No description available.

Secure email systems that use end-to-end encryption are the best method we have for ensuring user privacy and security in email communication. However, the adoption of secure email remains low, with previous studies suggesting mainly that secure email is too complex or inconvenient to use. However, the perspectives of those who have, in fact, chosen to use an encrypted email system are largely overlooked. To understand these perspectives, we conducted a semi-structured interview study that aims to provide a comprehensive understanding of the mindsets underlying adoption and use of secure email services. Our participants come from a variety of countries and vary in the amount of time they have been using secure email, how often they use it, and whether they use it as their primary account. Our results uncover that a defining reason for adopting a secure email system is to avoid surveillance from big tech companies. However, regardless of the complexity and accuracy of a person's mental model, our participants rarely send and receive encrypted emails, thus not making full use of the privacy they could obtain. These findings indicate that secure email systems could potentially find greater adoption by appealing to their privacy advantages, but privacy gains will be limited until a critical mass are able to join these systems and easily send encrypted emails to each other.

No description available.

Prior research examining persons with intellectual disabilities who have committed criminal offenses has focused primarily on correctional populations, or those who reside in secure forensic settings in the United Kingdom and Australia. This study describes 235 persons with intellectual, developmental, and cognitive disabilities who reside in a secure forensic psychiatric hospital in the Midwestern United States. Participants were further divided into groups of persons with pervasive developmental disorders (n = 35), fetal alcohol syndrome (n = 18), traumatic brain injuries (n = 52), or IQ scores falling within the range of moderate (n = 20) or mild (n = 55) mental retardation or borderline intellectual functioning (n = 55). These participants presented with significant histories of childhood maltreatment and adversity, serious psychiatric impairment, criminal histories marked by multiple arrests and serious violent behavior, and frequent histories of institutionalization and out-of-home placement. Their adaptive functioning within the community was characterized by limited histories of normative intimate relationships; sporadic, unskilled employment; and difficulties with maintaining residential and psychiatric stability. Important commonalities and future research needs are discussed. Important differences and similarities between groups are discussed and compared with other available literature.

None of the three largest webmail service providers (serving over 1 billion users) support end-to-end message encryption. Encrypted email has never seen mass adoption because it is prohibitive for non-experts to use. Private WebMail (Pwm) is our extension to popular webmail systems that lets users easily encrypt sensitive messages without having to first contact the recipient and share information. It is designed to spread quickly in a grassroots fashion so that a user receiving their first encrypted message can quickly and easily start using the system. This thesis describes the design and implementation of Pwm, then measures its usability through analysis and a user study.

Billions of web-based email and chat messages are sent over the Internet every day. However, very few service providers support end-to-end privacy protection. While providing security for these messages is technically feasible, usability remains a challenge in this field. Recent research attempts to hide security details like key management and encryption in order to make the system more usable. However usability studies demonstrated that hiding these details may confuse the user and contribute to mistakes (e.g., sending out an email in plaintext when the user thought it would be encrypted). In an effort to increase trust and eliminate mistakes, this thesis presents the design of a browser-based manual encryption mechanism that supports automatic key-management and manual encryption. It also describes the Message Protector (MP) prototype. An evaluations of MP is presented based on a user study conducted on the campus of BYU.

Computer Aided Design (CAD) applications have historically been based on a single user per application architecture. Although this architecture is still popular to date, it does have several drawbacks. First of all the single user CAD architecture inhibits a concurrent engineering design process where several designers can work on the same model simultaneously. This limitation introduces time inefficiency especially when a project involves geographically dispersed designers. A solution to these drawbacks could be a transition from the traditional single user CAD architecture to a multiuser collaborative architecture. Advances in computer networking technologies, especially relating to the Internet, have provided the needed tools to make this transition a reality, thus making it possible for designers to simultaneously work on geometric models from one or more networked computers regardless of the location of the user. This new paradigm is expected to improve collaboration and greatly reduce product design times and consequently reduce cost and improve productivity. The multi-user architecture will, however, also require reliable security mechanisms to ensure its successful deployment in an enterprise environment where protection of intellectual property is of critical importance. This thesis proposes a framework to implement authentication, authorization and secure data communications in a multiuser collaborative CAD software system. This framework has been tested on an emerging multiuser collaborative CAD system called v-CAx being developed at Brigham Young University.

