Universal Usable Security

点击翻译按钮获取中文摘要

Computer security and privacy affect every aspect of computing and are a critical matter of concern for all users. While low-level system and network security remain important, there is an increasing need for end-users to become active participants in maintaining their computer's security, guarding their credentials for important accounts, and making privacy and security decisions online. Security now involves having non-security experts, or even novice users, regularly making important security decisions while their main focus is on other primary tasks. We must find ways to design security systems appropriate for this new environment. I focus on designing usable security for children and mobile users initially because both groups are increasingly using technology and are targets for attacks. In fact, I argue that there is a critical and urgent need for better usable security for both children and mobile users. The theoretical impact is to make available in the literature well-tested design principles and design patterns of usable security that can serve as foundation for development of security applications. Through practical designs of security software, I expect direct and measurable improvements in security for both groups of users. For children, warnings and security cues tailored to their mental models of security will enable them to make better security decisions online, and authentication schemes tailored to their aptitudes and abilities will allow for stronger passwords. A security game will provide a safe environment for children to explore different security choices and provide at testbed for proposed security designs. For mobile users, determining the best methods for user authentication and CAPTCHAs will address a common complaint among users, while improved permission models will give users more control over installed applications.