Thank you. All right. So I would like to start with this very controversial sometimes notion,
which is I want to convince you all a bit that that sentence that is up there that bad
UX is bad security is actually true because I get often people who tell me that complete
bollocks I will later talk a bit also about cubes but I don't want to start with this.
I would like to start with the general principles. So why UX matters for security? The thing is
very often when I talk with hackers about security people come to me like but we don't
actually need usability. People can figure it out if you care about security you will figure it out
and that's not a good approach. One thing is of course it's not like security and privacy are
things that you should be you should have to deserve to work for them not everybody deserves only
the smart people but the other thing is it doesn't matter if it's the fault of the user if it's
the fault of the software if we get compromised if we get harmed the harm is done and I would
personally like there to be less harm less damage to the users and that's that means making things
more usable for people taking into account how humans work how human brains work this is of
course sometimes a controversial concept but we are all human here and we make mistakes like people
like humans who make mistakes user errors are a real vector of attack and a very important vector
of attack when we read about compromises and for example big corporations very often the initial
vector of attack was oh somebody clicked on the link or somebody answered the phone somebody talked
to somebody and said what they shouldn't somebody made a stupid password so we cannot just say well
I did the tech side all the problems there are user errors not my department this is not a good
attitude it's like if the UX for the door or for the door control process is terrible and you end
up doing oh nobody can remember the code just put the sticker next to the door then the person who
designed the security system failed yes people shouldn't put sticker with the password next to
the door but also the person who designed the process did a bad thing this is not good and also
we are not mothers and fathers of our users we should not be like oh you have to deserve this you
have to work harder why are you not paying attention chair a bad user we need to treat our users
seriously like adults who also sometimes have different priorities than our programs not like
children because the thing is humans make mistakes this is a thing this is a this is a truth
universally acknowledged we all do we will make mistakes we may have other priorities than making
using the software perfectly like very few people just want to use the software as good as possible
they want to use the software to do something and also the problem is our brains were not exactly
optimized for using computers also controversial our brains brains have a lot of heretics a lot of
shortcuts that they take all the fascinating optical illusions just tell us this our brain is not
perfect at perceiving the universe and reacting to what's happening we have a lot of iffy things in
our brains and this is something that we as people who make software need to take into account
people also do shortcuts they do it like they want to do things fast and if you keep noticing that
your users keep doing a shortcut that is for example a secure less reasonable terrible there is
a need to do we cannot be just like well stop doing that this is bad bad user no no if for
example people people keep people keep walking on the grass then they probably get need to get
somewhere and maybe that's not how this square should have looked like you have to take this into
account that people will want to get close to their goal not necessarily in the way that we would
like them to do it and again even the smartest person in the room can be in a hurry you can have a
bunch of brilliant engineers brilliant physicists and they may make stupid decisions and they may sit
and be like yeah and it can't be that bad right this one time what could possibly go wrong it's not
that terrible or something exploded oops we have to take this into account we cannot be just making
the software that we make with the assumption that people want to make mistakes you want to get
perfect users this is just impossible that's that's not how humans work one of the big things that I
find very important for designing things security related security related processes is in attention
that is we generally just notice the thing we care about we don't notice everything that happens in
the background this is not a bad thing this is very useful for our brains that's called cocktail
party phenomenon when a human being can actually for most humans understand conversation in a very
busy room and a cocktail party because our brain is very good at being like this thing I care about
all the rest not important not my thing but this is very annoying when you are trying to design a
good process for security because this means that a small red blinking light may be ignored the
error message may not be read because the person just cares about one thing and I really like to
refer to you to a psychological experiment that demonstrates this is how humans work it's called
the invisible gorilla and the experiment was people were asked to watch a short film where a bunch of
people was playing ball passing ball and told count how many times the balls is passed at the end of
the short film people asked okay how many times the ball was passed cool did you notice the man in
gorilla suit walking around and 50% of the participants did not notice the man in the gorilla
suit because they didn't care about it they were told to count the passing of the ball so gorilla
was there a gorilla and that's how humans work we cannot design our secure processes thinking
yes people will pay perfect attention to everything all of the time that's just not how our brains
work and I like to show it on the example of the error message this is liberal office error message
this is what a designer program a sees there's an error message as an explanation what happens
all very useful things and this is what a lot of users see because what they want is to get to
the file and there are some words and they're annoying because they are stopping them from
getting to the file please give me my file so it's just a bunch of annoying red stuff and a big
button that says oh go do my thing and then the person opens the file and be like I cannot edit
it something's wrong what happened is there an error message and this is I know this is annoying
