log in  |  register  |  feedback?  |  help  |  web accessibility
Logo
When SIGNAL hits the Fan: On the Usability and Security of State-of-the-Art Secure Mobile Messaging
Wednesday, March 15, 2017, 1:00-2:00 pm Calendar
  • You are subscribed to this talk through .
  • You are watching this talk through .
  • You are subscribed to this talk. (unsubscribe, watch)
  • You are watching this talk. (unwatch, subscribe)
  • You are not subscribed to this talk. (watch, subscribe)
Abstract

In this paper we analyze the security and usability of the state-of-the-art secure mobile messenger SIGNAL. In the first part of this paper we discuss the threat model current secure mobile messengers face. In the following, we conduct a user study to examine the usability of SIGNAL’s security features. Specifically, our study assesses if users are able to detect and deter man-in-the-middle attacks on the SIGNAL protocol. Our results show that the majority of users failed to correctly compare keys with their conversation partner for verification purposes due to usability problems and incomplete mental models. Hence users are very likely to fall for attacks on the essential infrastructure of today’s secure messaging apps: the central services to exchange cryptographic keys. We expect that our findings foster research into the unique usability and security challenges of state of-the art secure mobile messengers and thus ultimately result in strong protection measures for the average user.

Slides: https://www.umiacs.umd.edu/~dvotipka/misc/ReadingGroupSlides_Wei.pdf

This talk is organized by Daniel Votipka