1. Web Privacy and Security Part II

2. Agenda Project proposal grades Project proposal grades –Average: 87.5 –Divide by 5 for contribution to final grade Lecture/discussion Lecture/discussion Test info Test info Heuristic eval of Firefox plugin Heuristic eval of Firefox plugin

3. Thinking about Cookies Because cookies can be used beneficially, disallowing their use is not an acceptable solution Because cookies can be used beneficially, disallowing their use is not an acceptable solution Many sites collecting information about users do not explicitly inform them that they are doing so Many sites collecting information about users do not explicitly inform them that they are doing so Your browser is implicitly giving consent on your behalf when accepting cookies Your browser is implicitly giving consent on your behalf when accepting cookies

4. Problems with Cookie Management People claim to want the browser to seek their consent before giving up information in this manner People claim to want the browser to seek their consent before giving up information in this manner –Asking every time is too intrusive and annoying, and leads to users clicking through without paying attention Accept/Reject decision is not clear in all cases Accept/Reject decision is not clear in all cases Because the perceived risks are low, very little action can be required on the part of the user or they will simply avoid using the tool Because the perceived risks are low, very little action can be required on the part of the user or they will simply avoid using the tool

5. Informed consent Disclosure Disclosure Comprehension Comprehension Voluntariness Voluntariness Competence Competence Agreement Agreement Minimal distraction Minimal distraction Examples: current IE cookie management system, Amazon.com recommendation system, Examples: current IE cookie management system, Amazon.com recommendation system,

6. Consent continued… How important is informed consent? How important is informed consent? Given the knowledge and behavior of an average user, how much consent are people really currently giving? Given the knowledge and behavior of an average user, how much consent are people really currently giving? How can we improve? How can we improve? Comparison to offline: bank, credit cards. Are people reading those either? Comparison to offline: bank, credit cards. Are people reading those either? What should people be giving explicit consent for? What should people be giving explicit consent for? –(no harm, purpose is known, no coercion)

7. Cookie-Watcher Prototype Enhancements to cookie manager tool Enhancements to cookie manager tool –Additional cookie information Minimal distraction important Minimal distraction important –If overwhelmed with queries with low perceived benefits and risks, attention to each will become low –After some threshold, users will simply seek to disable the mechanism to avoid the annoyances it presents Just-in-time interventions for cookie events Just-in-time interventions for cookie events –Difficult to tell which are actually important to a user Friedman, Howe, and Felton. Friedman, Howe, and Felton. Informed Consent in the Mozilla Browser: Implementing Value-Sensitive Design. In HICSS 2002.

8. Prototype – cont Instead of interrupting current work with decisions, give peripheral notification Instead of interrupting current work with decisions, give peripheral notification –Users can then identify themselves which events are important and need their attention Cookie information box displays currently set cookies on side of browser area Cookie information box displays currently set cookies on side of browser area Color and formatting in cookie information dialog box make cookies easier to identify Color and formatting in cookie information dialog box make cookies easier to identify –3 rd party cookies in red –Long cookie expiration durations bolded –Cookie expiration durations for current session in italics

9. User Study Increased awareness of cookie events Increased awareness of cookie events More likely to respond to cookie events More likely to respond to cookie events More likely to make cookie management actions More likely to make cookie management actions

10. Doppelganger More fun with cookies! More fun with cookies! When deciding to accept a cookie or not, users would like to compare the privacy cost to the functionality benefit but are ill equipped to do so When deciding to accept a cookie or not, users would like to compare the privacy cost to the functionality benefit but are ill equipped to do so Doppelganger aims to assist the user in making these decisions and learn and make simple generalizations of these rules to remove later instances of repeated prompts Doppelganger aims to assist the user in making these decisions and learn and make simple generalizations of these rules to remove later instances of repeated prompts Shankar and Karlof. Doppelganger: Better browser privacy without the bother. Proceedings of Conference on Computer and Communications Security, 2006.

11. Doppelganger Mirrors session in hidden window Mirrors session in hidden window Detects differences in sessions Detects differences in sessions If there is no detected difference, cookies are assumed to have no benefit and are ignored If there is no detected difference, cookies are assumed to have no benefit and are ignored If there is a difference, present it to the user, give them information relevant to the cookie and let them decide to accept or reject If there is a difference, present it to the user, give them information relevant to the cookie and let them decide to accept or reject –Now has information necessary to make informed functionality vs. privacy decision

12. Doppelganger “Fix Me” button for user-initiated repair “Fix Me” button for user-initiated repair –Attempts to rewind and replay sequence of actions with cookies on –Needed incase no difference was detected and cookies were automatically rejected Learns policies per domain Learns policies per domain Configuration modes allow for automatic acceptance of 1 st party session cookies Configuration modes allow for automatic acceptance of 1 st party session cookies –Other modes allow for different trade off of privacy and intrusiveness

13. Evaluation Simulated User Simulated User –Willing to give up privacy at some sites Yahoo!, Netflix, GMail Yahoo!, Netflix, GMail –Not willing to give up privacy at sites which they had no relationship CNN, PCMagazine, etc CNN, PCMagazine, etc 5 Conditions 5 Conditions –All cookies enabled –Reject 3 rd party cookies –Reject 3 rd party cookies + Reject persistent cookies –Ask user for every cookie –Doppelganger

