The Saucer

Recommendations

Info

The Saucer Summer 2015Recent PublicationsMost CUPS publications are available on the CUPS website. Thefollowing are a selection of publications from the past year.Privacy Decision MakingYour Location has been Shared 5,398 Times!: A FieldStudy on Mobile App Privacy NudgingH. Almuhimedi, F. Schaub, I. Adjerid, A. Acquisti, J. Gluck, L. Cranor, Y. AgarwalCHI 2015Smartphone users are often unaware of the data collected byapps running on their devices. We report on a study thatevaluates the benefits of giving users an app permissionmanager and sending them nudges intended to raise theirawareness of the data collected by their apps. Our studyprovides both qualitative and quantitative evidence that theseapproaches are complementary and can each play a significantrole in empowering users to more effectively control theirprivacy. For instance, even after a week with access to thepermission manager, participants benefited from nudgesshowing them how often some of their sensitive data was beingaccessed by apps, with 95% of participants reassessing theirpermissions, and 58% of them further restricting some of theirpermissions. We discuss how participants interacted both withthe permission manager and the privacy nudges, analyze theeffectiveness of both solutions, and derive somerecommendations.A Design Space for Effective Privacy NoticesF. Schaub, R. Balebako, A. Durity, and L. CranorSOUPS 2015Notifying users about a system’s data practices is supposed toenable users to make informed privacy decisions. Yet, currentnotice and choice mechanisms, such as privacy policies, areoften ineffective because they are neither usable nor useful, andare therefore ignored by users. Constrained interfaces onmobile devices, wearables, and smart home devices connectedin an Internet of Things exacerbate the issue. Much researchhas studied usability issues of privacy notices and manyproposals for more usable privacy notices exist. Yet, there islittle guidance for designers and developers on the designaspects that can impact the effectiveness of privacy notices. Inthis paper, we make multiple contributions to remedy this issue.We survey the existing literature on privacy notices and identifychallenges, requirements, and best practices for privacy noticedesign. Further, we map out the design space for privacynotices by identifying relevant dimensions. This provides ataxonomy and consistent terminology of notice approaches tofoster understanding and reasoning about notice optionsavailable in the context of specific systems. Our systemizationof knowledge and the developed design space can helpdesigners, developers, and researchers identify notice andchoice requirements and develop a comprehensive noticeconcept for their system that addresses the needs of differentaudiences and considers the system’s limitations andopportunities for providing notice.What do they know about me? Contents and Concernsof Online Behavioral ProfilesA. Rao, F. Schaub, N. SadehUbiComp 2014Data aggregators collect large amount of information aboutindividual users and create detailed online behavioral profiles ofindividuals. Behavioral profiles benefit users by improvingproducts and services. However, they have also raised concernsregarding user privacy, transparency of collection practices andaccuracy of data in the profiles. To improve transparency, somecompanies are allowing users to access their behavioral profiles.In this work, we investigated behavioral profiles of users byutilizing these access mechanisms. Using in-person interviews(n=8), we analyzed the data shown in the profiles, elicited userconcerns, and estimated accuracy of profiles. We confirmed ourinterview findings via an online survey (n=100). To assess theclaim of improving transparency, we compared data shown inprofiles with the data that companies have about users. Morethan 70% of the participants expressed concerns aboutcollection of sensitive data such as credit and healthinformation, level of detail and how their data may be used. Wefound a large gap between the data shown in profiles and thedata possessed by companies. A large number of profiles wereinaccurate with as much as 80% inaccuracy. We discussimplications for public policy management.PasswordsMeasuring Real-World Accuracies and Biases inModeling Password GuessabilityB. Ur, S. Segreti, L. Bauer, N. Christin, L. Cranor, S. Komanduri, D. Kurilova, M.Mazurek, W. Melicher, R. ShayUSENIX Security 2015 (forthcoming)Parameterized password guessability—how many guesses aparticular cracking algorithm with particular training data wouldtake to guess a password—has become a common metric ofpassword security. Unlike statistical metrics, it aims to modelreal-world attackers and to provide per-password strengthestimates. We investigate how cracking approaches often usedby researchers compare to real-world cracking by professionals,as well as how the choice of approach biases researchconclusions. We find that semi-automated cracking byprofessionals outperforms popular fully automated approaches,but can be approximated by combining multiple suchapproaches. These approaches are only effective, however, withcareful configuration and tuning; in commonly used defaultconfigurations, they underestimate the real-world guessabilityof passwords. We find that analyses of large password sets areoften robust to the algorithm used for guessing as long as it isconfigured effectively. However, cracking algorithms differsystematically in their effectiveness guessing passwords withcertain common features (e.g., character substitutions). Ourresults highlight the danger of relying only on a single crackingalgorithm as a measure of password strength and constitute thefirst scientific evidence that automated guessing can oftenapproximate guessing by professionals.6