when we are designing things and making things is just like just read the error message why are
you not reading the error message people want we have to think about communicating things not just
in the error messages because a lot of people would ignore them because they don't care about them in
the moment the error appears okay so this is my introduction this is my introduction on human
brains complicated what is the thing I'm working on this is keeps us a reasonably secure operating
system we don't we don't say it's perfectly secure because nothing is perfectly secure don't use
computers if you want perfect security and cubes is a fairly complicated thing it's sort of a
meta operating system which means that it has a bunch of virtual machines talking to each other
everything's isolated this is my virtual machine that has my devices this is my virtual machine with
my work everything is compartmentalized and the thing is we are trying to make it actually usable
for people because you could have done the thing of partitioning things into virtual machines manually
but it would be such a pain to actually make it work cubes provides the layer that allows you to
actually use it to get all the security of really strongly isolating the things you're doing but
also being able to use it without writing pages and pages and pages and pages of shell scripts
this is a slightly cut but mostly visible diagram of how cubes works so you can see a lot of
different virtual machines called cubes because we are funny like that and there is for January for
the user there is a bunch of system stuff that does all the important system things and there is a
bunch of user things like this is my cube for work stuff I have my browser my liberal office
whatever I have my social media cube and those two cubes those two virtual machines don't know
about each other they can talk they can share things if I click on a stupid link on my Facebook
account it won't compromise my work which would be very nice so that whole idea of providing this
separation is very very nice but it leads to a very complex usability situation because you don't
have just one operating system you have a bunch of them smushed together that's not easy that's
why we are providing a lot of interesting tools to make the process of using those things together
a bit easier but also to still maintain some security and I want to discuss two things that we
are doing that I think show interestingly how this can be done how you can make things usable
but also think about security and the thing is the first thing is copying and pasting so in the
normal system Linux Windows whatever you select text you press control C or select copy whatever
text goes to clipboard control file V then the text goes to a new place this is of course terrible
from the security standpoint mostly there is a bunch of attacks that are your clibbert that steal
things from your clibbert put some things in your clibbert that should really not be there cubes
makes it a bit more complicated sorry for the slight cutoff this is some technical problem first
you copy text but this lands in the clipboard of the virtual machine you copied it from and all
the virtual machines don't know about it to actually move it to another virtual machine because for
example on your private Facebook you found this fascinating link that you have to share with your
co-worker you have to press control shift plus C copy to the global cubes clipboard and then control
shift V to copy it to another VM this is a bit more complex and yes we theoretically could have
done this is more easily right we could be just like us always copy everything but that what goes
all the security problems that would cause all the issues where one thing could steal the clipboard
from other thing that's not what we want does the introduction of this separate step it also means
that when people are trying to copy and paste things in cubes between different virtual machines
they have to stop for a moment and think do I need to do that this is what I want why am I doing
this this is something that forces you to stop and to pay attention for a second to this process
and that leads to slightly better decisions with relationship to security of course it's not
perfect some people get very much used to it they get it becomes also like automatic for them yeah
this is yet another step just press the keys very quickly but and that means that of course further
security is still needed that means we have to provide more layers of configuration of information
of what's going on we do have a whole complex policy that allows the user to configure it and the
thing is there's a lot of text here and a lot of you will be like nobody reads that yes that's why
we put it in the settings so only the people want to customize what's going on actually go and read
it the other people probably want because they don't care but only if you actually care enough to want
to learn a bit about what's going on then you go to the settings and read it and then you can
specify for example what can copy to where and how to control it so it is making the process so we
are making the process of copying and pasting adding this additional step to make things a bit
more secure by leveraging those two mechanisms technical one but also making people think for
a second about what's going on the other thing that we are doing that I think is very interesting
this is current work I could say devices things you connect to your computer they are evil like a
lot of them can be very malicious you never know what actually happens within the thing that you
are connecting to your computer maybe it is actually a USB stick or maybe not maybe it's
some more malicious device that's just masquerading as a USB stick you know it's very complicated with
them and even those devices that are not evil they very often can do far too much for example
microphone camera they are very powerful things they can record a lot of things that we really
would not like them to record and of course our browsers our programs are swearing to us that
nothing malicious is ever happening but some people don't think this is sufficient level of
security and for many people well attacks can happen and we would like to be protected about it
that's because that's why QPSOS isolates all the devices in their own cube and the user can
decide okay my camera I want to connect it to this cube this virtual machine from which I'm
making calls but not to one from work because I want my boss to have absolutely no chance to see
that I'm working in my pajamas or my microphone can only be connected to this cube not to the
