1 best practices for usable security in desktop software simson l. garfinkel dimacs workshop on...
TRANSCRIPT
1
Best Practices for Usable Security in Desktop Software
Simson L. GarfinkelDIMACS Workshop on
Usable Privacy and Security Software
Rutgers University
July 9, 2004,
2
Hypothesis
C, C++Failure to check
args, etc…
Common ProgrammingErrors
Buffer overflows,SQL injection,
etc…
Common SecurityErrors
??
Common Errors in UIand interaction design
Privacy compromises, lost
data, misconfigurations
…
Common SecurityErrors
If
Then…
3
Goals:
1. Identify common errors in UI design that create security and privacy failings.
2. Make it seem easy.
“Most really breakthrough conceptual advances are
opaque in foresight and transparent in hindsight.”
---Alan Cooper
4
Don’t lie to the user…(Aligning Interface, Information and Action)
ROADMAP:
1. Sanitizing disks and files
2. Sanitizing browser history
3. Spyware
5
Deletion and Sanitization
Why study deletion?– Affects everybody: we all have private or
security-critical information that needs to be deleted.
– Lots of lore, not a lot of good academic research.
6
Today’s desktop systems do a nice job on “delete”…
1. Start with an icon you want to delete
3. Trash icon changes
4. Right-click for empty6. File is gone
5. Confirm empty
2. Drag it to the trash
7
Double-click on “Recycle Bin” for more info…
Just like PGP 5.0: Good by conventional standards, but does not encourage secure computing practices…
Good feedback
Goodhelp
8
Recovery after confirmation…
Can you get back a file after you empty the trash?
Sure!
9
The Paradox of “Delete”
Delete
File can be recovered with “undelete” or forensic efforts.
Tossed files randomly get shred
Backups provide protection.
Intentionally overwritten file cannot be recovered from disk.
Special utilities overwrite slack space.
Backups don’t get shred.
Unlinks file from directory.
Put blocks on free list.
Allow space to reused.
Overwrites file blocks.
“Shred”“Toss”
Thanks to Clay Bennett at Christian Science Monitor
10
Sanitization is a big problem
“Remembrance” study:– 200 hard drives
purchased– more than 1/3 had data
that been deleted but could be recovered!
Hypothesis: data was there because of usability failures…
11
Drives in storage
200 drives
>80GB images(small drives)
12
DOS FORMAT misrepresents its functionality
A:\>format c:
WARNING, ALL DATA ON NON-REMOVABLE DISKDRIVE C: WILL BE LOST!proceed with Format (Y/N)?y
Formatting 1,007.96M100 percent completed.Writing out file allocation tableComplete.
“Data Passed” is a Usability Problem!
13
Approach #1: Distinguish “Toss” from “Shred”
Following publication of “Remembrance,” Apple added “Secure Empty Trash” to MacOS 10.3.
“Secure Empty” takes much longer than regular empty.
≈5 min instead of 5 sec
14
But separating is not enough…
Is this “toss” or “shred?”(“Empty Trash” or “Secure Empty Trash”)
Toss!
This is “Shred”
15
Other Problems with Separation
Apple’s approach was a “pasted on fix.”
Not consistently applied throughout user interface.
Doesn’t apply to other applications, unlink()
Users may not know what “Secure Empty Trash” means…
16
The dirty life of a disk block…
Free block pool
Allocated blocksunlink()
Trash Can directory
“Empty Trash”
“Secure Empty Trash”
scrubberNotice: Once a disk block is “emptied,” you can’t go back and “securely” empty it!
17
Alternative: Redesign the interaction
• Removed files go onto “old file” list.• Kernel grabs free blocks first, then blocks from “old files.”• Make “shred” an explicit operation at the interface.
– (extend to backup with individual encryption keys for each file)
(simulation)
QuickTime™ and aTIFF (LZW) decompressor
are needed to see this picture.
18
“Clean object reuse…”
Free pool of clean blocks
Allocated blocks
unlink()
Trash Can directory
block allocation
Scheduled shredding-or-
“Shred now”
Blocks awaiting shredder…
“Move trash to shredder…”
(simulation)
19
What about “whoops?”
“Darn! I didn’t mean to hit shred.”
Don’t use a “swat box”:
(“this action cannot be undone…”)
Instead:
(simulation)
QuickTime™ and aTIFF (LZW) decompressor
are needed to see this picture.
20
Best Practices
Distinguish “toss” from “shred.”
Don’t use a “swat box” to confirm an action that can’t be undone!
