% Notes:
% FAQ is online and part of TeX distribution. Google for Seminar-FAQ.
% http://www-robotics.usc.edu/~gerkey/tools/saynotopowerpoint.html
% http://www.amath.washington.edu/~medlock/presentation.html
% http://www-sp.iti.informatik.tu-darmstadt.de/software/ppower4/

% Issues in using seminar with pdflatex:
% Why you want to do it:
%    - pdflatex handles most image formats (except EPS) natively!
%    (convert your EPS files to PDF files with epstopdf)
%    - pdflatex gives you consistent handling of color, etc. (Normal
%    latex does this in the dvips driver, which can cause problems
%    since there are so many different drivers.)
%    - pdflatex is faster than running latex, dvi2ps, pstopdf.


% Get colors from:
% /usr/local/teTeX/share/texmf.tetex/tex/plain/pdfcolor/pdfcolor.tex
% This defines a whole number of color macros


\documentclass[25pt,landscape]{foils}
% Acceptable options: 20pt, 25pt, 30pt, landscape

% Other options: headrule, footrule, 30pt
\usepackage{helvet}		% helvetica
\usepackage{geometry}		% easier to specify numbers
\usepackage{graphicx}		% better graphics importing
\usepackage{url}
\usepackage{tabularx}		% Tables that can extend 
\usepackage{graphicx}		% getter importing of graphics
\usepackage{parskip}		% don't indent paragraphs
\usepackage{pause}		% for ppower4
\usepackage{pp4link}		% also for ppower4
\usepackage{alltt}		% a better verbatim
\usepackage{mpmulti}


\usepackage{pifont}
\renewcommand{\labelitemi}{\Pisymbol{psy}{183}}  %Bullet in PostScript
\renewcommand{\labelitemii}{\Pisymbol{psy}{183}}  %Bullet in PostScript
\renewcommand{\labelitemiii}{\Pisymbol{psy}{183}}  %Bullet in PostScript



\input{pdfcolor}		% named color for pdflatex

\newenvironment{points}{\begin{itemize}
\setlength{\itemsep}{0.0ex}
\setlength{\parskip}{0.5ex}
}{\end{itemize}}

\newenvironment{code}{
  \begin{center}
  \begin{alltt}
  \fontsize{8}{8}\selectfont
}{
  \end{alltt}
  \end{center}
}

\raggedright			% because it looks better


\geometry{headsep=3ex,hscale=0.9}
\geometry{noheadfoot}
\geometry{bottom=2pc}

% Set the lengths
% \foilheadskip - between foil head and first line
% \parskip - between paragraphs
% \itemsep - between items

\setlength{\foilheadskip}{0ex minus -.5in}     
\setlength{\parskip}{1ex plus 2ex}
\setlength{\itemsep}{0ex}



% This one will give you white text on a blue background:
% \usepackage{background}
% \pagecolor{color} - for solid color
% \vpagecolor[color1]{color2} for vertical gradient
% \hpagecolor[color1]{color2} for horizontal gradient
% 
% Note: Using \pagecolor will break backgrounds in PPower4
%
% Here is where you set up your slides template:
% (don't forget headrule & footrule above)

%\leftheader{leftheader}
%\rightfooter{rightfooter}
%\rightheader{rightheader}
\MyLogo{}		% easy to turn on and off.

%\Restriction{\vspace{2pc}\\ \copyright 2004 Simson L. Garfinkel}


% Some marks that I care about
\newcommand{\checkmark}{\Pisymbol{pzd}{52}}
\newcommand{\xmark}{\Pisymbol{pzd}{56}}
\newcommand{\bcheck}{\textcolor{blue}{\Pisymbol{pzd}{52}}}
\newcommand{\bcheckmark}{\textcolor{blue}{\Pisymbol{pzd}{52}}}
\newcommand{\bluecheckmark}{\textcolor{blue}{\Pisymbol{pzd}{52}}}
\newcommand{\rxmark}{\textcolor{red}{\Pisymbol{pzd}{56}}}
\newcommand{\redxmark}{\textcolor{red}{\Pisymbol{pzd}{56}}}
\newcommand{\bluerightarrow}{\textcolor{blue}{\Pisymbol{pzd}{212}}}
\newcommand{\blackrightarrow}{\Pisymbol{pzd}{212}}
\newcommand{\redrightarrow}{\textcolor{red}{\Pisymbol{pzd}{212}}}
\newcommand{\blackhalfmoon}{\textcolor{black}{\Pisymbol{pzd}{119}}}
\usepackage{hyperref}      % documentation suggests use this just before document

