Usable Privacy and Security Course Overview Lorrie Cranor, Jason Hong, Mike Reiter Grad students and juniors and seniors –Tended to be HCI, CS, Public Policy students Textbook First few lectures broad intros –Intro to HCI methods –Intro to privacy –Intro to computer security Students led rest of lectures and discussion

Course Projects Teams of 3-4 people –At most 1 HCI Masters student –At most 2 PhD students Project requirements –Complete IRB proposal (not necessarily submit) –Develop questionnaires / surveys / prototypes –Test study protocol on other students –Conduct pilot study

Course Projects Projects –Foxtor Anonymous Web Browsing –Why Johnny Still Can’t Encrypt –Symbols of Privacy –Improving Decisions on Opening Attachments

Course Highlights Need more small-scale exercises on HCI methods –Small-scale user studies –Heuristic evaluation Students had lots of activities in lectures –Good password habits quiz –Pictionary exercise –Develop and run small user study on CD player / calculator Students wanted more instructor lectures Pilot study hardest part, not lots of experience –Recruiting, Debugging protocol –Do pre-pilot study, get feedback in midterm presentations Overall, projects pretty good

Discussion board for posting beforehand Social engineering session Combine with HCI course somehow? Split homeworks T/Th for attendance reasons Will help you find job

Teaching Usable Privacy and Security Discussion Notes

Teaching Usable Privacy and Security Discussion Notes ~20 people in attendance –People that would like to take the course –People that will be teaching course or lecture like it soon Brief overview of our course (Spring 2006) –Taught by Lorrie Cranor, Jason Hong, Mike Reiter –Seminar style, 15 students –Started with intro to HCI, privacy, security –Rest of lectures and discussions student led –Large course project with milestones and presentations –Project group constraints: 1 HCI, 2PhDs max

Teaching Usable Privacy and Security Discussion Notes What worked well? –Breadth of course good –Diverse backgrounds helped learning –Project was good opportunity to learn –Midterm presentations to get project feedback Students asked to have study and pre-pilot done What could be improved? –Hardest part was designing and running pilot study –More homeworks with small HCI exercises –More guest lectures of case studies

Teaching Usable Privacy and Security Discussion Notes Possible directions: –Have students take both a security and HCI course? Either sequential or simultaneously –Include a social engineering component –What if only doing 1-2 lectures? Get people to appreciate difficulty and importance Get people to understand finding experts Final Notes –Assembling an instructor’s manual –Please send any materials you’re willing to share –We are also looking for reviewers