Security and Privacy of High Impact Computer Applications

这项研究探索了几个高影响力、广泛使用的计算机应用程序和基于云的服务中的安全和隐私问题。目前，任何安全敏感应用程序的使用都需要信心的飞跃，因为用户没有简单的方法来验证计算机系统是否没有恶意软件，以及用户是否没有被网络钓鱼/欺骗攻击所愚弄。大多数安全工具都是为专家用户隐式设计的，需要用户勤奋工作，充其量只能针对常见的恶意软件威胁提供有限的保护，更不用说国家支持的高级攻击了。另一方面，近些年来，日常用户在互联网上的参与度出现了惊人的增长，这主要得益于营利性公司提供的免费网络服务，他们希望企业可以通过不受限制地访问用户数据来赚钱。在这个过程中，急剧丢失的是用户的隐私，甚至是对隐私的期望。Sun MicorSystems、谷歌和Facebook的首席执行官们在不同的时间发表了大意是“隐私已经死了”的言论。从研究的角度来看，Web服务的隐私保护技术的设计因平衡日常用户的安全性和易用性需求而变得复杂。

This research explores security and privacy problems in several high-impact, widely-used computer applications and cloud-based services. The use of any security-sensitive applications currently requires a leap of faith as users have no easy way of verifying that a computer system is malware-free, and that users are not being fooled by a phishing/spoofing attack. Most security tools are implicitly designed for expert users, require user diligence, and at best can provide only limited protection against even common malware threats, let alone advanced, state-sponsored attacks. On the other hand, participation of everyday users on the Internet in recent years has seen phenomenal growth, mostly facilitated by 'free' web services from for-profit corporations -- with the expectation that businesses can generate money from their unrestrained access to user data. What has been sharply lost in this process is, users' privacy, or even the expectation of privacy. CEOs of Sun Micorsystems, Google and Facebook remarked at various time to the effect that "privacy is dead." From a research perspective, designing privacy-preserving techniques for web services is complicated by the requirement of balancing security and ease-of-use needs of everyday users.