Elio Qoshi, Anxhela Maloku (Angie) – Identifying and Addressing Usability Vulnerabilities #FOSSBack

This talk focuses on the critical intersection of security and user experience (UX) design, highlighting the importance of usability in security systems. The speakers discuss a variety of case studies, including work done with SecureDrop, an open-source whistleblowing platform, where they emphasized creating clear and user-friendly deletion processes to prevent accidental data loss. They introduce a framework based on heuristics that addresses cognitive load, accessibility, and technical considerations in secure UI design. The discussion also covers challenges in fostering better user behavior regarding security without overwhelming them with alerts and provides insights into practical design changes made in systems like Qubes OS. Ultimately, the presenters emphasize the need for a thoughtful approach to security that balances user needs with technical implementations.

Thank you everyone. I hope you can hear me all right. There's quite a bit of talk about security. It's It's very interesting. I've been at Fastback stage for a few years now and this feels like the time to talk about security and it's not like this crazy thing anymore but it's like affecting all of us. So this is a little bit about the talk today as well.

It's It's mostly coming from a UX usability perspective and we're going to go and talk about some things we've been doing as well. You must be pretty familiar with this one. We get no context but like are you sure? Um We gave this talk in FOSDEM a few weeks ago and we used the Macron meme. I thought because it's it's like a little bit of an old

meme now I got rid of it now but Um there's this UX paradigm of asking having no context and just asking are you sure for for what? So this is something very developer-centric and without a user flow tested out in mind. So things can go pretty badly. And in 2018 I'm Sorry, a little bit a little bit of dark humor might be coming, you know, but you

you you probably seen this meteor dropping in Australia like a few weeks ago and people thought it was a missile. Everyone was scared like oh [ __ ] like are we going to to war now? Well, in 2018 the Hawaiians had the same same thing because apparently someone dropped an alert that an actual missile was dropping. And people were freaking out and and going to safe safe places. Well,

apparently there was a drill but someone actually confused that it was the real thing. Someone pressing the button and this was actually here the UI you could see of that missile alert as well. Do you know which one to click to actually set the drill? Well, apparently it was the second one because it starts with drill. It's a bunch of lists. You know what's funny that this

is a photo by the governor. So, the governor didn't do a screenshot or anything, but he took his phone out and did a nice photo. So, um things can go badly as well and like on Windows, you also have this thing where you it asks you, "Do you want to delete multiple items?" And in in the best case, sometimes you get actual context on what you are

deleting. But in other cases, you might have forgotten you stepped away from the computer and you got back and then you see there, "Oh, do you want to delete your childhood memories?" So, yeah, yes, of course. But you don't have that context, you know? So, that's why um uh UX mindset is also very important in security as well. this is also quite related to the um privacy

paradox where in this case security, I'm going to interchange privacy and security. Please don't like um it for just for simplicity It's what when it breaks because the maintainers or developers are thinking that the users think in the same way like they do, right? And that shift, that change um is what we would call a privacy paradox. Um you can read about it as well. Um there's

quite a lot of studies about it in the early 2000s. I'm Elio and I I founded Ura Design and I'm here today with Angie and she will be talking a little bit more about some of the projects we have been doing where we actually look a little bit more into this. So, I'm going to give it to Angie as well today. Yeah. Thank you, Elio. Well, um

I'm actually going to have the pleasure to introduce one of the frameworks that we have been working on at Aura. And this is exactly it goes again on the same direction that Elias started for the secure UI heuristics that we find during our work um with our clients. Um first I'll start with just maybe clarifying a bit or bringing in the topic here that usability vulnerability as

most of you know uh sometimes it's it it comes up in design as a flow that predictably can cause the users to behave unsafely or despite any sound technical implementation that has been done in that application it still can be flaws in the interfaces in the underlying security controls. And there are a lot of questions that actually come up in our work with developers and different clients

that we've been working. So we've decided to kind of scope all this work into these three big pillars that kind of cover all the the scope of the work that we found in our previous practical projects. The first one is the cognitive one. It kind of goes in the direction of the mental load and what we find in the attention and the decision-making effect of security that

it's impact in the applications and how the users also react to different interfaces. And then the inclusive pillar which actually also covers the accessibility topics and how to make these interfaces accessible accessible for different users with a different abilities. And the third pillar is the technical one because of course there can be great work in the implementation side and making these systems so sound technically but there