The Saucer Summer 2015“I Added ‘!’ at the End to Make It Secure”: ObservingPassword Creation in the LabB. Ur, F. Noma, J. Bees, S. Segreti, R. Shay, L. Bauer, N. Christin, L. CranorSOUPS 2015Users often make passwords that are easy for attackers toguess. Prior studies have documented features that lead toeasily guessed passwords, but have not probed why users craftweak passwords. To understand the genesis of commonpassword patterns and uncover average users' misconceptionsabout password strength, we conducted a qualitative interviewstudy. In our lab, 49 participants each created passwords forfictitious banking, email, and news website accounts whilethinking aloud. We then interviewed them about their generalstrategies and inspirations. Most participants had a well-definedprocess for creating passwords. In some cases, participantsconsciously made weak passwords. In other cases, however,weak passwords resulted from misconceptions, such as thebelief that adding “!” to the end of a password instantly makesit secure or that words that are difficult to spell are more securethan easy-to-spell words. Participants commonly anticipatedonly very targeted attacks, believing that using a birthday orname is secure if those data are not on Facebook. In contrast,some participants made secure passwords using unpredictablephrases or non-standard capitalization. We identify aspects ofpassword creation ripe for guidance or automated intervention.A Spoonful of Sugar? The Impact of Guidance andFeedback on Password-Creation BehaviorR. Shay, L. Bauer, N. Christin, L. Cranor, A. Forget, S. Komanduri, M. Mazurek, W.Melicher, and B. UrCHI 2015Users often struggle to create passwords under strictrequirements. To make this process easier, some providerspresent real-time feedback during password creation, indicatingwhich requirements are not yet met. Other providers guideusers through a multi-step password-creation process. Our6,435-participant online study examines how feedback andguidance affect password security and usability. We find thatreal-time password-creation feedback can help users createstrong passwords with fewer errors. We also find that althoughguiding participants through a three-step password-creationprocess can make creation easier, it may result in weakerpasswords. Our results suggest that service providers shouldpresent password requirements with feedback to increaseusability. However, the presentation of feedback and guidancemust be carefully considered, since identical requirements canhave different security and usability effects depending onpresentation.Telepathwords: Preventing Weak Passwords byReading Users’ MindsS. Komanduri, R. Shay, L. Cranor, C. Herley, and S. SchechterUSENIX Security 2014To discourage the creation of predictable passwords, vulnerableto guessing attacks, we present Telepathwords. As a user creates apassword, Telepathwords makes realtime predictions for thenext character that user will type. While the concept is simple,making accurate predictions requires efficient algorithms tomodel users’ behavior and to employ already-typed charactersto predict subsequent ones. We first made the Telepathwordstechnology available to the public in late 2013 and have sinceserved hundreds of thousands of user sessions. We ran ahuman-subjects experiment to compare password policies thatuse Telepathwords to those that rely on composition rules,comparing participants’ passwords using two differentpassword-evaluation algorithms. We found that participantscreate far fewer weak passwords using the Telepathwordsbasedpolicies than policies based only on charactercomposition.Biometric Authentication on iPhone and Android:Usability, Perceptions, and Influences on Adoption.C. Bhagavatula, B. Ur, K. Iacovino, S. Kywe, L. Cranor, M. Savvides.USEC 2015While biometrics have long been promoted as the future ofauthentication, the recent introduction of Android face unlockand iPhone fingerprint unlock are among the first large-scaledeployments of biometrics for consumers. In a 10- participant,within-subjects lab study and a 198-participant online survey,we investigated the usability of these schemes, along with users’experiences, attitudes, and adoption decisions. Participants inour lab study found both face unlock and fingerprint unlockeasy to use in typical scenarios. The notable exception was thatface unlock was completely unusable in a dark room. Mostparticipants preferred fingerprint unlock over face unlock or aPIN. In our survey, most fingerprint unlock users perceived itas more secure and convenient than a PIN. In contrast, faceunlock users had mixed experiences, and many had stoppedusing it. We conclude with design recommendations forbiometric authentication on smartphones.Social NetworksI Would Like To..., I Shouldn't..., I Wish I...: ExploringBehavior-Change Goals for Social Networking SitesM. Sleeper, A. Acquisti, L. Cranor, P. Kelley, S. Munson, N. SadehCSCW 2015Despite the benefits they derive from social networking sites(SNSs), members of those services are not always satisfied withtheir online behaviors. The investigation of desires for behaviorchange in SNSs both provide insight into users’ perceptions ofhow SNSs impact their lives (positively or negatively) and caninform tools for helping users achieve desired behaviorchanges. We use a 604-participant online survey to explore SNSusers’ behavior-change goals for Facebook, Instagram, andTwitter. While some participants want to reduce site use, otherswant to improve their use or increase a range of behaviors.These desired changes differ by SNS, and, for Twitter, byparticipants’ levels of site use. Participants also expect a rangeof benefits from these goals, including more free time, contactwith others, intrinsic benefits, better security/privacy, andimproved self presentation. We provide insights both into howparticipants perceive different SNSs, as well as potential designsfor behavior-change mechanisms to target SNS behaviors.7
Page 1 and 2: The SaucerThe Newsletter of theCyLa
Page 3 and 4: The Saucer Summer 2015New Additions
Page 5: The Saucer Summer 2015Florian Schau

The Saucer

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?