\def\compactify{\itemsep=0pt \topsep=0pt \partopsep=0pt \parsep=0pt}
\newcommand{\centergraphic}[1]{
  \begin{center}
    \includegraphics[height=4in]{#1}
  \end{center}
}

\newcommand{\centerstuff}[1]{
 \vfill
 \begin{center}
 #1\\
 \end{center}
 \vfill
}


\newcommand{\centerbullets}[1]{
  \vfill
  \begin{center}
  \begin{itemize}
  \compactify
  \raggedright
  #1
  \end{itemize}
  \end{center}
  \vfill
}

\newcommand{\sidebyside}[2]{
  \vfill
  \begin{minipage}{.45\textwidth}
   \setlength{\parskip}{1ex plus 2ex}
   \raggedright
  {#1}
  \end{minipage}
  \begin{minipage}{.45\textwidth}
   \setlength{\parskip}{1ex plus 2ex}
   \raggedright
  {#2}
  \end{minipage}
  \vfill
}

\newcommand{\tgraphic}[2][width=\textwidth]{
  \begin{center}
  \includegraphics[#1]{../images/#2}
  \end{center}
}
\newcommand{\sgraphic}[2][width=\textwidth]{
  \begin{center}
  \includegraphics[#1]{#2}
  \end{center}
}



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%
%%% Slide assembling macros
%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\newcommand{\slide}[1]{
  \foilhead{}
    \begin{minipage}{\textwidth}
      \raggedright
      \textbf{\Maroon #1 \Black }
    \end{minipage}\\[3pc]
}

\newcommand{\bottom}[1]{
  \vfill
  \begin{minipage}{\textwidth}
    \raggedright
    \textbf{\Maroon #1 \Black }
  \end{minipage}\\[3pc]
}

\begin{document}


\slide{Aligning Security and Usability with Key Continuity
  Management}

\vfill
  \hfill\tgraphic[width=.5\textwidth]{johnny2/message2-engaged-only}
\vfill

{\large Simson L. Garfinkel} \\
MIT Computer Science and Artificial Intelligence Laboratory \\
\url{http://www.simson.net/}


\slide{I've been doing security \& Usability. what happens if this is
  more than a paragraph long? what happens? What really happens?}

There seem to be two main ways that this work has proceeded:
\begin{points}
\item[\rxmark] Work on authentication (hard problem)
\item[\rxmark] Work on new interfaces
\item[\rxmark] Work on underlying rules and principles
\end{points}

\slide{I'm taking a different track for aligning security and usability:}
\begin{points}
\item[\bcheck]
Re-evaluating underlying models and mechanisms so that we can get
more security with our existing interfaces.
\end{points}

\slide{First project: Hard drive deletion}
I purchased 250+ hard drives on the secondary market between 1998 and
2002.

\sidebyside{
\small
\begin{points}
\item Many of the disks contained confidential information [Garfinkel \& Shelat, IEEE S\&P '03]
\item Most of the confidential information could only be recovered
  using forensic tools.
\item Hypothesis: people had been trying to erase the info, but their tools were
  not very good.
\end{points}
}{\tgraphic{drives/shelf}}

\bottom{The trace-back study revealed that many cases involved
  the failure of a trusted organization or individual to correctly
  sanitize the drive before disposing of it.}


\slide{This is called the ``Oliver North Problem''}

\sidebyside{
\setlength{\parskip}{1ex plus 2ex}
\small ``We all sincerely believed that when we send a PROFS message to
another party and pressed the button 'delete' that it was gone
forever. 