are still errors and maybe sometimes even state changes that we want to show through the interfaces. one of our clients that I've actually the pleasure to work with the SecureDrop for some of you that maybe still don't know is an open-source whistleblowing platform that is used from major news organizations. there are users such as journalists or whistleblowers that sometimes might be at risk because what if the

the communication gets compromised in this application, they might be really in risk. And one of the issues that we've treated with this client is going to go back to the example that also Elio mentioned in the beginning of this talk, which is the deletion process. And we wanted to make the deletion process of SecureDrop to be as clear and transparent as possible such that we minimize the

confusion of the users and also to minimize the accidental data loss. Our approach with this was to make the full content necessary obvious and to for the users to actually have access to it such as showing files, messages, or replies. It's all going to be clear in a bit. So, as you see here, we have two examples of the models that were in our iteration of this

issue. And there there are few differences if you see it. It's mostly on the the colors. So, the first one has the the red background. It kind of alerts the user. And then we had the second one, which is uh of the yellow and making the user realize that there is a warning. Um so, when working with this, if even though it's a destructive action, it's still

we have to find this fine line of the user to not be alerted all the time, to be alerted as much as needed. And that's why we actually ended up with these two iterations, and later we decided to go for the second one because it has this very good balance of uh having the warning of the user when deleting a source account or a conversation, uh but

as well as when it goes in this final action, which is deleting it, it again goes with the red that we know is giving the user an alert state. But, how our framework approaches this is it starts with the interface condition. So, the condition that is observed in the interface, then we cover the user failure. So, how users actually respond predictably as I mentioned under these realistic

conditions, and then the security consequence that might be faced. So, the user can actually lose or um some data or attacker gains um in the other side as a result. How this goes in our example is um going to be shown very clearly also through the interfaces after. But, basically in the interface condition, we uh cover these uh topics such as colors and the error states that

are presented, the language, and then we make sure that the user failure, in this case the journalist, is able to read what is necessary, but not always as an alert when it's not needed because then it can end up rushing into a decision that they might not want to deal with or um avoiding a a confirmation just because they get confused. And the final is the security

consequence because as I mentioned, the the full content shown in these models is retained or deleted incorrectly without the journalist verifying the scope. Um one of the heuristics in our framework that we worked is exactly reconstructing these failure states. So, as you see here, ensuring that the error state is provided clearly. And the scope of impact, as I mentioned, is that these interfaces must uh surface exactly

the full content of the files for these journalists. What files, messages, replies, associated data they want to delete. And then we cover the irreversibility signal, which is actually showing clearly what they're going to delete in the case of the conversation or in the case of source account. And the the last one is the visual signal that must match the type of risk. How is this shown? Well,

as I showed in the beginning is the model. It has two radio buttons to cover these two main cases. If they want to delete a conversation only, what the user is provided with with is this detailed. It's two messages, two files, two replies. But if the user wants to delete a source account and it chooses the other radio button, it is shown with the details of this

case such that the journalist is actually aware before it takes the action the destructive action of deleting. Um Yeah. So, If I may just a few things. So, like this is also work in progress and it's very simplified, so you will see hopefully it will get even better in the next months as well. And the idea is that, you know, when I was a kid, uh, I

always thought like when people companies were in the red, it's bad, right? But why it's not green, you know? If you have make money, it should be green. Well, that's black because black is just a default state. So, not everything should be green or red because people will like get alarm fatigue after after that. You should be very careful when choosing how to highlight things. And this

was also the reason we chose that. I'm just like a little bit more vibe based on my explanations and um, we try to to make the whole framework um, a little bit more reproducible, which um, Angie was um, giving us so well here. >> Yeah. Probably my academic background is the best for this case, but um, so yeah, as Elio mentioned, like this was actually one issue

that I enjoyed so much working with SecureDrop. As much as it sounds now like everything is finalized, so it seems just like presenting all the work, but it went through benchmarking and um, kind of also trying to understand it better. What is this very safe way to provide the journalist to cover any use case that they might be dealing with. So, and that's why heuristic comes into

play very uh, very well into all this work because it gets you to question what is this heuristic asking for? What are the questions that we want to answer such that uh, we find the perfect um, UI component um, and the user experience we want to provide to the user. And also as you can see here, things that I already mentioned, um, that the user of course,

uh could not just delete for any given uh source they are presented with what they want to actually delete. And there is um there was no visual uh difference before, and that's why Secure Drop was wanting to find this uh solution. Um, like, what are going to be the colors of the buttons? Even even in the cancel one, what is going to be the position of the

