Best Practices for Usable Security in Desktop Software

1. Best Practices for Usable Security in Desktop Software Simson L. Garfinkel DIMACS Workshop on Usable Privacy and Security Software Rutgers University July 9, 2004,

2. Hypothesis C, C++ Failure to check args, etc… Buffer overflows, SQL injection, etc… If Common Programming Errors Common Security Errors ?? Privacy compromises, lost data, misconfigurations… Then… Common Errors in UI and interaction design Common Security Errors

3. Goals: • Identify common errors in UI design that create security and privacy failings. • Make it seem easy. “Most really breakthrough conceptual advances are opaque in foresight and transparent in hindsight.”---Alan Cooper

4. Don’t lie to the user…(Aligning Interface, Information and Action) • ROADMAP: • Sanitizing disks and files • Sanitizing browser history • Spyware

5. Deletion and Sanitization • Why study deletion? • Affects everybody: we all have private or security-critical information that needs to be deleted. • Lots of lore, not a lot of good academic research.

6. Today’s desktop systems do a nice job on “delete”… 1. Start with an icon you want to delete 2. Drag it to the trash 3. Trash icon changes 5. Confirm empty 4. Right-click for empty 6. File is gone

7. Double-click on “Recycle Bin” for more info… • Just like PGP 5.0: Good by conventional standards, but does not encourage secure computing practices… Good help Good feedback

8. Recovery after confirmation… • Can you get back a file after you empty the trash? Sure!

9. File can be recovered with “undelete” or forensic efforts. Tossed files randomly get shred Backups provide protection. Intentionally overwritten file cannot be recovered from disk. Special utilities overwrite slack space. Backups don’t get shred. The Paradox of “Delete” Delete Unlinks file from directory. Put blocks on free list. Allow space to reused. Overwrites file blocks. “Toss” “Shred” Thanks to Clay Bennett at Christian Science Monitor

10. “Remembrance” study: 200 hard drives purchased more than 1/3 had data that been deleted but could be recovered! Hypothesis: data was there because of usability failures… Sanitization is a big problem

11. Drives in storage • 200 drives • >80GB images • (small drives)

12. DOS FORMAT misrepresents its functionality • A:\>format c: • WARNING, ALL DATA ON NON-REMOVABLE DISK • DRIVE C: WILL BE LOST! • proceed with Format (Y/N)?y • Formatting 1,007.96M • 100 percent completed. • Writing out file allocation table • Complete. • “Data Passed” is a Usability Problem!

13. Approach #1: Distinguish “Toss” from “Shred” • Following publication of “Remembrance,” Apple added “Secure Empty Trash” to MacOS 10.3. • “Secure Empty” takes much longer than regular empty. ≈5 min instead of 5 sec

14. But separating is not enough… Toss! Is this “toss” or “shred?” (“Empty Trash” or “Secure Empty Trash”) This is “Shred”

15. Other Problems with Separation • Apple’s approach was a “pasted on fix.” • Not consistently applied throughout user interface. • Doesn’t apply to other applications, unlink() • Users may not know what “Secure Empty Trash” means…

16. The dirty life of a disk block… Free block pool unlink() Allocated blocks Trash Can directory “Empty Trash” scrubber Notice: Once a disk block is “emptied,” you can’t go back and “securely” empty it! “Secure Empty Trash”

17. Alternative: Redesign the interaction • Removed files go onto “old file” list. • Kernel grabs free blocks first, then blocks from “old files.” • Make “shred” an explicit operation at the interface. • (extend to backup with individual encryption keys for each file) (simulation)

18. “Clean object reuse…” Free pool of clean blocks Allocated blocks unlink() Trash Can directory block allocation “Move trash to shredder…” Blocks awaiting shredder… Scheduled shredding -or- “Shred now” (simulation)

19. What about “whoops?” • “Darn! I didn’t mean to hit shred.” Don’t use a “swat box”: (“this action cannot be undone…”) Instead: (simulation)

20. Best Practices • Distinguish “toss” from “shred.” • Don’t use a “swat box” to confirm an action that can’t be undone! • It’s easier to beg for forgiveness than ask for permission • Let people change their minds. • “Polite Software Is Self-Confident” (Cooper, p. 167) ≠

21. What else do you clear? • “Files” can be tossed or shredded… • “History” is cleared… Clear History “Erase my tracks.”