Wow, were we wrong.''  \\ \hfill--- Oliver North
}{\sgraphic{north}}


\slide{This presentation explores another technique for aligning
  usability and security: Key Continuity Management}

\sidebyside{
  Why KCM can help solve the secure messaging problem
  }{\sgraphic[height=2in]{carl-carl-arrows}}

\sidebyside{
  CoPilot: Implementing KCM with S/MIME and Outlook Express
  }{\tgraphic[height=2in]{johnny2/message2-engaged-only}}

\sidebyside{Johnny 2: A user test of KCM}{
  \tgraphic[width=2in]{johnny2/DSCN0235}}

\slide{Secure Messaging --- email that is \emph{signed} and
  \emph{sealed} --- seems to be the grand challenge of usability and security.}

\begin{points}
\item Public key cryptography was developed for secure messaging.
\item This project is nearly thirty years old:
\begin{points}
\item[\bluerightarrow] 1976 --- Diffie Helman
\item[\bluerightarrow]  1977 --- RSA
\item[\bluerightarrow]  1987 --- RFC 989 (PEM)
\item[\bluerightarrow]  1991 --- PGP Released
\item[\bluerightarrow]  1996 --- S/MIME
\end{points}
\item Today we sign code and use SSH, but there's little secure email.
\end{points}

\bottom{Either it's really hard to get this right, or nobody really cares.}

\slide{Amazon.com merchants care about email security. \\ (Garfinkel et al, FC05)}
Amazon Merchants want email security:
\begin{points}
\item 58.8\% thought that email receipts from online merchants should be
digitally signed.
\item 46.8\% thought receipts should be sealed
\end{points}

And Amazon Merchants have the tools --- sort of.
\begin{points}
\item 44.9\% respondents would upgrade their email client to get more
  security.
\item 54\% of those using S/MIME-capable mail clients didn't know that
  they could receive digitally signed mail!
\end{points}

\slide{We should also want email security, because security could help
  with the largest security threats we face today:}
\begin{points}
\item Phishing
\item Spam
\end{points}
\bottom{(These threats can be addressed with signing alone.)}

\slide{So email security must be a hard problem\ldots}
\sidebyside{
Peter Gutmann argues that it's the certification hierarchy that's the
fundamental usability problem 

}{\sgraphic{use_ssl}}
STARTTLS in SMTP, POP and IMAP has secured far more email than S/MIME
or PGP. Most of these certificates appear to be self-signed.

\slide{Perhaps the problem is that the CA approach is fundamentally
  not very usable.}

Recall that a certificate is a statement signed by a CA that binds a
  key to a particular Common Name (CN):

\sgraphic[width=6in]{maria-ben-keys}

\bottom{The theory is that humans understand names, not public keys.}

\slide{Carl Ellison argues that certified names are useless because
  names are not unique, not even within a company:}
\sgraphic[width=6in]{carl-carl-keys}

\bottom{Certification has proven to be the hard problem that
   gating secure email.}

\slide{An alternative is to directly certify relationships:}

\sgraphic[width=6in]{carl-carl-arrows}

\bottom{We rarely want to send confidential information on the first email, 
  before we know that the person can receive it, that they are
  reading their mail, etc.
}

\slide{PGP avoided this problem}
\sidebyside{
Phil Zimmerman handed me PGP 2.0 on a floppy with his key.

At that same party, somebody else gave me their key's fingerprint
on a business card.
}{\sgraphic{hand-with-floppy}}

\bottom{Today if you want to email somebody, you get their PGP key off
   their web page --- or ask them to email you their PGP key.}

\slide{The Stream SMTP and POP transparent proxy was a kind of
  automatic PGP assistant. [Garfinkel DGo'03]}

Stream:
\begin{points}
\item[\bcheckmark] Made PGP keys on the fly when it detected new From: address; 
\item[\bcheckmark] Hid user's PGP key in the outgoing email header.
\item[\bcheckmark] Automatically incorporated keys that were discovered.
\end{points}
~\\
Planned but never implemented:
\begin{points}
\item[\bluerightarrow] Alert user if a correspondent's key changes.
\item[\bluerightarrow] Automatically distribute and back up private keys.
\end{points}