cancel? Because they just don't want to uh cancel with the user not realizing or uh thinking about it. So, everything goes uh into play here, and the finding of the specific uh heuristic part of, like, uh you know, as I mentioned, there are three pillars. This goes on the third one, the technical pillar, and is actually called the reconstruct failure states. Um, in the interface condition is

um things that have to do with the appearance, right? So, the the styling of the info uh box to to display the scope what they are uh going to be deleting. And the user failure journalist, well, they have to know the difference of this alert. Something has gone wrong, or um is this a confirmation step? Um, under pressure, this can trigger actually avoidance as these necessary uh

actions that the user has to to take upon. And then the security con- consequence, well, as I mentioned, the user who wants to avoid this tab or rush into some deletion uh confirmation cannot verify what they're removing. Um, so, we we dealt with it, and we presented in a a very good way such that also these mismatching um between the visual signal and the moment the moment

type is presented in in the current design way under normal use. And at the mitigation which we we finally decided with the the warning treatment of this case rather than the alert all over the model and ensuring that this confirmation action is reachable to the user. Um another client that we've worked with is Qubes OS. Um Elio and other colleagues of mine have worked with Qubes OS

for a long time now, right Elio? Yeah, I can say a few more words about it. So Qubes OS is a very powerful VM-based Linux distro based on KDE. So basically every application you have is in its own VM. So you cannot copy-paste things back and forth. It's super super. Edward Snowden is using it, he says. I don't know. So yeah, it's it's very technical as well.

So one of the things we we did is reorganize the setting screen so people can understand what what is going on. And one of the things they had was a little bit of a help button for every action. But to access that you needed to click on it and hover over it. So it was very inaccessible on getting help on what you are actually doing. So one

of the things is that we we removed we improved the information hierarchy and clarified help screens and and settings a little bit more. And very funny as well, this yellow thing used to be red. It's it's like such a stupid simple thing, you know, but it's I see it in software so often. Everything is red, like you got to be careful. Like everyone is like tired of

the whole alarm fatigue, you know? We got to be chill chill out for a minute So so yeah, that's some some stuff we did for our QubesOS. Yeah. And we actually untangled its complexity of the system and here I present a few things from before and after cases like as Elina mentioned, they work with like the language, the icons and the layout in general hierarchy and support

tags and like decisions that had to do with security consequences or how the user can configure their system without guesswork or documentation. And what I've been working again going back to this framework, I I look up on this work and then I see how our heuristics go on very well with like situation that the application might be in the very first stage when the client comes to

us and how we actually can take this audit upon and then deliver the work after accordingly. Um few words about the framework. Uh yeah. Um so we tried uh the framework is not something out yet so we will be working on it over the next months and it's not supposed to be like very I know security people like to have things in binary and like being very

black and white so this will not be a black and white thing. But it will be something which we can help us become beyond this oh it's a matter of taste kind of situation because this is not, you know, our design and UX design is not art. It's like a solution it's scientific so we want to help move this conversation a bit further. Like for example issue

that we've been dealing right now with secure drop which is also in GitHub with a think UX and I found this framework just so helpful to actually have it as a guidance before when I took the issue it was so complex and then I just realized hey we've been working with this framework why not apply it and then we we actually had great results, and it was

really helpful and useful to to Yeah, indeed. Um so, the other we did it the other way around, you know, in like a lot of trainings on LinkedIn, you probably see them like come join my course so I can tell you how to do things. Uh we tried to make it the other way around, so we we worked on projects, and we kind of tried to get

our experience, put it into a framework, which is a little bit more can be reproduced a little bit better. Um and right now we are using it on our own projects to see if it actually makes sense. So, we kind of beta tested internally. Um so, we worked on a few clients over the past, including some major open source projects and organizations like these, um yeah, I

I think we've come a long way since um the early days of open source. I think uh Eva in their keynotes talked about that quite a quite a lot, and that resonated with us as well. So, yeah, uh the the framework, this is just a little bit of a taste of the framework. Um you can go on our website to see a little bit more of our

thinking on how we see um in design how we look at things in design. We will likely have the framework open available for beta in the next next months, but feel free to I don't know, even proactively ask questions or reach out to us afterwards if you have some experience or like if you really annoyed by one specific thing, and I don't know, this resonates with you.

Um you can always reach us via email and the usual communication channels as well. And we are actually a little bit ahead of time, but that makes more time for questions, isn't cool cool. THANK YOU VERY MUCH. UH WITH THE CHANGES TO UH, COLOR SYSTEMS and icon systems, did you investigate the effect on color blind users? Is there differentiation beyond color for the benefit of such users?

