1

Best Practices for Usable Security in Desktop Software

Simson L. GarfinkelDIMACS Workshop on

Usable Privacy and Security Software

Rutgers University

July 9, 2004,

2

Hypothesis

C, C++Failure to check

args, etc…

Common ProgrammingErrors

Buffer overflows,SQL injection,

etc…

Common SecurityErrors

??

Common Errors in UIand interaction design

Privacy compromises, lost

data, misconfigurations

…

Common SecurityErrors

If

Then…

3

Goals:

1. Identify common errors in UI design that create security and privacy failings.

2. Make it seem easy.

“Most really breakthrough conceptual advances are

opaque in foresight and transparent in hindsight.”

---Alan Cooper

4

Don’t lie to the user…(Aligning Interface, Information and Action)

ROADMAP:

1. Sanitizing disks and files

2. Sanitizing browser history

3. Spyware

5

Deletion and Sanitization

Why study deletion?– Affects everybody: we all have private or

security-critical information that needs to be deleted.

– Lots of lore, not a lot of good academic research.

6

Today’s desktop systems do a nice job on “delete”…

1. Start with an icon you want to delete

3. Trash icon changes

4. Right-click for empty6. File is gone

5. Confirm empty

2. Drag it to the trash

7

Double-click on “Recycle Bin” for more info…

Just like PGP 5.0: Good by conventional standards, but does not encourage secure computing practices…

Good feedback

Goodhelp

8

Recovery after confirmation…

Can you get back a file after you empty the trash?

Sure!

9

The Paradox of “Delete”

Delete

File can be recovered with “undelete” or forensic efforts.

Tossed files randomly get shred

Backups provide protection.

Intentionally overwritten file cannot be recovered from disk.

Special utilities overwrite slack space.

Backups don’t get shred.

Unlinks file from directory.

Put blocks on free list.

Allow space to reused.

Overwrites file blocks.

“Shred”“Toss”

Thanks to Clay Bennett at Christian Science Monitor

10

Sanitization is a big problem

“Remembrance” study:– 200 hard drives

purchased– more than 1/3 had data

that been deleted but could be recovered!

Hypothesis: data was there because of usability failures…

11

Drives in storage

200 drives

>80GB images(small drives)

12

DOS FORMAT misrepresents its functionality

A:\>format c:

WARNING, ALL DATA ON NON-REMOVABLE DISKDRIVE C: WILL BE LOST!proceed with Format (Y/N)?y

Formatting 1,007.96M100 percent completed.Writing out file allocation tableComplete.

“Data Passed” is a Usability Problem!

13

Approach #1: Distinguish “Toss” from “Shred”

Following publication of “Remembrance,” Apple added “Secure Empty Trash” to MacOS 10.3.

“Secure Empty” takes much longer than regular empty.

≈5 min instead of 5 sec

14

But separating is not enough…

Is this “toss” or “shred?”(“Empty Trash” or “Secure Empty Trash”)

Toss!

This is “Shred”

15

Other Problems with Separation

Apple’s approach was a “pasted on fix.”

Not consistently applied throughout user interface.

Doesn’t apply to other applications, unlink()

Users may not know what “Secure Empty Trash” means…

16

The dirty life of a disk block…

Free block pool

Allocated blocksunlink()

Trash Can directory

“Empty Trash”

“Secure Empty Trash”

scrubberNotice: Once a disk block is “emptied,” you can’t go back and “securely” empty it!

17

Alternative: Redesign the interaction

• Removed files go onto “old file” list.• Kernel grabs free blocks first, then blocks from “old files.”• Make “shred” an explicit operation at the interface.

– (extend to backup with individual encryption keys for each file)

(simulation)

QuickTime™ and aTIFF (LZW) decompressor

are needed to see this picture.

18

“Clean object reuse…”

Free pool of clean blocks

Allocated blocks

unlink()

Trash Can directory

block allocation

Scheduled shredding-or-

“Shred now”

Blocks awaiting shredder…

“Move trash to shredder…”

(simulation)

19

What about “whoops?”

“Darn! I didn’t mean to hit shred.”

Don’t use a “swat box”:

(“this action cannot be undone…”)

Instead:

(simulation)

QuickTime™ and aTIFF (LZW) decompressor

are needed to see this picture.

20

Best Practices

Distinguish “toss” from “shred.”

Don’t use a “swat box” to confirm an action that can’t be undone!