22. IE: Clearing History 1. Select “Internet Options” 2. Select “Clear History” 3. Confirm (no “undo”)

23. Clearing History • Safari makes it easier. • Give the ability to remove personal information where it is displayed… • It’s obvious because you see it!

24. Interaction puns • One action means two things… • Many actions for one thing… Clear History Clear Cache “Erase my tracks.” Clear Cookies

25. Cache and Cookies are not obvious… We’ve had a huge public education campaign to teach people about the “cache…” • Where’s the cache?... What’s a Cache?

26. Cache and Cookies are not obvious… What’s a Cache?

27. Each History item points to its entry in the “cache”… …disk blocks… … Clearing the history could automatically clear the cache.

28. But what about “Secure Empty Trash?” • “Clear History,” “Clear Cache” and “Reset Browser” don’t sanitize! • The privacy protecting features give a false sense of security. Libraries  Kiosks Shared Machines

29. Best Practices • Allow personal information to be corrected or deleted where it is shown. • If you “toss” potentially sensitive information, shred the bytes! • Especially if you are tossing for privacy.

30. Spyware, Adware, and Informed Consent What if the software tries to hide it’s activities?

31. Example 2: Gator and GAIN • GATOR eWallet? • “The Gator eWallet is provided free by GAIN Publishing. • “The Gator eWallet is part of the GAIN Network. • “This software also occasionally displays pop up ads on your computer screen based on your online behavior.”

32. Gator’s Disclosure on download page

33. Gator… Comes with Gator eWallet, Precision Time, Date Manager, OfferCompanion, Weatherscope, and SearchScout Toolbar

34. Gator License Agreement… • Words: 6,645 • Key Provisions: • Displays pop-up advertisements. • Determines your interests by monitoring your web surfing behavior, including the URLs you type. • Software updates itself • Any use of a “packet sniffer” is “strictly prohibited” PLEASE READ THE GAIN PUBLISHING PRIVACY STATEMENT AND END USER LICENSE AGREEMENT (COLLECTIVELY "Terms and Conditions") CAREFULLY AND MAKE SURE YOU UNDERSTAND THEM. THEY CONTAIN IMPORTANT INFORMATION THAT YOU SHOULD KNOW BEFORE ACCEPTING ANY GAIN-Supported Software (DEFINED BELOW). The GAIN Publishing Terms and Conditions describe the operation of the GAIN-Supported Software you are about to download and the terms and conditions that govern your use of this software. GAIN Publishing ("GP") provides you the opportunity to download a software product you desire at no charge or a reduced charge in return for your agreement to also download GP's software product which will periodically … buried

35. “Here’s what we do know… • - Some of the Web pages viewed • - The amount of time spent at some Web sites • - Some click history, including responses to some online ads • - Standard web log information and system settings (except that IP addresses are not stored) • - What software is on the personal computer (but no information from those programs) • First name, country, city, and five digit ZIP • Non-personally identifiable information on Web pages and forms • - Software usage characteristics and preferences • - For Gator(r) eWallet users, your master password, if you choose to create one

36. Not a new problem! • People are bad at reading legal documents • Solution: • - Standardized Labels of product actions. • - Logos of special significance

37. 1906 Pure Food and Drug Act • Required disclosure of narcotics and other substances. • “Warning --- May be Habit Forming” • (got the cocaine out of coca-cola) http://www.cfsan.fda.gov/~lrd/history1.html

38. Hook: Starts Automatically Dial: Places a Call Modify: Alters OS Monitors you when not active program Displays Pop-Ups Remote Control Self-Updates Stuck: Cannot be Uninstalled The Pure Software Act of 2006 (simulated icons) S. Garfinkel, “The Pure Software Act of 2006”TechnologyReview.com, April 7, 2004 http://www.technologyreview.com/articles/wo_garfinkel040704.asp

39. Gator with Icons Pop-ups monitors Self-updates hook (simulation)

40. Notes on the icons… • Icons force disclosure of things that the lawyers might have forgotten. (e.g. ) • Having an icon isn’t good or bad. (e.g. )

41. Summary • Don’t lie to the user. • Rethink functionality beneath the interface. • Mandate disclosure of hidden functionality • Acknowledgements: Matthew Bouchard (icon design) Alma Whitten (mentioned warning labels in “Why Johnny…”) Rob Miller, David Clark, Min Wu, Steven Bauer (MIT) Jonathan Zittrain (Harvard Law)