Security and Privacy of High Impact Computer Applications

这项研究探讨了几个高影响力，广泛使用的计算机应用程序和基于云的服务中的安全和隐私问题。 使用任何安全敏感的应用程序目前需要一个飞跃的信念，因为用户没有简单的方法来验证计算机系统是无恶意软件的，并且用户没有被网络钓鱼/欺骗攻击愚弄。 大多数安全工具都是为专家用户设计的，需要用户勤奋，最多只能提供有限的保护，即使是常见的恶意软件威胁，更不用说先进的，国家赞助的攻击。 另一方面，近年来，互联网上的日常用户的参与出现了惊人的增长，主要是由营利性公司提供的“免费”网络服务提供的便利-期望企业可以从不受限制的用户数据访问中赚钱。 在这一过程中，用户的隐私，甚至是对隐私的期望，都急剧丧失。太阳微系统公司、谷歌和Facebook的首席执行官们在不同的时候都说：“隐私已经死了。“从研究的角度来看，为Web服务设计隐私保护技术是复杂的，因为需要平衡安全性和日常用户的易用性需求。

This research explores security and privacy problems in several high-impact, widely-used computer applications and cloud-based services. The use of any security-sensitive applications currently requires a leap of faith as users have no easy way of verifying that a computer system is malware-free, and that users are not being fooled by a phishing/spoofing attack. Most security tools are implicitly designed for expert users, require user diligence, and at best can provide only limited protection against even common malware threats, let alone advanced, state-sponsored attacks. On the other hand, participation of everyday users on the Internet in recent years has seen phenomenal growth, mostly facilitated by 'free' web services from for-profit corporations -- with the expectation that businesses can generate money from their unrestrained access to user data. What has been sharply lost in this process is, users' privacy, or even the expectation of privacy. CEOs of Sun Micorsystems, Google and Facebook remarked at various time to the effect that "privacy is dead." From a research perspective, designing privacy-preserving techniques for web services is complicated by the requirement of balancing security and ease-of-use needs of everyday users.