The paper by Apostolaki, Zohar, and Vanbever [3] describes two routing attacks on the Bitcoin network, partition attack and delay attack. By isolating parts of the network or delaying block propagation, a significant amount of mining power could be wasted, resulting in revenue loss and a wide range of exploits could be enabled, such as double spending. Hence, the Bitcoin’s solution to the double spending problem would be broken, making the technology unreliable and unavailable. The Border Gateway Protocol (BGP) is the standardized routing protocol in the current Internet, without any security guarantees. Numerous security extensions have been proposed for BGP, but there is still no widely deployed solution. Therefore, some argue that instead of securing BGP, an entirely new inter-domain architecture should be developed. The thesis investigates the possible mitigation of routing attacks in the blockchain technology, by using the new inter-domain architecture called SCION. Two solutions are proposed utilizing SCION and IP, namely an application level solution and a SIG proxy solution. The solutions have been evaluated in terms of security, availability and efficiency, with the conclusion that routing attacks can be mitigated using SCION. Hence, providing incentive to the blockchain users to use SCION, in order to benefit from a secure and highly available blockchain network communication, with potential revenue increase. Furthermore, the thesis provides incentive for further development of the SCION architecture, as well as applying SCION to additional fields. / Forskningsarbetet av Apostolaki, Zohar och Vanbever [3] beskriver två routingattacker på Bitcoinnätverket, partitioneringsattack och fördröjningsattack. Genom att isolera delar av nätverket eller fördröja blockutbredningen, skulle signifikant mängd brytningskraft kunna slösas bort, vilket resulterar i omsättningsförlust och ett brett spektrum av utnyttjanden skulle kunna möjliggöras, som t.ex. dubbla utgifter. Som en följd, skulle Bitcoins lösning på problemet med dubbla utgifter sättas ur spel, vilket gör tekniken opålitlig och otillgänglig. Border Gateway-protokollet (BGP) är det standardiserade routingprotokollet i nuvarande Internet, utan några säkerhetsgarantier. Många säkerhetsutvidgningar för BGP har föreslagits, även om det fortfarande inte finns någon allmänt nyttjad lösning. Därför hävdar vissa att istället för att säkra BGP, bör en helt ny interdomänarkitektur utvecklas. Detta examensarbete undersöker en eventuell lindring av routingattacker i blockkedjetekniken, med hjälp av den nya interdomänarkitekturen som heter SCION. Två lösningar som nyttjar SCION och IP föreslås, en applikationsnivålösning och en SIG-proxylösning. Lösningarna har utvärderats med avseende på säkerhet, tillgänglighet och effektivitet. Slutsatsen blev att routingattacker kan lindras med SCION, vilket motiverar blockkedjeanvändarna att använda SCION, för att dra nytta av en säker och högt tillgänglig blockkedjenätverkskommunikation, med möjlighet till ökad omsättning. Examensarbetet bidrar dessutom med motivering för vidareutveckling av SCION-arkitekturen, samt till att tillämpa SCION på ytterligare områden.

This applied dissertation paper introduced a program evaluation of a secure laptop-based testing (SLBT) program, which was implemented from 2009 to 2014 in an undergraduate nursing program at a private institution in the southeastern region of the United States (US). Computerized testing is an old topic in the educational research field, but the instructor-made, laptop-based secure testing that utilizes learning management systems (LMS) for undergraduate nursing programs is a fairly new topic in the US. Traditionally, testing has been administered with paper and pencil in the undergraduate nursing programs in the US for security reasons. Recently, with different robust LMSs, together with availability of affordable laptops, SLBT has become a reality on many campuses. The undergraduate nursing program at the Adventist University of Health Sciences (ADU) began to implement the SLBT program in 2009, which allowed students to use their newly purchased laptops to take secure quizzes and tests in their classrooms. After nearly five years' SLBT program implementation, a formative evaluation was conducted to seek constructive feedback from students, faculty, and technology support personnel to improve the program. Evaluation data show that, overall, students believed the SLBT program help them get hands-on experience of taking exams on the computer and get them prepared for their National Council Licensure Examination for Registered Nurses (NCLEX-RN) which is also computerized. Students, however, had a lot of concerns on laptop glitches and campus wireless network glitches they experienced during testing. Faculty and technology support personnel, on the other hand, were very satisfied with the SLBT program. Another goal of this evaluation study was to determine if students' first-time passing rate of NCLEX-RN has been improved significantly after the implementation of the SLBT program. NCLEX-RN first-time passing rate data were analyzed using the Chi-Square test and it revealed that there was no significant association between the two types of testing method (paper-and-pencil testing and the secure laptop-based testing) and whether or not students would pass NCLEX-RN the first time X2(1) = 3.53, p > .05. Based on the odds ratio, however, the odds of students passed NCLEX-RN the first time were 1.37 times higher if they were taught with the SLBT testing method than if taught with the traditional paper-and-pencil testing method in nursing school.

Secure Shell, a tool to securely access and run programs on a remote machine, is an important tool for both system administrators and developers alike. The technology landscape is becoming increasingly distributed and reliant on tools such as Secure Shell to protect information as a user works on a system remotely. While Secure Shell accounts for the abuses the security of older tools such as telnet overlook, it still has fundamental vulnerabilities which leak information about both the user and their activities through timing attacks. The OpenSSH client, the implementation included in all Linux, Mac, and Windows computers, sends each keystroke entered to the server as soon as it becomes available. As a result, an attacker can observe the network patterns to know when a user presses a key and draw conclusions based on that information such as what a user is typing or who they are. In this thesis, we demonstrate that such an attack allows a malicious observer to identify a user with a concerning level of accuracy without having direct access to either the client or server systems. Using machine learning classifiers, we identify individual users in a crowd based solely on the size and timing of packets traveling across the network. We find that our classifiers were able to identify users with 20\% accuracy using as little as one hour of network traffic. Two of them promise to scale well to the number of users.