Collaborative Research: SaTC: CORE: Medium: Improving Personal Account Security

This project focuses on the design of secure account management tools and frameworks, advancing the science of digital account security and fostering safer digital ecosystems for people who face targeted attacks. Online accounts increasingly play a central role in people’s wellbeing, acting as the gateway to email, finances, social networks, geographic locations, and even domestic home environments. However, a growing amount of evidence suggests that people who face heightened threats to their digital safety are often targeted by abusive adversaries; adversaries who bypass trusted authentication mechanisms for unauthorized access to victim accounts, enabling further harassment, surveillance, and control. The research agenda has four aims. The first will lead to a better understanding of experiences of targets such attacks, support professionals, and abusive adversaries through qualitative, stakeholder investigations. The second will complement this knowledge by cataloguing existing management tools and emerging authentication mechanisms as provided by online services via new forms of measurement studies and new framework for analyzing the abusability of account management tools. The third will offer new designs of account management tools to improve detection and investigation into illicit accesses, refining them via design provocation studies with relevant stakeholders. The fourth will create new empirically-grounded interventions for the targets to restore their digital safety, and the perpetrators of attacks to deter technology abuse at its source. The intellectual contributions of the work include: 1) new analytical frameworks for assessing illicit client-side access to accounts; 2) new frameworks for reasoning about UI-bound attacks and the abusability of tools; 3) new design patterns for account security management that can be applied widely; and 4) new direct interventions with both the targets of such attacks and abusive adversaries. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.