Security and Privacy of High Impact Computer Applications

点击翻译按钮获取中文摘要

This research explores security and privacy problems in several high-impact, widely-used computer applications and cloud-based services. The use of any security-sensitive applications currently requires a leap of faith as users have no easy way of verifying that a computer system is malware-free, and that users are not being fooled by a phishing/spoofing attack. Most security tools are implicitly designed for expert users, require user diligence, and at best can provide only limited protection against even common malware threats, let alone advanced, state-sponsored attacks. On the other hand, participation of everyday users on the Internet in recent years has seen phenomenal growth, mostly facilitated by 'free' web services from for-profit corporations -- with the expectation that businesses can generate money from their unrestrained access to user data. What has been sharply lost in this process is, users' privacy, or even the expectation of privacy. CEOs of Sun Micorsystems, Google and Facebook remarked at various time to the effect that "privacy is dead." From a research perspective, designing privacy-preserving techniques for web services is complicated by the requirement of balancing security and ease-of-use needs of everyday users.