Nathaniel S. Good Aaron Krekelberg Usability and privacy: a study of Kazaa P2P file- sharing

Abstract P2P sharing is becoming very popular P2P sharing is becoming very popular Intended for multimedia files, but applications like Kaaza allow for other files to be shared Intended for multimedia files, but applications like Kaaza allow for other files to be shared With this security concerns need to be addressed With this security concerns need to be addressed The applications that allow P2P file sharing make it easy to unintentionally share private information The applications that allow P2P file sharing make it easy to unintentionally share private information

Introduction Introduction The most popular P2P system was Kazaa The most popular P2P system was Kazaa 85 million downloads done worldwide 85 million downloads done worldwide Interface looks straightforward and easy to use Interface looks straightforward and easy to use Good way to share files with others but no security Good way to share files with others but no security If sharing is set up incorrectly personal files can be shared If sharing is set up incorrectly personal files can be shared Kazaa has no security measure to protect users Kazaa has no security measure to protect users

Introduction Introduction Look at how Kazaa is not a secure application Look at how Kazaa is not a secure application Does Kazaa have responsibilities and obligations to users? Does Kazaa have responsibilities and obligations to users? Help users protect personal files Help users protect personal files

Abuses on Kaaza Many unintentionally share private files with others Many unintentionally share private files with others folders or credit card information folders or credit card information Scripted searches to run for 12 hours Scripted searches to run for 12 hours Did not download any files just did queries Did not download any files just did queries Found 61% of all searches returned one or more hits for inbox.dbx Found 61% of all searches returned one or more hits for inbox.dbx 156 users with shared inboxes were found 156 users with shared inboxes were found

Abuses on Kaaza Are users taking advantage of this? Are users taking advantage of this? Set up a dummy client to see Set up a dummy client to see Created dummy files like Credit Cards.xls and Outlook.pst Created dummy files like Credit Cards.xls and Outlook.pst 4 different users downloaded the Credit Cards.xls 4 different users downloaded the Credit Cards.xls 2 different users downloaded the inbox.dbx 2 different users downloaded the inbox.dbx

Usability Guidelines P2P file sharing software is safe and usable if users: P2P file sharing software is safe and usable if users: Are aware of the files that others can download from your system Are aware of the files that others can download from your system Can easily and successful start and stop file sharing Can easily and successful start and stop file sharing Can not accidentally share private files that they don’t want to share Can not accidentally share private files that they don’t want to share Users should be comfortable with what is being shared with others and the system is handling the sharing correctly Users should be comfortable with what is being shared with others and the system is handling the sharing correctly

Summary of Cognitive Walkthrough New Kazaa is safer New Kazaa is safer Default settings are changed Default settings are changed Users able to change the default settings Users able to change the default settings Sharing is not turned on by default Sharing is not turned on by default Changing the Download file directory Changing the Download file directory File can be changed under Options-> tools File can be changed under Options-> tools My Shared folder and all folders below it are shared My Shared folder and all folders below it are shared Download folder is also automatically shared Download folder is also automatically shared Users don’t understand file hierarchical systems Users don’t understand file hierarchical systems Leads to undesired folder sharing Leads to undesired folder sharing

Summary of Cognitive Walkthrough Sharing Files Sharing Files Kazaa has two ways to share folders Kazaa has two ways to share folders Search Wizard Search Wizard Folder List Folder List Search Wizard will automatically discover files that can be shared Search Wizard will automatically discover files that can be shared Has no criteria to discover files Has no criteria to discover files Folder List allows the user to select files to share Folder List allows the user to select files to share User can select what files he or she would like to shared by selecting them from a explorer type window User can select what files he or she would like to shared by selecting them from a explorer type window

Summary of Cognitive Walkthrough Adding Files to the My Media folder Adding Files to the My Media folder This will add files to shared or downloaded folder This will add files to shared or downloaded folder Files can be individually turned on and off Files can be individually turned on and off Only at file level Only at file level Not at the folder level Not at the folder level

Summary of Cognitive Walkthrough Uploading Files Uploading Files Transfer File Interface Transfer File Interface Allows users to select individual files that can be uploaded by Kazaa users Allows users to select individual files that can be uploaded by Kazaa users Has a scrollable list to select files Has a scrollable list to select files Transfer list cleared every time Kazaa is restarted Transfer list cleared every time Kazaa is restarted

Summary of Cognitive Walkthrough Overview of Results from the Cognitive Walkthrough Overview of Results from the Cognitive Walkthrough Users should know what files are able to be downloaded Users should know what files are able to be downloaded Users should know how to share and stop sharing files Users should know how to share and stop sharing files Users should not be able to accidentally share files Users should not be able to accidentally share files Users need to know what they are sharing and be comfortable with it Users need to know what they are sharing and be comfortable with it