14. Measurements Number of sites whose cookies were accepted Number of sites whose cookies were accepted –Grouped by persistence and context –Doesn’t directly measure privacy loss Inconveniences suffered by user Inconveniences suffered by user –Dialog boxes and prompts –Lost functionality Looking for low values both times Looking for low values both times Set of common tasks was repeated three times Set of common tasks was repeated three times

15. Results Doppelganger had the best fit for accepted cookies vs. lost functionality Doppelganger had the best fit for accepted cookies vs. lost functionality –More prompts than the conditions that never prompt –Fewer prompts than the condition that always prompts –After the 2 nd visit to any given site, no further prompts were required for any of the test scripts –After navigating prompts, there was no lost functionality –Required use of “Fix Me” button once upon returning to a site that needed a persistent cookie for functionality http://www.umeshshankar.com/doppelganger/

16. Acumen Use social recommendations to make cookie decisions Use social recommendations to make cookie decisions –Mavens vs. all users Issues: Issues: –Deployment –Coverage –Gaming Website reputation system: WOT Website reputation system: WOT http://www.cc.gatech.edu/fce/ecl/projects/acumen/

17. Revisiting 3 tools 3 tools –Cookie Watcher –Doppelganger –Acumen Advantages and disadvantages? Advantages and disadvantages? Which would you like to use? Which would you like to use? Which would you give your parent to use? Which would you give your parent to use?

18. Other Alternatives Many existing extensions and add-ons to enhance cookie management Many existing extensions and add-ons to enhance cookie management –Cookie Button –Cookie Toggle –Permit Cookies –Add N Edit Cookies –Cookie Culler –View Cookies But they still focus on the low level task of cookie management But they still focus on the low level task of cookie management

19. Firefox Make decisions for the user Make decisions for the user –More likely to make the right decision than the user –Users won’t read it anyway –Can’t ask too much or you will overwhelm When you must interrupt When you must interrupt –Perhaps use something besides a dialog Maintain trust so users will tolerate your mistakes Maintain trust so users will tolerate your mistakes Educate as simply as possible Educate as simply as possible –because users really don’t care that much Question – how does this compare to informed consent?

20. Why Extensions? Why aren’t these built into the default behavior of browsers? Why aren’t these built into the default behavior of browsers? –Chances are, users won’t take the proactive action required of going out to acquire these tools –Highest risk users likely not aware of their existence They all make tradeoffs They all make tradeoffs –User effort –Distractions –Blocking use of often-abused functionality But potentially useful functionality But potentially useful functionality

21. Firefox Extensions 151 Extensions in the Security and Privacy Section at mozilla.org 151 Extensions in the Security and Privacy Section at mozilla.org Scripting-related Scripting-related –NoScript, JSView, QuickJava Anonymizing Anonymizing –TorButton, FoxyProxy, FoxTor Site Identity Site Identity –RedirectRemover, ShowIP, Locationbar, PhishTank SiteChecker Cookies Cookies –Add N Edit Cookies, CookieSafe, CookieCuller Other Other –KeyScrambler Personal, TrackMeMot, WOT

22. Test Some short answer questions Some short answer questions –Give 3 advantages and 3 disadvantages of X over Y. –Given a scenario/tool/set of users, etc. List 3 potential design issues, or 2 methods of evaluating, etc. A couple longer answer questions A couple longer answer questions –Given a scenario, which tool would you use and why? –Design study to examine blah.

23. Let’s review the topics HCI Methods HCI Methods –Why is it important? –Types of user evaluations, typical user study Security Security –General definition and goals Privacy Privacy –Several definitions –How differs from security –Issues with bounded rationality Usable Privacy and Security Usable Privacy and Security –Weakest link –Secondary task –Product, process, panorama –Tog’s RingWall metaphor

24. More topics Authentication Authentication –Factors (know, have, are) –Various types (text, graphical, biometrics) –Issues and tradeoffs with each (for example: accessibility, memorability, security, cost, environmental) Phishing Phishing –Why do people fall for it? –Potential solutions to fix it Trust Trust –General definitions and layers –relationship to privacy and security –What contributes to trust

25. And final topics PKI & certificates PKI & certificates –Generally, what are they and why are they so hard to use? –Suggested improvements or solutions? Privacy policies Privacy policies –What are user issues? What are solutions? –P3P: generally what is it and what is its use? –Tools for dealing with privacy policies? Cookies Cookies –Informed consent model –What are they and what are issues? –What are techniques for dealing with them? Generic topics Generic topics –Training & education –Usability

26. Studying What I expect you to know What I expect you to know –General topic of each chapter/paper –General conclusions, issues, tradeoffs for each topic –How to compare/contrast techniques, tools, and methods What I don’t expect you to know What I don’t expect you to know –Specific statistics of any study –All issues or conclusions –Detailed implementation or interface of any technique or tool Advice: go through slides, go through summaries, flip through book and look at headings and bullets Advice: go through slides, go through summaries, flip through book and look at headings and bullets Advice on Test: structure your response, use terms from the book or class when giving answer Advice on Test: structure your response, use terms from the book or class when giving answer

27. Heuristic Evaluation uses simple and natural dialog uses simple and natural dialog speaks user’s language speaks user’s language is consistent is consistent provides feedback provides feedback provides good error messages provides good error messages prevents errors prevents errors  awareness of security/privacy tasks  aids user in making correct and safe decisions