniea. More than skin deep: Measuring effects of the underlying model on access-control system usability. CHI 2011. • P.G. Leon, B. Ur, R. Balebako, L.F. Cranor, R. Shay, and Y. Wang. Why Johnny Can't Opt Out: A Usability Evaluation of Tools to Limit Online Behavioral Advertising. CHI 2012. See also related papers listed at http://cups.cs.cmu.edu/ 6