Why Johnny the Developer Can't Work with Public Key
Certificates: An Experimental Study of OpenSSL Usability

D 2018

Why Johnny the Developer Can't Work with Public Key Certificates: An Experimental Study of OpenSSL Usability

UKROP, Martin a Václav MATYÁŠ

Základní údaje

Originální název

Why Johnny the Developer Can't Work with Public Key Certificates: An Experimental Study of OpenSSL Usability

Autoři

UKROP, Martin (703 Slovensko, garant, domácí) a Václav MATYÁŠ (203 Česká republika, domácí)

Vydání

Švýcarsko, Topics in Cryptology – CT-RSA 2018: The Cryptographers' Track at the RSA Conference 2018, od s. 45-64, 20 s. 2018

Nakladatel

Springer International Publishing

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Obor

10201 Computer sciences, information science, bioinformatics

Stát vydavatele

Spojené státy

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

tištěná verze "print"

Odkazy

URL

Impakt faktor

Impact factor: 0.402 v roce 2005

Kód RIV

RIV/00216224:14330/18:00100813

Organizační jednotka

Fakulta informatiky

ISBN

978-3-319-76952-3

ISSN

DOI

https://doi.org/10.1007/978-3-319-76953-0_3

UT WoS

000445246500003

EID Scopus

2-s2.0-85045462454

Klíčová slova anglicky

usable security;cryptographic library;API

Štítky

best4

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 30. 4. 2019 15:28, RNDr. Pavel Šmerk, Ph.D.

Anotace

V originále

There have been many studies exposing poor usability of security software for the common end user. However, only a few inspect the usability challenges faced by more knowledgeable users. We conducted an experiment to empirically assess usability of the command line interface of OpenSSL, a well known and widely used cryptographic library. Based on the results, we try to propose specific improvements that would encourage more secure behavior. We observed 87 developers/administrators at two certificate-related tasks in a controlled environment. Furthermore, we collected participant opinions on both the tool interface and available documentation. Based on the overall results, we deem the OpenSSL usability insufficient according to both user opinions and standardized measures. Moreover, the perceived usability seems to be correlated with previous experience and used resources. There was a great disproportion between the participant views of a successful task accomplishment and the reality. A general dissatisfaction with both OpenSSL interface and its manual page was shared among the majority of the participants. As hinted by a participant, OpenSSL gradually “turned into a complicated set of sharp kitchen knives” – it can perform various jobs very well, but laymen risk stabbing themselves in the process. This highlights the necessity of a usable design even for tools targeted at experienced users (Supplementary material available at crocs.fi.muni.cz/papers/rsa2018).

Návaznosti

GBP202/12/G061, projekt VaV

Název: Centrum excelence - Institut teoretické informatiky (CE-ITI) (Akronym: CE-ITI)

Investor: Grantová agentura ČR, Centrum excelence - Institut teoretické informatiky

Citovat

UKROP, Martin a Václav MATYÁŠ. Why Johnny the Developer Can't Work with Public Key Certificates: An Experimental Study of OpenSSL Usability. In Nigel P. Smart. Topics in Cryptology – CT-RSA 2018: The Cryptographers' Track at the RSA Conference 2018. Švýcarsko: Springer International Publishing, 2018, s. 45-64. ISBN 978-3-319-76952-3. Dostupné z: https://doi.org/10.1007/978-3-319-76953-0_3.

@inproceedings{1406887,
   author = {Ukrop, Martin and Matyáš, Václav},
   address = {Švýcarsko},
   booktitle = {Topics in Cryptology – CT-RSA 2018: The Cryptographers' Track at the RSA Conference 2018},
   doi = {https://doi.org/10.1007/978-3-319-76953-0_3},
   editor = {Nigel P. Smart},
   keywords = {usable security;cryptographic library;API},
   howpublished = {tištěná verze "print"},
   language = {eng},
   location = {Švýcarsko},
   isbn = {978-3-319-76952-3},
   pages = {45-64},
   publisher = {Springer International Publishing},
   title = {Why Johnny the Developer Can't Work with Public Key Certificates: An Experimental Study of OpenSSL Usability},
   url = {https://link.springer.com/chapter/10.1007%2F978-3-319-76953-0_3},
   year = {2018}
}

TY  - CONF
ID  - 1406887
AU  - Ukrop, Martin - Matyáš, Václav
PY  - 2018
TI  - Why Johnny the Developer Can't Work with Public Key Certificates: An Experimental Study of OpenSSL Usability
PB  - Springer International Publishing
CY  - Švýcarsko
SN  - 9783319769523
KW  - usable security;cryptographic library;API
UR  - https://link.springer.com/chapter/10.1007%2F978-3-319-76953-0_3
L2  - https://link.springer.com/chapter/10.1007%2F978-3-319-76953-0_3
N2  - There have been many studies exposing poor usability of security software for the common end user. However, only a few inspect the usability challenges faced by more knowledgeable users. We conducted an experiment to empirically assess usability of the command line interface of OpenSSL, a well known and widely used cryptographic library. Based on the results, we try to propose specific improvements that would encourage more secure behavior. We observed 87 developers/administrators at two certificate-related tasks in a controlled environment. Furthermore, we collected participant opinions on both the tool interface and available documentation. Based on the overall results, we deem the OpenSSL usability insufficient according to both user opinions and standardized measures. Moreover, the perceived usability seems to be correlated with previous experience and used resources. There was a great disproportion between the participant views of a successful task accomplishment and the reality. A general dissatisfaction with both OpenSSL interface and its manual page was shared among the majority of the participants. As hinted by a participant, OpenSSL gradually “turned into a complicated set of sharp kitchen knives” – it can perform various jobs very well, but laymen risk stabbing themselves in the process. This highlights the necessity of a usable design even for tools targeted at experienced users (Supplementary material available at crocs.fi.muni.cz/papers/rsa2018).
ER  -

UKROP, Martin a Václav MATYÁŠ. Why Johnny the Developer Can't Work with Public Key Certificates: An Experimental Study of OpenSSL Usability. In Nigel P. Smart. \textit{Topics in Cryptology – CT-RSA 2018: The Cryptographers' Track at the RSA Conference 2018}. Švýcarsko: Springer International Publishing, 2018, s.~45-64. ISBN~978-3-319-76952-3. Dostupné z: https://doi.org/10.1007/978-3-319-76953-0\_{}3.

Přehled o publikaci