1 Secure Interaction Design Cynthia Kuo

2 Overview Describe project on Wi-Fi access point configuration Show mockups and design process for Google Safe Browsing Talk about how you can design for security

3 Overview Describe project on Wi-Fi access point configuration Show mockups and design process for Google Safe Browsing Talk about how you can design for security

4 Wi-Fi Also known as a/b/g October 2006: 4 million units shipped each week

5 Going Back a Few Years… Returns –~30% return rate Technical Support –12 – 20 minutes / call –~10% of sales  technical support call $50 / hr technical support 15 minute call = $12.50 $10 materials  $2 profit / unit (assume 20%) 1 call = profit from unit + 5 other units! Rough Estimate

6 Research Question Why don’t users configure their wireless networks securely? –Cannot? –Choose not to? –Don’t know to?

7 Traditional Solution “Layer” different study techniques –Interviews: assess values, thought processes, and level of security knowledge –Surveys –Contextual inquiry: observe users –Usability study: evaluate features

8 Why Not? Evaluation of configuration process must be holistic –One user study method will not provide insight into entire process to pinpoint problems –Security is not a primary task Takes a long time! –Number of qualified users may be small

9 Designing a User Study How do we evaluate a system where the end goal may be different for every user? How can we ask about security concepts (e.g., encryption) if we don’t know whether users know what they are? People know that they’re supposed to care about security. How do we design a study without social acceptability bias?

10 Assumptions Textbook study methods make assumptions that may not hold for security software

11 Common Assumptions 1.Clear-cut criteria for success –Good security is risk management 2.Multiple ways to reach end result –No “undo” for some security breaches 3.Familiarity with underlying concepts –Task list may unintentionally provide information 4.Tasks are primary goals –No one wants to “do” security 5.Users respond without bias –Social acceptability biases Kuo, Perrig, and Walker, ACM, May + June 2006

12 Configuration Process

13 Evaluation Methodology What do people know about wireless security? What security issues do people care about? If users are aware of the security issues and care about them, are users able to configure the access points? Uses laptop as primary computer Has broadband connectivity at home Uses wireless on a daily basis (5+ times/week) Target Home User Interview (25 min) Questionnaire (5 min) Tasks (45 min) Questionnaire (5 min) Debriefing (10 min) Study Design Evaluating the Whole Process

14 Interview: Broadcasting?

15 Questionnaire –Availability –Reliability –Connection speed –Ease of use –Open networks –Security –Privacy –Health Opinions & concerns

16 Experimental Setup Okay, let’s pretend you just received this access point as a gift. You would like to set up and use a wireless network at home today. Just set up the access point as you would if you were at home. Scenario Gradual revelation User task –Set up access point for home –Explain motivation & understanding of possible consequences

17 Findings Users are reasonably knowledgeable about wireless technologies …but have difficulty translating that knowledge into security policies and feature configurations Novice users perform significantly worse than expert users –Expanding market  novice users

18 What Does that Mean for Products?

19 Goal-Based Design Can “level the playing field” between novice and expert users –Start from human goals, not technical features –Do not assume people are familiar with technical terms or particular technologies –Anticipate common error states –Minimize time & human effort required

20 Prototype Design

21 Results

22 Lessons More than one user study method may be needed to evaluate your problem Watch out for assumptions in your user study methods Adapt existing methods for your needs

23 Overview Describe project on Wi-Fi access point configuration Show mockups and design process for Google Safe Browsing Talk about how you can design for security

24 Google Safe Browsing Anti-phishing alert Part of Google Toolbar for Firefox browsing/index.htmlhttp:// browsing/index.html

25 Maps Bubble Warning bubble and icon used to appear trustworthy Gray background to emphasize danger and to catch attention Bubble attached to browser chrome to convey message origin Active elements on page disabled

26 Lessons Establish trustworthiness of message –Origin –Authority Match intrusiveness to severity –No false positives Recommend what actions to take Provide a feeling of closure

27 Overview Describe project on Wi-Fi access point configuration Show mockups and design process for Google Safe Browsing Talk about how you can design for security

28 Design for Security Think like your user –Use personas Stop thinking like yourself –Design for your personas User test, user test, user test –Watch your users –Don’t always believe what they say

29 Think Like Your User Personas –A precise description of your user and what s/he wants to accomplish –Make up archetypical users More specific is better! –Design for these users You may have primary and secondary personas Cooper (1999)

30 Example Persona Dan is a 46-year old sales executive for a sports magazine. He has never heard of encryption, Diffie-Hellman, or EKE. Dan sent 38 s from his Blackberry 8700c yesterday. He travels 50% of the time to meet with clients all over the East Coast. Using his IBM T41 laptop, he checks his from different hotels – he prefers Wyndham - every night. Dan often needs to download sensitive documents that contain his company’s business strategies. After 10 hours of meetings during the day, Dan does not want to spend any time configuring anything. Dan likes to play basketball in his spare time. Dan

31 Stop Thinking Like Yourself You are probably not the typical user Your user does not think like you Your user probably does not know as much as you do (about security in general and especially your product) Your user is not dumb, but will almost always make mistakes

32 Common Mistake #1: Thinking Like an Engineer “The user might want to disable L2TP Passthrough.” No! Dan doesn’t know what L2TP is - and he doesn’t ever want to.

33 Common Mistake #2: Focusing on Tasks & Features, Not Goals Users’ Goals –Not feel stupid –Not make mistakes –Get work done –Have fun (or at least not be too bored) False Goals –Save memory –Run in a browser –Safeguard data integrity –Increase program- execution efficiency –Use cool technology or features Cooper, Alan. The Inmates are Running the Asylum. Sams, 1999.

34 Software Evaluation Inexpensive, “discount” methods –Low-fidelity –Cognitive walkthrough –Heuristic evaluation Expensive –Formal models (e.g., GOMS) –Formal experiment

35 Discount Methods: Predictive? # Problems that Did Occur Cognitive Walkthrough Experts System Designers Non-experts # Problems that Could Potentially Occur Heuristic Evaluation Lab (44%) 4 (16%) 2 (8%) 9 (31%) 7 (24%) 1 (3%) Experts System Designers Non-experts 7 (28%) 4 (16%) 2 (8%) 9 (31%) 6 (21%) 2 (7%) Desurvire, Kondziela, Atwood (1992)

36 Common Mistake #3: Listening to One Person “A customer said we should…” 80% rule Feature creep

37 Lessons Think like your user Stop thinking like yourself User test, user test, user test –Be careful about what information you use

Thank you! Questions? Comments?