Best Practices for Usable
Security in Desktop Software
Simson L. Garfinkel
DIMACS Workshop on
Usable Privacy and Security Software
Rutgers University
July 9, 2004,
1
Hypothesis
If
C, C++
Failure to check
args, etc…
Common Programming
Errors
Then…
??
Common Errors in UI
and interaction design
Buffer overflows,
SQL injection,
etc…
Common Security
Errors
Privacy
compromises, lost
data,
misconfigurations
…
Common Security
Errors
2
Goals:
1.
Identify common errors in UI
design that create security and
privacy failings.
2.
Make it seem easy.
“Most really breakthrough
conceptual advances are
opaque in foresight and
transparent in hindsight.”
---Alan Cooper
3
Don’t lie to the user…
(Aligning Interface, Information and Action)
ROADMAP:
1. Sanitizing disks and files
2. Sanitizing browser history
3. Spyware
4
Deletion and Sanitization
Why study deletion?
– Affects everybody: we all have private or
security-critical information that needs to be
deleted.
– Lots of lore, not a lot of good academic
research.
5
Today’s desktop systems do a
nice job on “delete”…
1. Start with an icon you want to delete
2. Drag it to the trash
3. Trash icon changes
5. Confirm empty
4. Right-click for empty
6. File is gone
6
Double-click on “Recycle Bin” for
more info…
Good
help
Good feedback
Just like PGP 5.0: Good by conventional standards, but does
not encourage secure computing practices…
7
Recovery after confirmation…
Can you get back a
file after you empty
the trash?
Sure!
8
The Paradox of “Delete”
Delete
Unlinks file from directory.
Put blocks on free list.
Allow space to reused.
Overwrites file blocks.
“Toss”
“Shred”
File can be recovered with
“undelete” or forensic efforts.
Intentionally overwritten file cannot
be recovered from disk.
Tossed files randomly get shred
Special utilities overwrite slack
space.
Backups provide protection.
Backups don’t get shred.
Thanks to Clay Bennett at Christian
Science Monitor
9
Sanitization is a big problem
“Remembrance” study:
– 200 hard drives
purchased
– more than 1/3 had data
that been deleted but
could be recovered!
Hypothesis: data was
there because of
usability failures…
10
Drives in storage
200 drives
>80GB images
(small drives)
11
DOS FORMAT
misrepresents its functionality
A:\>format c:
WARNING, ALL DATA ON NON-REMOVABLE DISK
DRIVE C: WILL BE LOST!
proceed with Format (Y/N)?y
Formatting 1,007.96M
100 percent completed.
Writing out file allocation table
Complete.
“Data Passed” is a Usability Problem!
12
Approach #1: Distinguish
“Toss” from “Shred”
Following publication of
“Remembrance,” Apple
added “Secure Empty
Trash” to MacOS 10.3.
“Secure Empty” takes
much longer than regular
empty.
≈5 min instead of 5 sec
13
But separating is not enough…
Toss!
Is this “toss” or “shred?”
(“Empty Trash” or “Secure Empty Trash”)
This is
“Shred”
14
Other Problems with Separation
Apple’s approach was a “pasted
on fix.”
Not consistently applied
throughout user interface.
Doesn’t apply to other
applications, unlink()
Users may not know what
“Secure Empty Trash” means…
15
The dirty life of a disk block…
Free block pool
unlink()
Allocated blocks
Trash Can directory
“Empty Trash”
Notice: Once a disk
block is “emptied,”
you can’t go back and
“securely” empty it!
scrubber
“Secure Empty Trash”
16
Alternative:
Redesign the interaction
QuickTime™ and a
TIFF (LZW) decompressor
are needed to see this picture.
(simulation)
• Removed files go onto “old file” list.
• Kernel grabs free blocks first, then blocks from “old files.”
• Make “shred” an explicit operation at the interface.
– (extend to backup with individual encryption keys for each file)
17
“Clean object reuse…”
Free pool of clean blocks
Allocated blocks
unlink()
Trash Can directory
block allocation
“Move trash to shredder…”
Blocks awaiting shredder…
Scheduled shredding
-or“Shred now”
(simulation)
18
What about “whoops?”
“Darn! I didn’t mean to hit shred.”
Don’t use a
“swat box”:
(“this action cannot be
undone…”)
QuickTime™ and a
TIFF (LZW) decompressor
are needed to see this picture.
Instead:
(simulation)
19
Best Practices
Distinguish “toss” from “shred.”
≠
Don’t use a “swat box” to confirm an
action that can’t be undone!
– It’s easier to beg for forgiveness than ask for permission
– Let people change their minds.
– “Polite Software Is Self-Confident”
(Cooper, p. 167)
20
What else do you clear?