\bottom{The real problem with Stream was that PGP has poor
  penetration and poor usability.}

\slide{Most of Stream's goals can be achieved with S/MIME, by changing
  the certification model.}
\begin{points}
\item S/MIME distributes certificates by sending them with signed mail.
\item You need is a transparent, zero-click way to make new
  certificates:

\begin{points}
\item Option 1: create self-signed certificates.
\item Option 2: Some sort of automatic email answer-back system.
\end{points}

\item You need an expert that watches the certificates used for
  signing and alerts on new \verb+(cert, addr)+ combinations.
\end{points}

\slide{CoPilot Implements the Key Continuation Management interface on
top Outlook Express.}
\sidebyside{
  \tgraphic[height=2in]{johnny2/message1-engaged-only}New Key}{
  \tgraphic[height=2in]{johnny2/message2-engaged-only}Same Key}
\sidebyside{
  \tgraphic[height=2in]{johnny2/message4-engaged-only}Changed Key}{
  \tgraphic[height=2in]{johnny2/message6-engaged-only}Gray Key}


\slide{Unfortunately, this interface creates a number of attacks}
\begin{points}
\item New Key Attack
\item New Identity Attack
\item Unsigned Message Attack
\end{points}

\bottom{So now we have something we can test --- can people resist
  these attacks?}

\slide{The original plan: Test with Whitten's ``Why Johnny Can't
  Encrypt'' protocol} 
\sidebyside{
  \begin{points}
  \item It's a great experimental scenario
  \item Use \emph{Johnny} as our control group: see if KCM
    has a higher success rate and lower spoof rate than PGP. 
  \end{points}
  }{\sgraphic{whitten-p1}}

\slide{This didn't work}
\begin{points}
\item \emph{Johnny} didn't have an attacker
\item \emph{Johnny} didn't use third-party certification --- it used email
  answerback certification. 
\end{points}
\bottom{You have to wonder why the scenario's Campaign was using
  encryption at all!} 

\slide{The Johnny 2 Scenario:}
It's Alma's Scenario, except:
\begin{points}
\item The personas are developed
\item There are good guys and bad guys
\item The bad guys are trying to spoof the experimental subject.
\end{points}

\slide{Big Questions to answer:}
What will the users do when faced with the attacks?

\begin{points}
\item New Key Attack --- Attacker Paul says that he is having computer
  problems (new key, old email address).
\item New Identity Attack --- Attacker Sarah says she is working from
  home and using Hotmail.
\item Unsigned Message Attack --- Attacker Maria sends mail from her
  Campaign account, but it's not signed.
\end{points}



\slide{Other questions that we can answer with the \emph{Johnny 2} scenario:}
\begin{points}
\item Do users understand the difference between signing and sealing?

\item If users can trivially sign and/or seal their email, will they?

\item If users can seal confidential information before they send it, will
they be less concerned about the destination?
\end{points}


\slide{The big question we don't need to answer:}
Is it just as secure as CA model? 

\vspace{1in}

This isn't a fair question\ldots

\begin{points}
\item \ldots KCM doesn't replace the CA model, it replaces no crypto at all.
\item \ldots You can \emph{still} use the CA model, if you can find a
  CA.
\end{points}

\slide{Johnny 2 User Study}
\sidebyside{
Subjects recruited by posters at MIT.

43 subjects aged 18--63 (average TK, sigma TK)

min max average time

Subjects paid \$20 
}{ \tgraphic{johnny2/poster}}

\slide{Three Cohorts were compared for
  statistically-significant differences.}
  
\begin{tabular}{ccc}
No Color & Color & Color + Briefing \\
\includegraphics[width=2.75in]{../images/johnny2/message2-control-only} &
\includegraphics[width=2.75in]{../images/johnny2/message2-engaged-only} &
\includegraphics[width=2.75in]{../images/johnny2/message2-engaged-only} \\
& & 
\fcolorbox{black}{green}{
\begin{minipage}{2.40in}
\tiny A Green Border will appear around an email message each successive
time that a particular Digital ID is used with an email address.
\end{minipage} 
}\\
& & \\
\end{tabular}