Overview of Results from the Cognitive Walkthrough Users should be made aware of what files can be downloaded by others Users should be made aware of what files can be downloaded by others Did not provide information on what kind of file that was intended for sharing Did not provide information on what kind of file that was intended for sharing Did not provide a way to indicate if they want all files and folders beneath to be shared Did not provide a way to indicate if they want all files and folders beneath to be shared No safeguard is built in so responsibility falls on users No safeguard is built in so responsibility falls on users

Overview of Results from the Cognitive Walkthrough Users should be able to stop and start file sharing easily and successfully Users should be able to stop and start file sharing easily and successfully Deselecting files to be shared from My Media Folder was shown through the tips page Deselecting files to be shared from My Media Folder was shown through the tips page Must read it first and then have to remember the information later Must read it first and then have to remember the information later Has multiple ways to share files and folders Has multiple ways to share files and folders Has only one hard to find way to stop sharing Has only one hard to find way to stop sharing

Overview of Results from the Cognitive Walkthrough Users should not be able to accidentally share private files Users should not be able to accidentally share private files Files and folders shared through the download folder were not indicated by the Share Folders Box Files and folders shared through the download folder were not indicated by the Share Folders Box Since there is no coupling of views there is no distinction between shared folders and download folders Since there is no coupling of views there is no distinction between shared folders and download folders

Overview of Results from the Cognitive Walkthrough Users should be comfortable with what is being shared with others Users should be comfortable with what is being shared with others Does not provide a tool to manage types of files and extensions being shared Does not provide a tool to manage types of files and extensions being shared Relies to much on users understanding the assumptions the program has made Relies to much on users understanding the assumptions the program has made

User Study Wanted to see if users would be confused with the process Wanted to see if users would be confused with the process Wanted to see if users could determine what is being shared Wanted to see if users could determine what is being shared See if users could determine which if any folders were being shared by Kaaza with others See if users could determine which if any folders were being shared by Kaaza with others 10 out of 12 had used some type of file sharing application 10 out of 12 had used some type of file sharing application All used a computer over 1o hours a week All used a computer over 1o hours a week

User Study All users started from the Kaaza home page and were only allowed to use this UI All users started from the Kaaza home page and were only allowed to use this UI The users were given a tutorial on file sharing The users were given a tutorial on file sharing All users were given as much time as they needed All users were given as much time as they needed Users had to answer precise questions regarding the searching Users had to answer precise questions regarding the searching If answered correctly were asked to stop searching and to share only My Shared Folders If answered correctly were asked to stop searching and to share only My Shared Folders

Survey Results 2 users indicated all files could be shared 2 users indicated all files could be shared 9 out of 10 users believed only multimedia files and software could be shared 9 out of 10 users believed only multimedia files and software could be shared 1 out of 10 said possible to share folders, office documents, and source code files 1 out of 10 said possible to share folders, office documents, and source code files

Task Results 2 of 12 were able to determine which files and folders were being shared 2 of 12 were able to determine which files and folders were being shared Both could turn off file sharing, but could not apply it to individual folders Both could turn off file sharing, but could not apply it to individual folders 5 of 12 thought only My Shared Folder was shared 5 of 12 thought only My Shared Folder was shared 2 of 12 used search for shared folders 2 of 12 used search for shared folders None were checked so believed they weren’t sharing folders None were checked so believed they weren’t sharing folders 2 of 12 browsed help to determine incorrectly that My Shared Folder was only thing that could be shared 2 of 12 browsed help to determine incorrectly that My Shared Folder was only thing that could be shared 1 of 12 could not determine which folder was being shared no matter what approach they took 1 of 12 could not determine which folder was being shared no matter what approach they took

Suggestions Prohibit sharing of files that aren’t multimedia files Prohibit sharing of files that aren’t multimedia files Limit file sharing to types users expect to be shared Limit file sharing to types users expect to be shared Also, allow for advanced users to permit additional file sharing if desired Also, allow for advanced users to permit additional file sharing if desired

Conclusion File sharing is problematic because of the UI File sharing is problematic because of the UI Design of applications make to many assumptions Design of applications make to many assumptions Many are not aware of what and how much they are sharing Many are not aware of what and how much they are sharing The My Media interfaces causes more confusion than help The My Media interfaces causes more confusion than help File sharing applications should design applications according to security applications File sharing applications should design applications according to security applications Questions ?