And uh, if so, did you investigate whether you could improve that as well? Can I talk to that? Yeah, please. Um, yeah, one of on Qubes OS and uh, secure drop as well, we are making everything WCAG AA compliant, which was not the case before. So, now um, there is a new AAPC, I think it's called, it's a new color system, um, checking for color, um, vision

deficiencies. Um, anyway, I'm just getting to nerdy, but yes, the the answer is yes. And it all should work better, and it should be more compliant with the European Accessibility Act, for example. Sure. Yeah. So, uh, several providers of different services have, uh, in order to, I believe, uh, strengthen the security, uh, have introduced like three-phase logins. Uh, you all know, I mean, use authenticator, have two-phase,

uh, login verification, and and so on. Um, two weeks ago my my my son, uh, spent almost one week to get able to play one, uh, one computer game, because the login was so so difficult. So, do you see that that could actually, uh, introduce some kind of a login fatigue, which would be, uh, uh, usability risk or or vulnerability in itself? I have a lot of

opinions, but I also talk too much, so maybe you want to take >> Actually, it's funny because, uh, just 2 weeks ago when I was at NDSS conference, uh, there was a paper about how, uh, the Duo application is seen in that, and how much time users also spend going through an application and another one like, you know, you are on your phone in an interface and

then you have to go out and but um I do have to say that there are a few times well, a lot of times when these steps are necessary. And um it is actually also often secure to do it this way so that you have a third-party to uh help you with the the two-factor authentication and make it more safe, right? But there are times when it's

not necessary and uh there are also times when maybe from the design perspective it's not given a lot of thoughts and it's just been as a you know, a safe approach that everyone is following, but what is the case for that application? So, you know, there are scenarios uh where uh it has to of course be chosen in a in a way that it does make sense

for that specific application. Um I don't know, you can also add of course Um I I I think if a system is very secure a user will make it will screw it up like if they are too tired of it. So, I that's why a Mac is reasonably secure I feel and because if you use Qubes OS I hope these the people at Qubes OS will understand

me. I think they will agree with me. And you don't know what you're doing Qubes OS will be a worse time for you than actual a Mac, you know, because of the user experience. But to answer your question, I think passkeys is a very interesting technology which is removing the whole uh it's it's works magically, you know, and I I I would love to look what is

happening in that space more. And also fingerprints are actually a lot in the discussion. Uh well, it goes actually in a both ways. Sometimes people are also a bit skeptical about that so there are a lot of studies also going in the fingerprint whether it's like the uh safe way to go with, but has been working quite well the majority, so and it's also, you know, taking

less time for the users to actually log in. Um, yeah. you've worked a lot with your pillars and your heuristic um systems, beta testing them, and I can see very clearly how it would work for some fairly well-resourced open source projects and organizations. How would you like smaller, less resourced, um more bootstrapped open organizations to use the heuristic? How would you ideally describe how how they would

use it? Um, should I? Um, I I have to say that if you take a look on the heuristic when it actually is going to be released later on, it's so easy to, you know, like it's um it's provided in such way, in such a structure that you don't necessarily have to go through everything. You understand it quite easily where to go and have those uh questions

that you have, such that you gain the answer only for that concern you have, you know? So, there are cases when you have to go through all the structure and provide like uh the guidance through that issue, but there are also other cases when you everything, only to what you said, like a small task to actually um have the guidance and Hopefully it's quick. Um, so I'm

just wondering, do you focus exclusively on things with GUIs? Um, does this also apply to terminal applications? And did you have chance to work with anybody to kind of improve security on terminal That's a very great question. Thank you. Um Um, I personally worked on terminal UI in the past um on Sequoia PGP to be specific. Shout out to my fans at Sequoia uh when they listen

to They they have uh PGP application as called SQ and we kind of made the whole commands a little bit easier to use the whole comment. So you won't be confusing confusing by having the wrong PGP key. You know all the great fun PGP stuff um as well and in the past I have some of my ex-colleagues from Canonical here. Um I've worked on Ubuntu Pro which

was how you would log in to Ubuntu um from your server, right? So the whole experience was very different. We had some issues about security, how long the keyword the 2FA keyword should be. So yeah, there's a quite a lot of considerations. I can talk on and on but I probably shouldn't. No, thanks. Okay, thanks a lot. A big round of applause.