“Files” can be tossed or shredded…
“History” is cleared…
Clear History
“Erase my tracks.”
21
IE: Clearing History
1. Select “Internet Options”
2. Select “Clear History”
3. Confirm (no “undo”)
22
Clearing History
Safari makes it easier.
Give the ability to remove
personal information where
it is displayed…
It’s obvious because you
see it!
23
Interaction puns
One action means two things…
Many actions for one thing…
Clear History
Clear Cache
“Erase my tracks.”
Clear Cookies
24
Cache and Cookies are not
obvious…
Where’s the cache?...
We’ve had a huge
public education
campaign to teach
people about the
“cache…”
What’s a
Cache?
25
Cache and Cookies are not
obvious…
What’s a
Cache?
26
Each History item points to its entry
in the “cache”…
…disk blocks…
…
Clearing the history could
automatically clear the cache.
27
But what about “Secure Empty Trash?”
“Clear History,”
“Clear Cache” and
“Reset Browser” don’t
sanitize!
The privacy protecting
features give a false
sense of security.
Libraries
Kiosks
Shared Machines
28
Best Practices
Allow personal information to be corrected
or deleted where it is shown.
If you “toss” potentially sensitive
information, shred the bytes!
– Especially if you are tossing for privacy.
29
Spyware, Adware, and
Informed Consent
What if the software tries to hide
it’s activities?
30
Example 2: Gator and GAIN
GATOR eWallet?
“The Gator eWallet is
provided free by GAIN
Publishing.
“The Gator eWallet is part
of the GAIN Network.
“This software also
occasionally displays pop
up ads on your computer
screen based on your
online behavior.”
31
Gator’s Disclosure
on download page
32
Gator…
Comes with Gator eWallet,
Precision Time, Date Manager,
OfferCompanion,
Weatherscope, and
SearchScout Toolbar
33
Gator License Agreement…
Words: 6,645
Key Provisions:
– Displays pop-up advertisements.
– Determines your interests by
monitoring your web surfing behavior,
including the URLs you type.
– Software updates itself
– Any use of a “packet sniffer” is
“strictly prohibited”
PLEASE READ THE GAIN PUBLISHING
PRIVACY STATEMENT AND END USER
LICENSE AGREEMENT (COLLECTIVELY
"Terms and Conditions") CAREFULLY
AND MAKE SURE YOU UNDERSTAND
THEM. THEY CONTAIN IMPORTANT
INFORMATION THAT YOU SHOULD
KNOW BEFORE ACCEPTING ANY
GAIN-Supported Software (DEFINED
BELOW).
The GAIN Publishing Terms and
Conditions describe the operation of the
GAIN-Supported Software you are about
to download and the terms and conditions
that govern your use of this software.
GAIN Publishing ("GP") provides you the
opportunity to download a software
product you desire at no charge or a
reduced charge in return for your
agreement to also download GP's
software product which will periodically …
buried
34
“Here’s what we do know…
-
-
Some of the Web pages viewed
The amount of time spent at some Web sites
Some click history, including responses to some online ads
Standard web log information and system settings (except
that IP addresses are not stored)
What software is on the personal computer (but no
information from those programs)
First name, country, city, and five digit ZIP
Non-personally identifiable information on Web pages and
forms
Software usage characteristics and preferences
For Gator(r) eWallet users, your master password, if you
choose to create one
35
Not a new problem!
People are bad at
reading legal documents
Solution:
- Standardized Labels of
product actions.
- Logos of special
significance
36
1906 Pure Food and Drug Act
Required disclosure of narcotics
and other substances.
“Warning --- May be Habit Forming”
(got the cocaine out of coca-cola)
http://www.cfsan.fda.gov/~lrd/history1.html
37
The Pure Software Act of 2006
Hook: Starts
Automatically
Displays Pop-Ups
Remote Control
Dial: Places a Call
Modify: Alters OS
Monitors you when
not active program
Self-Updates
Stuck: Cannot be
Uninstalled


gyRvmp7
4
p://gyvm
38
Gator with Icons
monitors
Popups
hook
Selfupdates
(simulation)
39
Notes on the icons…
Icons force disclosure of things that the
lawyers might have forgotten. (e.g.
)
Having an icon isn’t good or bad. (e.g.
)
40
Summary
Don’t lie to the user.
Rethink functionality beneath the interface.
Mandate disclosure of hidden functionality
Acknowledgements:
Matthew Bouchard (icon design)
Alma Whitten (mentioned warning labels in “Why Johnny…”)
Rob Miller, David Clark, Min Wu, Steven Bauer (MIT)
Jonathan Zittrain (Harvard Law)
41