– It’s easier to beg for forgiveness than ask for permission– Let people change their minds.– “Polite Software Is Self-Confident”
(Cooper, p. 167)
≠
21
What else do you clear?“Files” can be tossed or shredded…
Clear History
“Erase my tracks.”
“History” is cleared…
22
IE: Clearing History1. Select “Internet Options”
2. Select “Clear History”
3. Confirm (no “undo”)
23
Clearing HistorySafari makes it easier.
Give the ability to remove personal information where it is displayed…
It’s obvious because you see it!
24
Interaction punsOne action means two things…
Clear History
Clear Cache
Clear Cookies
“Erase my tracks.”
Many actions for one thing…
25
Cache and Cookies are not obvious…
What’s a Cache?
Where’s the cache?... We’ve had a huge public education campaign to teach people about the “cache…”
26
Cache and Cookies are not obvious…
What’s a Cache?
27
Each History item points to its entry in the “cache”…
…
…disk blocks…
Clearing the history could automatically clear the cache.
28
But what about “Secure Empty Trash?”
“Clear History,” “Clear Cache” and “Reset Browser” don’t sanitize!
The privacy protecting features give a false sense of security.
Libraries
Kiosks
Shared Machines
29
Best Practices
Allow personal information to be corrected or deleted where it is shown.
If you “toss” potentially sensitive information, shred the bytes!
– Especially if you are tossing for privacy.
30
Spyware, Adware, and Informed Consent
What if the software tries to hide it’s activities?
31
Example 2: Gator and GAIN
GATOR eWallet?
“The Gator eWallet is provided free by GAIN Publishing.
“The Gator eWallet is part of the GAIN Network.
“This software also occasionally displays pop up ads on your computer screen based on your online behavior.”
32
Gator’s Disclosure on download page
33
Gator…
Comes with Gator eWallet, Precision Time, Date Manager, OfferCompanion, Weatherscope, and SearchScout Toolbar
34
Gator License Agreement…
Words: 6,645Key Provisions:
– Displays pop-up advertisements.
– Determines your interests by monitoring your web surfing behavior, including the URLs you type.
– Software updates itself
– Any use of a “packet sniffer” is “strictly prohibited”
PLEASE READ THE GAIN PUBLISHING PRIVACY STATEMENT AND END USER LICENSE AGREEMENT (COLLECTIVELY "Terms and Conditions") CAREFULLY AND MAKE SURE YOU UNDERSTAND THEM. THEY CONTAIN IMPORTANT INFORMATION THAT YOU SHOULD KNOW BEFORE ACCEPTING ANY GAIN-Supported Software (DEFINED BELOW).The GAIN Publishing Terms and Conditions describe the operation of the GAIN-Supported Software you are about to download and the terms and conditions that govern your use of this software. GAIN Publishing ("GP") provides you the opportunity to download a software product you desire at no charge or a reduced charge in return for your agreement to also download GP's software product which will periodically …
buried
35
“Here’s what we do know…
- Some of the Web pages viewed- The amount of time spent at some Web sites - Some click history, including responses to some online ads- Standard web log information and system settings (except
that IP addresses are not stored)- What software is on the personal computer (but no
information from those programs)- First name, country, city, and five digit ZIP - Non-personally identifiable information on Web pages and
forms- Software usage characteristics and preferences- For Gator(r) eWallet users, your master password, if you
choose to create one
36
People are bad at reading legal documents
Not a new problem!
Solution: - Standardized Labels of product actions.- Logos of special significance
37
1906 Pure Food and Drug Act
Required disclosure of narcotics and other substances.
“Warning --- May be Habit Forming”
(got the cocaine out of coca-cola)
http://www.cfsan.fda.gov/~lrd/history1.html
38
The Pure Software Act of 2006
Hook: Starts Automatically
Dial: Places a Call
Modify: Alters OS
Monitors you when not active program
Displays Pop-Ups
Remote Control
Self-Updates
Stuck: Cannot be Uninstalled
“ ”
(simulated
icons)
39
Gator with Icons
hook
monitorsPop-ups
Self-updates
(simulation)
40
Icons force disclosure of things that the lawyers might have forgotten. (e.g. )
Having an icon isn’t good or bad. (e.g. )
Notes on the icons…
41
Summary
Don’t lie to the user.
Rethink functionality beneath the interface.
Mandate disclosure of hidden functionality
Acknowledgements:Matthew Bouchard (icon design)
Alma Whitten (mentioned warning labels in “Why Johnny…”)Rob Miller, David Clark, Min Wu, Steven Bauer (MIT)
Jonathan Zittrain (Harvard Law)