\slide{Scenario Message 1: \\Greetings from Maria Page}
  \tgraphic[width=6in]{johnny2/message1-engaged-only}
\bottom{Orients user and provides list of campaign worker roles.}

\slide{Scenario Message 2: \\Maria sends the schedule}
  \tgraphic[width=6in]{johnny2/message2-engaged-only}
\bottom{Tests to see if the subject can follow directions.}

\slide{Scenario Message 3: \\Ben asks for the schedule}
  \tgraphic[width=6in]{johnny2/message3-engaged-only}
\bottom{Tests to see if the subject will trust a legitimately
  signed message}

\slide{Scenario Message 4: \\Attacker Paul asks for schedule}
  \tgraphic[width=6in]{johnny2/message4-engaged-only}
\bottom{New Key Attack \\ (unfortunately combined with a Reply-To: attack}

\slide{Scenario Message 5: \\Attacker Sarah asks for schedule}
  \tgraphic[width=6in]{johnny2/message5-engaged-only}
\bottom{New identity attack}

\slide{Scenario Message 6: \\Attacker Maria demands that schedule
be sent to attackers Paul and Sarah}
  \tgraphic[width=6in]{johnny2/message6-engaged-only}
\bottom{Unsigned message attack}

\slide{Scenario Message 7: \\Maria Page asks that schedule be sent
  to Sarah and Ben}
  \tgraphic[width=6in]{johnny2/message7-engaged-only}
\bottom{Another set of test messages}

\slide{Scenario Message 8: \\Maria Page thanks the subject}
  \tgraphic[width=6in]{johnny2/message8-engaged-only}
\bottom{This proved to be a nice way to end the experiment.}

\slide{Results, Task Comprehension:}
Most subjects:

\begin{points}
\item Understood and enjoyed the scenario.
\item Understood the concept of a ``signed message'' as
   authenticating the sender. 
\item Didn't realize that signing prevented message modification
\end{points}

Many people who were attacked didn't realize it at all; some realized it after-the-fact.

\slide{Authentication Approaches Chosen:}

 Many users struggled for some way to verify the authenticity of the
   messages 

Very few people looked at the OE certificate tools.

 Many tried Email answer-back.

 Some asked for the phone.

\slide{Well, we didn't let them use the phone}

\vfill
\tgraphic[height=3in]{johnny2/DSCN0235}
\vfill
\tgraphic[height=3in]{johnny2/DSCN0236}
\vfill


\slide{KCM was very successful against the New Key Attack:}

  
\begin{tabular}{ccc}
No Color & Color & Color + Briefing \\
\includegraphics[width=2.75in]{../images/johnny2/message4-control-only} &
\includegraphics[width=2.75in]{../images/johnny2/message4-engaged-only} &
\includegraphics[width=2.75in]{../images/johnny2/message4-engaged-only} \\
& & 
\fcolorbox{black}{red}{
\begin{minipage}{2.40in}
\tiny A Red Border will appear around an email message if the Digital ID
used with that email address changes. This might indicate that the
sender has moved to a different computer, or that someone else is
trying to impersonate the sender.
\end{minipage} 
}\\
& & \\

 71\%  & 64\%  &  13\% \\
\multicolumn{3}{c}{Rate of successful attack} \\
\multicolumn{3}{c}{$p = 0.001$}
\end{tabular}



\slide{KCM works well against the Unsigned Message Attack:}
\definecolor{mygray}{cmyk}{0,0,0,0.1}


\begin{tabular}{ccc}
No Color & Color & Color + Briefing \\
\includegraphics[width=2.75in]{../images/johnny2/message6-control-only} &
\includegraphics[width=2.75in]{../images/johnny2/message6-engaged-only} &
\includegraphics[width=2.75in]{../images/johnny2/message6-engaged-only} \\
& & 

