{"title":"Secure software installation in a mobile environment","authors":"A. Heiner, N. Asokan","doi":"10.1145/1280680.1280705","DOIUrl":"https://doi.org/10.1145/1280680.1280705","url":null,"abstract":"Software security in mobile devices today is done by granting privileges to software, usually based on code signing. The cost of obtaining signatures and meeting strict quality requirements deters hobbyist developers from participating and contributing to application development. If a certain piece of software does not come with an acceptable signature, the mobile device may give the user the option of deciding whether that software should be granted the requested privileges. Naturally, designing the user interaction for this step without hampering usability and security is tricky. When users are simply prompted whether they want to grant certain privileges to some software, they often do not have enough information to understand the implications of this action.\u0000 We propose that using community feedback can be an effective way of helping the user to decide whether to grant privileges to software. Community feedback includes opinions and ratings on both security and functionality attributes of software. We argue that users will use community feedback to decide whether they want to use a piece of software and that the decisions to download, install, and grant necessary privileges are implied by the decision to use.","PeriodicalId":273244,"journal":{"name":"Symposium On Usable Privacy and Security","volume":"57 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-07-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130877527","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A survey of privacy concerns with dynamic collaborator discovery capabilities","authors":"R. Marchant","doi":"10.1145/1280680.1280707","DOIUrl":"https://doi.org/10.1145/1280680.1280707","url":null,"abstract":"Dynamic Collaborator Discovery is concept that proposes using a person's patterns of information access to create models that can then be used to find others with similar interest. This concept may raise privacy concerns to end users. The poster will present the results of a survey conducted in May 2007 to determine if privacy concerns will exist for a dynamic collaborator discovery capability.","PeriodicalId":273244,"journal":{"name":"Symposium On Usable Privacy and Security","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-07-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127376925","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Carlos Jensen, Chandan Sarkar, Christian Jensen, C. Potts
{"title":"Tracking website data-collection and privacy practices with the iWatch web crawler","authors":"Carlos Jensen, Chandan Sarkar, Christian Jensen, C. Potts","doi":"10.1145/1280680.1280686","DOIUrl":"https://doi.org/10.1145/1280680.1280686","url":null,"abstract":"In this paper we introduce the iWatch web crawler, a tool designed to catalogue and analyze online data practices and the use of privacy related indicators and technologies. Our goal in developing iWatch was to make possible a new type of analysis of trends, the impact of legislation on practices, and geographic and social differences online. In this paper we present preliminary findings from two sets of data collected 15 months apart and analyzed with this tool. Our combined samples included more than 240,000 pages from over 24,000 domains and 47 different countries. In addition to providing useful and needed data on the state of online data practices, we show that iWatch is a promising approach to the study of the web ecosystem.","PeriodicalId":273244,"journal":{"name":"Symposium On Usable Privacy and Security","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-07-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117123604","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"An honest man has nothing to fear: user perceptions on web-based information disclosure","authors":"G. Conti, E. Sobiesk","doi":"10.1145/1280680.1280695","DOIUrl":"https://doi.org/10.1145/1280680.1280695","url":null,"abstract":"In today's era of the global ubiquitous use of free online tools and business models that depend on data retention and customized advertising, we face a growing tension between the privacy concerns of individuals and the financial motivations of organizations. As a critical foundation step to address this problem, we must first understand the attitudes, beliefs, behaviors, and expectations of web users in order to create an environment where user privacy needs are met while still allowing online companies to innovate and provide functionality that users desire. As security and usability professionals we must identify areas where misperceptions exist and seek solutions, either by raising awareness, changing policy, or through technical means. In this paper, we explore these issues and report the results from a survey of 352 college undergraduates and a comparison group of 25 middle aged adults The results were at times surprising and even contradictory to the views held by security professionals. To summarize our findings, the students we surveyed believe that \"an honest man has nothing to fear.