other and the problem with devices is that the initial user interface for handling them was made
by engineers and it's not very friendly there are small things there is a list of stuff a lot of
complicated technical details of what's coming from where one for example one USB stick can
appear multiple times for very good and sensible technical reasons but it's very annoying when
you have to figure out okay which one of them is the thing I actually want to use you have a list
of cubes you want to connect to which is also very small and I ended up with this and I decided to
ask my users okay does this work for you is it good and a lot of people said no this is terrible
because I keep making mistakes because I I want to connect for example my USB stick to my
development cube but I keep connecting it to my work cube because those things are very small
and it's very easy to click on the wrong one and the thing is yes it's a user error it's not
the fault of the system that the user clicks on the on the wrong thing but we would like
the errors to be less common I know it's a user error but I still think we could make it
easier for users to make less errors good decisions and that's why we're working on
redesigning it and I think this is a decent example this is not yet working in cubes this
is incoming will happen very soon once I finish working on it so extremely soon we we are changing
things to one provide more information which is another thing that a lot of users told me when
I started talking to them actually doing user interviews like yeah I know I should know that
but I have no idea which of the devices I see listed is my camera because they all have like
names that consists of numbers and letters randomly maybe we should we can actually show people
which one of the things is the camera which one of the things is the microphone that's why
icons actually show what's happening that's why there is much more space between different
options and that's why the options are actually described not guess what it's going to happen
no now I'm using actual full sentences to describe what the thing is doing and yes this is
basically a visual update right this is not a technical change this is not deep delve into
the back end of the USB of how cubes handles USB stack but this is a change that a lot of people
when they saw it all of you said oh wow now I think I will make less mistakes now this will fix a
bit of me problem but at the end we will have a more secure system everything will be better for me
as a user even though it's just a visual change of course some people are like and this is terrible
too big why it takes up so much space but unfortunately you can never have everybody be very happy
this is basically the same okay so as a final word on these two examples and generally I would
like to say a bit about how to design with security on your mind if you're a designer or if you're a
programmer making a secure things that want to be secure designed for human error designed for
mistakes not just for success take into account that people will do things badly people will be in
the hurry if you if you ever want to design a process for a thing that's supposed to be used by human
imagine that your user is currently having their six month old baby yelling and they're cut puking
at the one at the other side and you want to design a thing that will not completely compromise them
even if that unpleasant situation does happen the things that are secure should be easy making
things in security should be harder making a shortcut the shortcut the easy way should be the secure way
going around because people will sometimes go around also we are open source people we like to go around
sometimes so the going around the insecure way should be harder design for actual human beings
don't don't think that if it's a user error then it's not our fault because unfortunately
user error is also our fault not just the user thank you
five minutes for questions please
yes
isn't it creating more friction in the process and rather than focusing on adding more layers to
like force people to go to read the like all the security issues rather than that why is there
not a focus on the display of the error messages that makes them read it makes the user read them
more properly okay so the question is why why are the more friction instead of just making better
user errors so two reasons one reason is that sometimes it's difficult to tell a part user
error for what user wanted if I copied what I wanted into a wrong cube this is a user error
but it's not an obvious error that can be detected by the system and the other thing is friction is
not always bad we like to think that friction in design is always a bad thing but friction also
forces people to stop to think for a moment and at some sometimes when we design the system
so that people have to make certain choices we give them a large variety of choices but
there are some choices we have to give them a chance to actually make those choices and friction
allows us for the stop to make a choice I don't want to add friction to every copy and paste
within a single VM there is no friction it's just when you're going outside and the friction is by
design to also show that this should not be a common operation to decrease on the making shortcuts
thing yes
Do you have some methods to encourage users for secure behavior for example let's say
what prevents me to log to social media on my work cube
so the question is how to prevent users from making bad decisions security wise for example logging
into social media and work so in short we don't have a technical solution for it we have just a
solution of describing like tutorials how can you use it sharing the setups of the developers of the
core users so like educating people encouraging people to use different colors for different
environments you also if you want to do it like you can limit yourself by limiting network access
of different cubes so be like okay this is firewall and cannot access Facebook or whatever
we don't have a good solution like system-wide this is still a decision that the user can make
it has to make also because the user needs to divide their work into those virtual machines
themselves this is something that the user generally has to do
No so the question is do I have any favorite examples of UX oh this is a very difficult question
security yeah oh I don't know I'd say that I really like how
those usb tokens pass for u2f authentication work so I really like this process which adds
just the perfect amount of friction with the need to press a button so I think this is my favorite
example we have to finish
you