Re: [hrpc] draft-celi-irtf-hrpc-ipvc-00 (and notification aspects of authentication systems)

[Sofía Celi <[e-mail]>]

Dear, John,

Thank you very much! Apologies for the delay, but there were a couple of 
deadlines on my table ;)

>     Regarding the /Recommendation/ section, I note that the document
>     doesn’t include any mention of importance of the notification
>     capabilities of authentication systems as a means for mitigation
>     possible abuser use of technology.
> 
>     As means of example, I’d refer to the work of the National Network
>     to End Domestic Violence (NNEDV) and Facebook in making clear
>     possible mitigations to technology by abusers, and their publication
>     "A guide for Survivors of Abuse”
>     <https://nnedv.org/wp-content/uploads/2019/07/Library_TH_2018_Privacy_Safety_Facebook_Guide_Survivors_Abuse.pdf <https://nnedv.org/wp-content/uploads/2019/07/Library_TH_2018_Privacy_Safety_Facebook_Guide_Survivors_Abuse.pdf>>, which calls out the usefulness of notifications in detecting misuse of technology by abusers -
> 
>>     Login notifications
>>
>>     You can be notified, either by email or text message, if someone
>>     tries to access your account from a computer or device that you
>>     haven’t used before.
>>
>>     Login approvals
>>
>>     If you are logging into your account from a different web browser
>>     or device, you must have a security code to access your account.
>>
>>     Recognized devices
>>
>>     You can manage the devices that are allowed to have access to your
>>     account and be notified if an unknown device tries to access your
>>     account. This is particularly helpful for a survivor who may have
>>     wanted to access their account from their partner’s device, but
>>     now no longer wants that device to have access.
>>
>>     Active sessions
>>
>>     This is important to note because it shows sessions that are
>>     currently active or logged on. You may have active sessions if
>>     you’ve accessed your account or are using an app and forgot to log
>>     off. This also will show if someone else might have accessed your
>>     account. In that case, you can choose to ‘End Activity,’ which
>>     will block that device from continuing to access your account.
>>
>     This usefulness of such controls echoed in another recent paper "A
>     Domestic Violence Dystopia: Abuse via the Internet of Things and
>     Remedies Under Current Law”
>     <https://californialawreview.org/print/a-domestic-violence-dystopia-abuse-via-the-internet-of-things-and-remedies-under-current-law/#clr-toc-heading-10 <https://californialawreview.org/print/a-domestic-violence-dystopia-abuse-via-the-internet-of-things-and-remedies-under-current-law/#clr-toc-heading-10>>. which notes implications of technology design on those facing potential abuse – "Safe design should also include automatic generation of weekly or monthly reports informing users about their data and account logins, a system notification that shows which registered user initiated the controls, and the standard of requiring that users opt into rather than out of data-sharing between members of a household. “
> 
>     I’d encourage some further discussion on the list of the
>     notification aspects of authentication systems and their potential
>     use in mitigation of abuse via technology, and if found useful,
>     inclusion of additional text in the authentication systems portion
>     of the recommendations.

That is certainly a great point! I opened this github issue to keep it 
in mind: https://github.com/claucece/draft-celi-ipvc/issues/3 I did a 
very quick reading on some literature:

"More broadly, our findings clearly show a need for new tools that help 
users build better mental models of information flows and authorization 
dependencies across their devices and accounts. Reminder notifications 
are one such mechanism, but our interactions with clients suggests that
misunderstanding of information flow is pervasive (e.g., images being 
synced across accounts, files accessible from different devices). Both 
users and consultants also need to better understand authorization 
dependencies — what accounts or devices can be authorized to access a 
particular technology asset. Current approaches, such as configuration 
screens listing backup emails/phone numbers for recovering account 
access or which apps have been authorized to access an account’s
data are disjointed and poorly understood by clients.

One approach would be to design visualization tools that help users 
understand information flow and authorization dependency relationships. 
Our technograph can be seen as a pen-and-paper approach to doing so, but 
digital versions that extract configuration information from accounts to
graphically depict information flows and authorization relationships 
would likely be more accurate and informative. In turn, companies could 
provide “sharing summaries” that provide users with guided tours that 
make sense of an account’s information and authorization flows. 
Transitive cross-platform flows will be significantly harder to 
similarly visualize, since they would rely on compositions of security 
and sharing configurations on distinct platforms. Nevertheless one can 
imagine building a tool that gathers such information to drive a 
visualization."

- From "“Is my phone hacked?” Analyzing Clinical Computer Security 
Interventions with Survivors of Intimate Partner Violence"

I think I agree with all the points noted, but I'll read more some 
references. I do also think we ought to be careful on the recommendation 
as "Register of login details: Regular notifications of login locations 
(i.e., where) and associated timestamps (i.e., when) may be accessible 
to victim’s/survivor’s through their account settings (Parkin et al., 
2019). Crucially, these should be sufficiently vague so as not to put a 
victim/survivor in danger should a perpetrator access this information." 
from "Threat Modeling Intimate Partner Violence: Tech Abuse as a 
Cybersecurity Challenge in the Internet of Things". I think we should 
include the vagueness caveat in some of the points.

Thank you,

-- 
Sofía Celi
@claucece
Cryptographic research and implementation at many places, specially Brave.
Chair of hprc at IRTF and anti-fraud at W3C.
Reach me out at: [e-mail]
Website: https://sofiaceli.com/
3D0B D6E9 4D51 FBC2 CEF7  F004 C835 5EB9 42BF A1D6