SCS
Student
Seminar
Series
|
|
|
|
|
No Authorization Without Representation: Conveying the authority applications require users to grant as a condition of installation
Friday, November 6th, 2009 from 12-1 pm in GHC 4303.
Jennifer Tam, CSD
Computer operating systems, and now websites that serve as application platforms, are increasingly adopting stricter application security models; they restrict the resources applications can access to those authorized by the user. Users authorize access to these resources either when the application is installed or when the application rst requires access to an unauthorized resource. While the security of users systems and data increasingly rests on their ability to make these authorization decisions, there is little research to guide those designing these authorization experiences.
We performed a laboratory study to evaluate different designs for representing the actions and resources to be authorized as a condition of installing an application. We used a within-participants design to observe thirty-three Facebook users ability to absorb and search information in seventeen different representations, all of which were presented in the context of a fictional Facebook application. Four of these representations conveyed only a set of resources to be authorized, such as contacts or friends. The other thirteen representations paired resources with different actions that could be performed on them, such as seeing information, changing information, or adding new information.
We find that participants overwhelmingly prefer representations in which resources are presented visually, using icons or pictures. We also find strong evidence that users are able to search presentations containing icons more quickly than those that do not. Finally, we found that participants performed better when authorization information was organized by actions, and followed by the various resources on which the actions would be authorized, than when information was grouped by the resources.
Joint work with Stuart Schechter (MSR) and Robert Reeder (Microsoft)
(Presented in Partial Fulfillment of the CSD Speaking Skills Requirement.)
The Student Seminar Series is an informal research seminar by and for SCS graduate students from noon to 1 pm on Fridays. Lunch is provided by the Computer Science Department (personal thanks to Sharon Burks and Debbie Cavlovich!). At each meeting, a different student speaker will give an informal, 40 minute talk about his/her research, followed by questions/suggestions/brainstorming. We try to attract people with a diverse set of interests, and encourage speakers to present at a very general, accessible level.
So why are we doing this and why take part? In the best case scenario, this will lead to some interesting cross-disciplinary work among people in different fields and people may get some new ideas about their research. In the worst case scenario, a few people will practice their public speaking and the rest get together for a free lunch.
This page is updated roughly once a week, usually on Fridays.
Note: Step #1 and #3 below are applicable to ALL SSS speakers.
SSS is an ideal forum for SCS students to give presentations that count toward fulfilling their speaking requirements. The specifics, though, vary with each department. For instance, students in CSD will need to be familiar with the notes in Section 8 of the Ph.D. document and follow the instructions outlined on the Speakers Club homepage. Roughly speaking, these are the steps:
- Schedule a talk with SSS, first checking this page for available slots, then emailing sss@cs at least SIXTEEN DAYS before your scheduled talk. You can schedule AT MOST THREE talks per semester.
- After you are confirmed with your SSS slot,
go to the
Speakers Club Calendar
and schedule your talk at least three
weeks in advance of the talk date.
- Send your talk title, abstract, additional info (like "Joint work with..." or "In Partial Fulfillment of the Speaking Requirement"), and a picture of yourself (preferably jpeg) to sss@cs, at the latest, TEN DAYS before your scheduled talk.
- On the day of your talk, make sure you print Speakers Club evaluation forms for your evaluators to use.
Fan Guo, WebMaster
Dafna Shahaf, PosterMaster