Appropriate Security and Confinement Technologies Methods for the Design of Appropriate Security and a Case Study on Confinement Technologies for Desktop Computers Steve Dodier-Lazaro UCL A thesis submitted for the degree of Doctor of Philosophy 22nd June 2018 I, Steve Dodier-Lazaro confirm that the work presented in this thesis is my own. Where information has been derived from other sources, I confirm that this has been indicated in the thesis. 3 Abstract Despite significant research, desktop computers remain fundamentally insecure. Mal- ware is a prime culprit for data breaches in organisations. A vast number of user machines are connected to the Internet unprotected, leading to global ransomware attacks costing billions to world economies. Confinement systems are technologies that can thwart mal- ware. Several security researchers have claimed to have designed usable confinement, and both Microsoft and Apple have deployed confinement into their desktop OSs in the form of sandboxes, but application developers avoid supporting it. Commercial off-the-shelf confinement systems exist which users can adopt and use, but very few do. My thesis investigates the design process of confinement technologies, to understand why they are not in use. It is divided in two parts. Firstly, I examine why the methods of usable security may not be judicious when it comes to designing for adoption. I propose alternative methods and goals, focused on the adoption and appropriation of technologies, rather than on their usability. This alternative process, named appropriate security, rests on four principles: security research is about users, not technology; it is about appropriation, not usability; it should not cause harm to users; and it should involve users in shaping security goals, rather than impose others’ goals onto them. Next, I apply this approach to sandboxes, through a field study with users at risk of being disenfranchised by sandboxing if it were mandatory. In this study, I document users’ appropriations of their computers to elicit design requirements and to invent new types of file access policies for existing sandboxes. I build metrics and tools to evaluate the security provided by file access policies, and their cost to users. Using ground-truth data from users, I demonstrate that my policies (designed with users’ appropriations in mind) outperform existing ones in Windows both on security and usability. I then co-design confinement-based services with users, based on their own experiences of security, and which provide actual value to them, as a way to bootstrap security adoption. This study demonstrates the substantial benefits of implementing an appropriate security design process. Impact Statement My thesis introduces new methods to usable security. It reveals the existence of marginalised topics and offers methodological commitments to address them. This work may allow researchers to make breakthroughs, either by finding and eliminating incor- rect design assumptions which had not been revealed by the current methods of usable security, or by allowing them to design security services which users have incentives to adopt. The focus of my methods to making findings rooted in real-world practice makes it clearer how they are actionable by practitioners than typical usable security research based on laboratory usability evaluations. In security research, methods to evaluate and compare confinement systems have been missing. My thesis introduces such a method along with metrics which will allow policy makers and security researchers to predict the impact and benefits of the confinement systems and prototypes they seek to deploy. This will help the field move towards evidence-based practice, and thus, deliver security of a higher quality. OS development companies like Microsoft and Apple will benefit from the findings of the research, as my research explains why certain design requirements must be modified and proposes new directions for sandboxed application policies. These results should be replicated with each OS’s own user populations, and if they hold, could bring changes that will make sandboxes more usable, and more secure for end users. Either way, the methods proposed for requirements gathering and for sandbox evaluation will remain useful and necessary to future sandbox design even if different results are obtained. Finally, the sandboxes I have developed as part of my experimental study are open- source software, available to participants and to other users. There has been an expression of interest in integrating my software into the Xfce desktop environment, upon which it is based. Xfce is used by hundreds of thousands to millions of users, who would benefit from those new security services. Moreover, the services developed, if released in Xfce, will help foster conversation about what can be made of sandboxing and will encourage other open-source developers to build sandbox services that go beyond the