\"","PeriodicalId":273244,"journal":{"name":"Symposium On Usable Privacy and Security","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-07-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128572584","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Vidalia: towards a usable Tor GUI","authors":"Matthew Edman, J. Hipple","doi":"10.1145/1280680.1280709","DOIUrl":"https://doi.org/10.1145/1280680.1280709","url":null,"abstract":"Tor is a popular tool for online anonymity that currently does not have a standard graphical user interface. We present Vidalia, an open source, cross-platform GUI for Tor. We discuss some of the design decisions we have made in Vidalia, as well as what we have found users expect in a Tor GUI.","PeriodicalId":273244,"journal":{"name":"Symposium On Usable Privacy and Security","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-07-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127910298","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Lessons learned from the deployment of a smartphone-based access-control system","authors":"Lujo Bauer, L. Cranor, M. Reiter, Kami Vaniea","doi":"10.1145/1280680.1280689","DOIUrl":"https://doi.org/10.1145/1280680.1280689","url":null,"abstract":"Grey is a smartphone-based system by which a user can exercise her authority to gain access to rooms in our university building, and by which she can delegate that authority to other users. We present findings from a trial of Grey, with emphasis on how common usability principles manifest themselves in a smartphone-based security application. In particular, we demonstrate aspects of the system that gave rise to failures, misunderstandings, misperceptions, and unintended uses; network effects and new flexibility enabled by Grey; and the implications of these for user behavior. We argue that the manner in which usability principles emerged in the context of Grey can inform the design of other such applications.","PeriodicalId":273244,"journal":{"name":"Symposium On Usable Privacy and Security","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-07-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130783748","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
R. James, WooLim Kim, Aleecia M. McDonald, R. McGuire
{"title":"A usability evaluation of a home monitoring system","authors":"R. James, WooLim Kim, Aleecia M. McDonald, R. McGuire","doi":"10.1145/1280680.1280699","DOIUrl":"https://doi.org/10.1145/1280680.1280699","url":null,"abstract":"In this paper, we describe results from a laboratory-based study of user interactions with the Home Heartbeat system, which allows customers to monitor sensor data about their residence. Our study focused on usability, privacy, and security.","PeriodicalId":273244,"journal":{"name":"Symposium On Usable Privacy and Security","volume":"79 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-07-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114301986","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Bitfrost: the one laptop per child security model","authors":"I. Krstić, S. Garfinkel","doi":"10.1145/1280680.1280697","DOIUrl":"https://doi.org/10.1145/1280680.1280697","url":null,"abstract":"We present an integrated security model for a low-cost laptop that will be widely deployed throughout the developing world. Implemented on top of Linux operating system, the model is designed to restrict the laptop's software without restricting the laptop's user.","PeriodicalId":273244,"journal":{"name":"Symposium On Usable Privacy and Security","volume":"106 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-07-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121773912","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Is FacePIN secure and usable?","authors":"Paul Dunphy, Jeff Yan","doi":"10.1145/1280680.1280710","DOIUrl":"https://doi.org/10.1145/1280680.1280710","url":null,"abstract":"Personal identification numbers (PINs) and hardware tokens are often used together for authentication purposes, e.g., in financial transactions with ATM machines. However, many people cannot remember their PINs. This has caused insecure practice, extra management cost, or both. In this paper, we evaluate FacePIN, a solution proposed to improve the security and memorability of the PIN scheme.","PeriodicalId":273244,"journal":{"name":"Symposium On Usable Privacy and Security","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-07-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126427925","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"End user concern about security and privacy threats","authors":"Joshua B. Gross, M. Rosson","doi":"10.1145/1280680.1280711","DOIUrl":"https://doi.org/10.1145/1280680.1280711","url":null,"abstract":"End users are typically seen as the weakest link in ensuring security and privacy in computing environments. Our own prior work suggested that end users may have difficulty differentiating between privacy/security problems and other hardware/software concerns. However, a survey of a broad group of internet users showed that, in fact, these users believe that they can not only differentiate between these two sets of concerns, but that in fact users are more concerned with security/privacy concerns than they are with other types of computer problems.","PeriodicalId":273244,"journal":{"name":"Symposium On Usable Privacy and Security","volume":"87 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-07-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123814361","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}