– It’s easier to beg for forgiveness than ask for permission– Let people change their minds.– “Polite Software Is Self-Confident”

(Cooper, p. 167)

≠

21

What else do you clear?“Files” can be tossed or shredded…

Clear History

“Erase my tracks.”

“History” is cleared…

22

IE: Clearing History1. Select “Internet Options”

2. Select “Clear History”

3. Confirm (no “undo”)

23

Clearing HistorySafari makes it easier.

Give the ability to remove personal information where it is displayed…

It’s obvious because you see it!

24

Interaction punsOne action means two things…

Clear History

Clear Cache

Clear Cookies

“Erase my tracks.”

Many actions for one thing…

25

Cache and Cookies are not obvious…

What’s a Cache?

Where’s the cache?... We’ve had a huge public education campaign to teach people about the “cache…”

26

Cache and Cookies are not obvious…

What’s a Cache?

27

Each History item points to its entry in the “cache”…

…

…disk blocks…

Clearing the history could automatically clear the cache.

28

But what about “Secure Empty Trash?”

“Clear History,” “Clear Cache” and “Reset Browser” don’t sanitize!

The privacy protecting features give a false sense of security.

Libraries

Kiosks

Shared Machines

29

Best Practices

Allow personal information to be corrected or deleted where it is shown.

If you “toss” potentially sensitive information, shred the bytes!

– Especially if you are tossing for privacy.

30

Spyware, Adware, and Informed Consent

What if the software tries to hide it’s activities?

31

Example 2: Gator and GAIN

GATOR eWallet?

“The Gator eWallet is provided free by GAIN Publishing.

“The Gator eWallet is part of the GAIN Network.

“This software also occasionally displays pop up ads on your computer screen based on your online behavior.”

32

Gator’s Disclosure on download page

33

Gator…

Comes with Gator eWallet, Precision Time, Date Manager, OfferCompanion, Weatherscope, and SearchScout Toolbar

34

Gator License Agreement…

Words: 6,645Key Provisions:

– Displays pop-up advertisements.

– Determines your interests by monitoring your web surfing behavior, including the URLs you type.

– Software updates itself

– Any use of a “packet sniffer” is “strictly prohibited”

PLEASE READ THE GAIN PUBLISHING PRIVACY STATEMENT AND END USER LICENSE AGREEMENT (COLLECTIVELY "Terms and Conditions") CAREFULLY AND MAKE SURE YOU UNDERSTAND THEM. THEY CONTAIN IMPORTANT INFORMATION THAT YOU SHOULD KNOW BEFORE ACCEPTING ANY GAIN-Supported Software (DEFINED BELOW).The GAIN Publishing Terms and Conditions describe the operation of the GAIN-Supported Software you are about to download and the terms and conditions that govern your use of this software. GAIN Publishing ("GP") provides you the opportunity to download a software product you desire at no charge or a reduced charge in return for your agreement to also download GP's software product which will periodically …

buried

35

“Here’s what we do know…

- Some of the Web pages viewed- The amount of time spent at some Web sites - Some click history, including responses to some online ads- Standard web log information and system settings (except

that IP addresses are not stored)- What software is on the personal computer (but no

information from those programs)- First name, country, city, and five digit ZIP - Non-personally identifiable information on Web pages and

forms- Software usage characteristics and preferences- For Gator(r) eWallet users, your master password, if you

choose to create one

36

People are bad at reading legal documents

Not a new problem!

Solution: - Standardized Labels of product actions.- Logos of special significance

37

1906 Pure Food and Drug Act

Required disclosure of narcotics and other substances.

“Warning --- May be Habit Forming”

(got the cocaine out of coca-cola)

http://www.cfsan.fda.gov/~lrd/history1.html

38

The Pure Software Act of 2006

Hook: Starts Automatically

Dial: Places a Call

Modify: Alters OS

Monitors you when not active program

Displays Pop-Ups

Remote Control

Self-Updates

Stuck: Cannot be Uninstalled

“ ”

(simulated

icons)

39

Gator with Icons

hook

monitorsPop-ups

Self-updates

(simulation)

40

Icons force disclosure of things that the lawyers might have forgotten. (e.g. )

Having an icon isn’t good or bad. (e.g. )

Notes on the icons…

41

Summary

Don’t lie to the user.

Rethink functionality beneath the interface.

Mandate disclosure of hidden functionality

Acknowledgements:Matthew Bouchard (icon design)

Alma Whitten (mentioned warning labels in “Why Johnny…”)Rob Miller, David Clark, Min Wu, Steven Bauer (MIT)

Jonathan Zittrain (Harvard Law)