Usable Privacy and Security Course Overview

1
Usable Privacy and Security Course Overview

• Lorrie Cranor, Jason Hong, Mike Reiter
• Grad students and juniors and seniors
• Tended to be HCI, CS, Public Policy students
• Textbook
• First few lectures broad intros
• Intro to HCI methods
• Intro to privacy
• Intro to computer security
• Students led rest of lectures
  and discussion

2
Course Projects

• Teams of 3-4 people
• At most 1 HCI Masters student
• At most 2 PhD students
• Project requirements
• Complete IRB proposal (not necessarily submit)
• Develop questionnaires / surveys / prototypes
• Test study protocol on other students
• Conduct pilot study

3
Course Projects

• Projects
• Foxtor Anonymous Web Browsing
• Why Johnny Still Cant Encrypt
• Symbols of Privacy
• Improving Decisions on Opening E-mail Attachments

4
Course Highlights

• Need more small-scale exercises on HCI methods
• Small-scale user studies
• Heuristic evaluation
• Students had lots of activities in lectures
• Good password habits quiz
• Pictionary exercise
• Develop and run small user study on CD player /
  calculator
• Students wanted more instructor lectures
• Pilot study hardest part, not lots of experience
• Recruiting, Debugging protocol
• Do pre-pilot study, get feedback in midterm
  presentations
• Overall, projects pretty good

5

• Discussion board for posting beforehand
• Social engineering session
• Combine with HCI course somehow?
• Split homeworks T/Th for attendance reasons
• Will help you find job

6

• Teaching Usable Privacy
• and Security
• Discussion Notes

7
Teaching Usable Privacy and SecurityDiscussion
Notes

• 20 people in attendance
• People that would like to take the course
• People that will be teaching course or lecture
  like it soon
• Brief overview of our course (Spring 2006)
• Taught by Lorrie Cranor, Jason Hong, Mike Reiter
• Seminar style, 15 students
• Started with intro to HCI, privacy, security
• Rest of lectures and discussions student led
• Large course project with milestones and
  presentations
• Project group constraints 1 HCI, 2PhDs max

8
Teaching Usable Privacy and SecurityDiscussion
Notes

• What worked well?
• Breadth of course good
• Diverse backgrounds helped learning
• Project was good opportunity to learn
• Midterm presentations to get project feedback
• Students asked to have study and pre-pilot done
• What could be improved?
• Hardest part was designing and running pilot
  study
• More homeworks with small HCI exercises
• More guest lectures of case studies

9
Teaching Usable Privacy and SecurityDiscussion
Notes

• Possible directions
• Have students take both a security and HCI
  course?
• Either sequential or simultaneously
• Include a social engineering component
• What if only doing 1-2 lectures?
• Get people to appreciate difficulty and
  importance
• Get people to understand finding experts
• Final Notes
• Assembling an instructors manual
• Please send any materials youre willing to share
• We are also looking for reviewers