Seeing further: extending visualization as a basis for usable security

ABSTRACT

The focus of our approach to the usability considerations of privacy and security has been on providing people with information they can use to understand the implications of their interactions with a system, as well as, to assess whether or not a system is secure enough for their immediate needs. To this end, we have been exploring two design principles for secure interaction: visualizing system activity and integrating configuration and action. Here we discuss the results of a user study designed as a broad formative examination of the successes and failures of an initial prototype based around these principles. Our response to the results of this study has been twofold. First, we have fixed a number of implementation and usability problems. Second, we have extended our visualizations to incorporate new considerations regarding the temporal and structural organization of interactions.

REFERENCES

• 1: Jetty Java HTTP Servlet Server, Mort Bay Consulting <http://jetty.mortbay.org/jetty/>.
• 2: The Jakarta Slide Projects, <http://jakarta.apache.org/slide/>
• 3: Altman, I. (1975). The Environment and Social Behavior. Privacy Personal Space, Territory and Crowding. Monterey, CA. Brooks/Cole Pub. Co., Inc.
• 4: Altman, I. (1977). Privacy Regulation: Culturally Universal or Culturally Specific? Journal of Social Issues, 33(3), 66--84.
• 5: Rogério de Paula , Xianghua Ding , Paul Dourish , Kari Nies , Ben Pillet , David F. Redmiles , Jie Ren , Jennifer A. Rode , Roberto Silva Filho, In the eye of the beholder: a visualization-based approach to information system security, International Journal of Human-Computer Studies, v.63 n.1-2, p.5-24, July 2005 [doi>10.1016/j.ijhcs.2005.04.021]
• 6: Rogério de Paula , Xianghua Ding , Paul Dourish , Kari Nies , Ben Pillet , David Redmiles , Jie Ren , Jennifer Rode , Roberto Silva Filho, Two experiences designing for effective security, Proceedings of the 2005 symposium on Usable privacy and security, p.25-34, July 06-08, 2005, Pittsburgh, Pennsylvania [doi>10.1145/1073001.1073004]
• 7: Paul DiGioia , Paul Dourish, Social navigation as a model for usable security, Proceedings of the 2005 symposium on Usable privacy and security, p.101-108, July 06-08, 2005, Pittsburgh, Pennsylvania [doi>10.1145/1073001.1073011]
• 8: Dourish, P. and Anderson, K. In press. Collective Information Practice: Exploring Privacy and Security as Social and Cultural Phenomena. Human-Computer Interaction.
• 9: Goland, Y., E. J. Whitehead, et al. (1999). HTTP Extensions for Distributed Authoring -- WEBDAV, Internet Engineering Task Force: 1--94, RFC 2518.
• 10: William C. Hill , James D. Hollan , Dave Wroblewski , Tim McCandless, Edit wear and read wear, Proceedings of the SIGCHI conference on Human factors in computing systems, p.3-9, May 03-07, 1992, Monterey, California, United States [doi>10.1145/142750.142751]
• 11: Braden Kowitz , Lorrie Cranor, Peripheral privacy notifications for wireless networks, Proceedings of the 2005 ACM workshop on Privacy in the electronic society, November 07-07, 2005, Alexandria, VA, USA [doi>10.1145/1102199.1102217]
• 12: Plummer, D. C. (1986). Ethernet Address Resolution Protocol: Or converting network protocol addresses to 48.bit Ethernet address for transmission on Ethernet hardware, IETF RFC826.
• 13: Roberto S. Silva Filho , Cleidson R. B. de Souza , David F. Redmiles, The design of a configurable, extensible and dynamic notification service, Proceedings of the 2nd international workshop on Distributed event-based systems, June 08-08, 2003, San Diego, California [doi>10.1145/966618.966633]
• 14: Steinberg, D. and S. Cheshire (2005). Zero Configuration Networking: The Definitive Guide. O'Reilly Media.
• 15: Deborah G. Tatar , Gregg Foster , Daniel G. Bobrow, Design for conversation: lessons from Cognoter, International Journal of Man-Machine Studies, v.34 n.2, p.185-209, Feb. 1991 [doi>10.1016/0020-7373(91)90041-5]

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.1 Multimedia Information Systems
          Subjects: Evaluation/methodology

Additional Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.4 Electronic Commerce
          Subjects: Security

General Terms:
Design, Experimentation, Human Factors, Security

Keywords:
configuration in action, dynamic visualizations, effective security, history, peer-to-peer file sharing, theoretical security, usable security, user and media characterization, user study