\fcolorbox{black}{mygray}{
\begin{minipage}{2.40in}
\tiny A Gray Border indicates that no Digital ID was used to send the
message. The sender might have forgotten or have a computer
problem. Alternatively, the message might be sent by someone else who
is trying to impersonate the sender.
\end{minipage} 
} \\
& & \\
 75\%  & 58\%  &  43\% \\
\multicolumn{3}{c}{Rate of successful attack} \\
\multicolumn{3}{c}{$p = 0.046$}
\end{tabular}



\slide{KCM didn't help against the New Identity Attack:}
\begin{tabular}{ccc}
No Color & Color & Color + Briefing \\
\includegraphics[width=2.75in]{../images/johnny2/message5-control-only} &
\includegraphics[width=2.75in]{../images/johnny2/message5-engaged-only} &
\includegraphics[width=2.75in]{../images/johnny2/message5-engaged-only} \\
& & 
\fcolorbox{black}{yellow}{
\begin{minipage}{2.40in}
\tiny A
Yellow Border will appear around an email message the first time a
particular Digital ID is used with an email address.
\end{minipage} 
}\\
& & \\
 79\%  & 50\%  &  60\% \\
\multicolumn{3}{c}{Rate of successful attack} \\
\multicolumn{3}{c}{$p = 0.31$}

\end{tabular}


Subjects said that they knew there was a risk, but decided to ignore it. Only two noticed that Sarah's name was misspelled!

\slide{Evaluating the Usability of Encryption:}
\sidebyside{
\begin{points}
\item Suprisingly, more people in NoColor encrypted than in Color or
   Color+Briefing 
\item It appears that they were (incorrectly) using encryption as a proxy
   for authentication 
\item Many people were confused by the Sign and Encrypt buttons in the OE
   interface 
\end{points}
}{
\small
\begin{tabular}{l|l||cc||}
& & \multicolumn{2}{c||}{Clicked ``encrypt''} \\
& & \multicolumn{2}{c||}{to seal email} \\
Colort & $n$ & sometimes & always \\
\hline
\textbf{NoColor} & 14 & 50\% & 21\% \\
\textbf{Color} & 14 & 36\% & 36\% \\
\textbf{Color+Briefing} & 15 & 20\% & 13\% \\
\hline
\multicolumn{2}{c||}{$\chi^2$} & 2.96 & 0.29 \\
\multicolumn{2}{c||}{$p=$} & 0.087 & 0.59 \\
\end{tabular}
}

\slide{Interesting failings:}
\begin{points}
\item Subjects were confused regarding single-click vs. double-click. They would double-click the ``encrypt'' button to no result!
\item Subjects wanted to know how to make a Digital ID for Attacker Paul so they could send him the schedule!
\end{points}


\slide{Evaluation of CoPilot's Interface:}
\sidebyside{
\begin{points}
\item People liked the colors, didn't read the text, and didn't
   understand the button  
\item People ignored the headers
\item Serious confusion on commands vs. status on buttons
\item Heavy users of web mail were the most confused.
\end{points}
}{  \tgraphic[height=4in]{johnny2/message7-engaged-only}
}

\slide{Conclusion and Recommendations:}
\begin{itemize}
\item We've previously argued that much commercial mail sent by eBay, Amazon, etc., should be signed.
\item Johnny 2 shows that people can understand and use KCM with little or no training. 
\item S/MIME is much more usable than people give it credit.
\item The hard thing is getting a certificate.
\item KCM gives people certificates automatically, but leaves them susceptible to the New Identity Attack. (This is the phishing  problem.)
\end{itemize} 

\slide{Deployment Strategies:}
\begin{itemize}
\item You could build this in right now.
\item Or Microsoft \& Thawte could work together to make it easier for
   people to get email-only certificates.
\end{itemize}

\slide{We can improve usability and
  security by making better use of the tools we have already deployed.}

\sidebyside{
\small
Merchants like Amazon, eBay and PayPal should use S/MIME to sign their
outgoing mail.

Most of what key continuity management offers can be accomplished with e-mail
only S/MIME certificates.

A ``CoPilot'' that explains what certificates means can increase
understanding, which increases usability and security.

}{   \tgraphic[height=4in]{johnny2/message2-engaged-only}
}

\bottom{Questions?}

\end{document}