traditional application sandbox, which struggles to find adopters. Acknowledgements To Jens Krinke. I would not have been able to find the discipline and the mental strength to write this thesis without Jens’s support and experience. He is not a researcher in either of HCI or security, and he has stepped out of his comfort zone more than many would to be able to supervise me. Thank you, Jens. À ma mère pour m’avoir enseigné à être honnête et sensible aux autres, à ma soeur pour m’avoir soutenu lorsque je ne croyais plus en moi. À mon enseignante Irène Larramendy Valverde pour m’avoir encouragé quand je croyais ne pas avoir ma place à l’université. À la République Française pour sa solidarité. À Quentin Avril, Valérie Gouranton, Anne- Élisabeth Baert, et Pascal Berthomé qui m’ont donné le goût de la recherche. To Martin Peres who offered his expertise on security. To Wonmin Byeon, who sup- ported me through the earlier phases of this PhD and taught me much about conducting research. To Jin Xu, for extending my perspectives on psychology. To my designer friends Sandra Pedersen, Liyi Zhang, Alexia Danton, and Thomas Poblete for helping me open up to design thinking and to my academic friends Brian Glass, Ingolf Becker, Luca Melis, Tristan Caulfield and Abi Roper for their advice and help. To Richard Gamester and the Institute of Making for interesting me in craftmanship. To George Danezis, Brad Karp and Mark Handley, whose strong commitment to work ethics makes them outstanding role models of leadership. It is also thanks to them that I have kept enough faith in academia to complete this research project. To my secondary supervisor Angela Sasse who paved the way for the work in this the- sis by highlighting the importance of acknowledging humans in security design. She has had a decisive influence on my choice of research topic and my work while at UCL. Like- wise, to Paul Dourish, Lucy Suchman and Susanne Bødker for their respective academic influences. Particularly, Susanne Bødker’s advice on my study design was invaluable. To the administrative staff at UCL who make our work possible: Caroline Wardle, Sarah Turnbull, JJ Giwa-Majekodunmi, Patricia Fenoy, Dawn Bailey, Wendy Richards and all the TSG staff. To the many fellow open-source developers who supported the vast development effort required to produce my thesis. Particularly, to Olivier Fourdan and the rest of the Xfce team and to Ion Ionescu, the Firejail developer. To Mathias Clasen and Colin Watson for their respective and repeated help with toolkit hacking and software packaging. To my study participants. Contents Preamble3 1. Introduction3 1.1. Confinement: a Response to Lack of Security on Desktop OSs . .4 1.2. Why Won’t Confinement Technologies be Used? . .5 1.3. Scope of This Thesis . .6 1.4. Aims and Objectives . .7 1.5. Contributions . .9 1.6. Thesis Outline . 10 2. Background – HCI and Usable Security 13 2.1. Human-Computer Interaction . 13 2.2. Security and Usability . 29 2.3. Conclusion . 42 2.4. Research Methods . 42 I. Identifying Obstacles to Making Confinement Appropriate 49 3. Theoretical Foundations for Appropriate Security 51 3.1. Introduction – What’s the Matter with Usable Security? . 51 3.2. Technological Fixation . 55 3.3. Beyond Experimental Usability Studies . 63 3.4. When Security Causes Harm . 74 3.5. Paternalism in Usable Security Research . 78 3.6. Conclusion . 85 4. Open Problems in Confinement on Desktop OSs 87 4.1. Introduction – Motivation for Studying Confinement . 87 4.2. Models for Confinement . 97 4.3. Process Confinement Mechanisms . 105 4.4. Activity Confinement Mechanisms . 117 4.5. Content Confinement Mechanisms . 121 4.6. Integration to Desktop Environments . 122 4.7. Commercial Desktop OS Sandboxes . 124 4.8. Discussion . 131 II. Experimenting with the Design Process of Application Sandboxes135 5. Study Design 137 5.1. Principles Underlying the Study Design . 137 5.2. Why not Mobile OSs? . 139 5.3. Recruitment and Demographics . 140 5.4. Part 1 – Observing Practices and Activities . 142 5.5. Part 2 – Designing a Sandbox Service . 145 5.6. Ethics and Tools for Participants . 147 5.7. Reproducibility . 149 5.8. Limitations . 152 6. Unveiling Value Conflicts Between App Appropriations and Sandboxes 155 6.1. Introduction . 155 6.2. Background . 157 6.3. Method . 158 6.4. Values in Application Appropriation . 161 6.5. Feature Loss . 168 6.6. Limitations . 174 6.7. Implications for Usable Security Research . 175 6.8. Conclusion . 176 7. Learning from Filesystem Appropriations to Design Sandbox Policies 179 7.1. Introduction . 179 7.2. Data Collection and Analysis Method . 181 7.3. Interview Results . 182 7.4. Implications for Sandbox Policies . 187 7.5. Proposed Policies . 191 7.6. Conclusion . 197 8. A Comparative Evaluation of Sandbox Policies 199 8.1. Introduction . 199 8.2. Related Work . 201 8.3. Data Collection and Technical Background . 202 8.4. Metrics Definition . 205 8.5. Comparative Evaluation of Policies .