{"id":815,"date":"2009-06-02T12:20:34","date_gmt":"2009-06-02T19:20:34","guid":{"rendered":"http:\/\/www.talesfromthe.net\/jon\/?p=815"},"modified":"2009-06-02T12:20:34","modified_gmt":"2009-06-02T19:20:34","slug":"the-pscyhology-of-security-and-privacy-a-cfp09-panel-discussion","status":"publish","type":"post","link":"https:\/\/2024.thenexus.today\/index.php\/2009\/06\/02\/the-pscyhology-of-security-and-privacy-a-cfp09-panel-discussion\/","title":{"rendered":"The psychology of security and privacy — a #cfp09 panel discussion"},"content":{"rendered":"

Raw notes …<\/p>\n

<\/p>\n

Bruce Schneier:I put the panel together because there’s a lot of work on the human side of security, pscyhology, risk.\u00c2\u00a0 There’s a lot to be learned from researchers in these subjects, economics, cultural anthropology … it’s a taste of the stuff out there.\u00c2\u00a0 How do we design systems and social policy in a way that they’re effective?\u00c2\u00a0 How do we respond to events and rhetoric?<\/p>\n

The feeling and reality of security are different.\u00c2\u00a0 You can feel secure if you’re not; you can be secure even if you don’t feel that way.\u00c2\u00a0 Two concepts, we use the same word.\u00c2\u00a0 We need to split them apart.\u00c2\u00a0 We don’t have the words to talk about a lot of these things.<\/p>\n

I view security as a tradeoff.\u00c2\u00a0 No such thing as absolute; you’re trading off time, convenience, etc.\u00c2\u00a0 The question isn’t “is it effective”, it’s abou the tradeoff.\u00c2\u00a0 e.g. bulletproof vests work great; none of us are wearing them.\u00c2\u00a0 People have different intuitions, and we talk based on our intuitions. Making security tradeoffs is part of being alive … we should be really good at it, since it’s key to evolutionary success.\u00c2\u00a0 Sometimes we’re really bad.\u00c2\u00a0 Why?<\/p>\n

A lot of it’s the distinction between risk and reality.\u00c2\u00a0 Work being done on evolutionary psychology – how we evolved based on situations 100,000 years ago.We’re highly optimized for decisions in small group living in the east african highlands 100,000 yeas ago.<\/p>\n

_________<\/p>\n

Christine Jolls of Yale Law School: focusing on privacy.\u00c2\u00a0 Almos everything we regard as private isn’t private vis-a-vis everyone.\u00c2\u00a0 Whether it’s personal informaiotn or your unclothed body, there are some people you don’t mind giving access to it.\u00c2\u00a0 When peple make decisions about who to give access, undersanding psychology and behavioral economics is key.\u00c2\u00a0 Brandeis: “privacy is the right to be let alone”. But nobody wants to be completely alone.\u00c2\u00a0 The work I do focuses on how the law should try to construct the relationship between ourseles and others.<\/p>\n

Think about workpalce email monitoring.\u00c2\u00a0 Employees are typically told that employers reserve the right to monitor email.\u00c2\u00a0 Employees may make bad decisions in this context.\u00c2\u00a0 People are aware their email may be monitored; many people don’t process this, and optimism bias explains a lot of this.\u00c2\u00a0 Example of optimism bias: economist professor Thaler asks students to predict where they’ll finish in the class, and 80% predict they’ll be in the top 20%.\u00c2\u00a0 Workplace drug testing’s anohter example; most people who are caught just smoked pot with a friend on the weekend, but figure “oh i probably won’t get tested”. Ditto for email accesss.<\/p>\n

Another facter: the way people think about the future vs. present.\u00c2\u00a0 “The priority of the present is like ‘me’ vs. the rest of the world — everything else is later.”\u00c2\u00a0 People make decisions focusing on what they want right now, so the potential of future email monitoring\/testing is lower.\u00c2\u00a0 This is different from situations where people aren’t aware of the issues; people do <\/em>know what they’re consenting to, and they still do.<\/p>\n

Congress han’t been responsive to these kinds of concerns.\u00c2\u00a0 Common “judge-made” law, however, often picks up on this.\u00c2\u00a0 For drug testing, if you sign a form just as you’re being tested, courts will trea thast as consent.\u00c2\u00a0 If you sign it a year in advance (where these kinds of effects kick in), courts won’t treat it as valuable.\u00c2\u00a0 The same pattern applies elsewhere.\u00c2\u00a0 Why is statuatory law so less aware of these issues?<\/p>\n

___________<\/p>\n

Rachna Dhamija, CEO, Usable Security Systems and Fellow at the Harvard Center for Research on Computation and Society. Think about educating uses.\u00c2\u00a0 Tips are pages and pages long — even just on “how to choose a password”.\u00c2\u00a0 We’re starting to see security games.\u00c2\u00a0 Or fun posters: “passwords are like pants, you shouldn’t sure them”.\u00c2\u00a0 MSR did a major study: uses have 25 accoutns and 6 passwords they reuse.\u00c2\u00a0 3M Yahoo! pasword resets\/month.\u00c2\u00a0 Google password study: 15M accounts, 50% choose from only 1M possibilities.<\/p>\n

Why don’t uses do better?\u00c2\u00a0 “I can’t” — cogintive limitations.\u00c2\u00a0 “I have nothing to lose!”\u00c2\u00a0 That infuriates me as asecurity researcher, but on second thought maybe users are right: Consumers Union’s recent survey shows that most people don’t have issues.<\/p>\n

Users in their daily lives just wan tto get tasks done, they’re not focused on security.\u00c2\u00a0 Attackers exploit this by adding urgency.\u00c2\u00a0 Security interrupts like “invalid certificate”, users see “something happened and you need to hit okay to get on with doing things.”\u00c2\u00a0 Geting informed consent is hard; users will knowingly install spyware if they think functionality is vlauable.\u00c2\u00a0 Users are over-confident in their abiilty to protect themselves: “I can always uninstall it.”<\/p>\n

Users don’t notice the absence of security indicators.\u00c2\u00a0 RSA’s response: “You found a weakness, but Gartner’s survey showed most users find our security conenient.”\u00c2\u00a0 Bruce’s point abou difference<\/p>\n

Design assumptions: users<\/p>\n