1. Usable Privacy and Security and Mobile Social Services Jason Hong jasonh@cs.cmu.edu

2. My Two Areas of Interest Usable Privacy and Security –“Give end-users security controls they can understand and privacy they can control for the dynamic, pervasive computing environments of the future.” - CRA –Anti-phishing Mobile Social Computing –Using sensing, wireless networking, and mobile devices to facilitate awareness, communication, and coordination –Mobile phones

3. Everyday Privacy and Security Problem

4. This entire process known as phishing

5. Phishing is a Plague on the Internet Estimated 3.5 million people have fallen for phishing Estimated $350m-$2b direct losses a year 9255 unique phishing sites reported in June 2006 Easier (and safer) to phish than rob a bank

6. Project: Supporting Trust Decisions Goal: help people make better online trust decisions –Currently focusing on anti-phishing Large multi-disciplinary team project at CMU –Six faculty, five PhD students, undergrads, staff –Computer science, human-computer interaction, public policy, social and decision sciences, CERT

7. Our Multi-Pronged Approach Human side –Interviews to understand decision-making –PhishGuru embedded training –Anti-Phishing Phil game –Understanding effectiveness of browser warnings Computer side –PILFER email anti-phishing filter –CANTINA web anti-phishing algorithm

8. Usable Privacy and Security Supporting Trust Decisions

9. Results of Evaluation Have to fall for phishing email to be effective? How well do people retain knowledge after a week? Correctness

10. Results of Evaluation Have to fall for phishing email to be effective? How well do people retain knowledge after a week? Correctness

11. Anti-Phishing Phil

19. PILFER Email Anti-Phishing Filter Example heuristics combined in SVM –IP addresses in link (http://128.23.34.45/blah)http://128.23.34.45/blah –Age of linked-to domains (younger domains likely phishing) –Number of domain names in links –Number of dots in URLs –SpamAssassin rating

20. Robust Hyperlinks Developed by Phelps and Wilensky to solve “404 not found” problem Key idea was to add a lexical signature to URLs that could be fed to a search engine if URL failed –Ex. http://abc.com/page.html?sig=“word1+word2+...+word5”http://abc.com/page.html?sig=“word1+word2+...+word5 How to generate signature? –Found that TF-IDF was fairly effective Informal evaluation found five words was sufficient for most web pages

21. Adapting TF-IDF for Anti-Phishing Can same basic approach be used for anti-phishing? –Scammers often directly copy web pages –With Google search engine, fake should have low page rank FakeReal

22. Evaluating CANTINA

23. My Two Areas of Interest Usable Privacy and Security –“Give end-users security controls they can understand and privacy they can control for the dynamic, pervasive computing environments of the future.” - CRA –Anti-phishing Mobile Social Computing –Using sensing, wireless networking, and mobile devices to facilitate awareness, communication, and coordination –Mobile phones

24. Mobile Social Computing New ways for people to organize and coordinate with one another –Smart Mobs –Gawker Stalker

26. Mobile Social Computing New ways for people to organize and coordinate with one another –Smart Mobs –Gawker Stalker –MySpace Mobile

27. Mobile Social Computing IMBuddy Facilitate coordination and communication by letting people request contextual information via IM –Interruptibility (via SUBTLE toolkit) –Location (via Place Lab WiFi positioning) –Active window Balance privacy with utility Few privacy concerns –Safe defaults –Often wanted to share more Currently developing Facebook widget

28. Mobile Social Computing inTouch System to facilitate awareness and communication for small groups –Dual-career families Real-time info about people Faster messaging using contextual information –Location, calendar, traffic, etc

29. Mobile Social Computing Whisper Social Event Service Help people with events when mobile –Find nearby social events –Notify friends of social events –Organize friends to go to events

30. Research Style Observe & understand how people actually use tech Design and implement systems Evaluate systems with users Iterate

31. Jason Hong jasonh@cs.cmu.edu Newell Simon Hall 2504D http://www.cs.cmu.edu/~jasonh/advice.html