►
Description
Presented by Sonya Mann
When you're shipping a product or service -- or a resource that doesn't fit into either category -- you can do a lot of technical work that protects your users behind the scenes. But it's just as important to communicate security and privacy principles to your users, empowering them to take control of their own exposure. Many open-source tools end up being used by people who are less tech-savvy than the creators, and the more accessible you make your security and privacy features, the better.
About CodeConf
CodeConf improves the software community by providing a forum for thought-provoking talks and forging social connections. The fourth installment of the CodeConf series took place in Hollywood in 2016. This year's event focused on systems engineering projects, practices, and programs in the open source community.
For more information on this year's CodeConf, go to:
https://codeconf.com/
A
I
am
a
technology
enthusiast
I'm,
a
freelance
word
person
and
I
use
a
lot
of
websites
and
apps
and
software
products.
I
am
by
no
means
an
expert
on
anything
that
I'm
going
to
talk
about.
So
I
would
like
you
to
regard
this
as
more
of
a
sort
of
experimental
way
of
viewing
the
world
as
viewing
building
software
web
apps,
etc.
A
So
this
talk
is
aimed
at
all
of
you,
people
who
actually
make
websites
apps
and
software
products
and
about
how
you
can
nudge
your
own
users
towards
better
security
habits
so
for
warning,
I'm
going
to
use
passwords
as
an
example
a
lot
because
they're,
the
most
common
security
credential,
that
regular
users
actually
manage
and
control.
But
this
way
of
thinking
about
things
the
security
focused
behavior
design
idea
is
not
limited
to
passwords,
but
I
hope
you'll
be
able
to
sort
of
flex
your
imaginations
a
little
bit.
A
So,
let's
dive
in
you
may
already
know
this,
but
typical
users
have
really
bad
security
habits.
It's
not
because
they're,
stupid
or
lazy,
but
really
because
they
have
different
priorities.
Most
people
aren't
judged
at
work
or
in
their
personal
lives
by
their
security
habits
by
you
know
their
password
hygiene
or
anything
like
that,
and
someone
who
hasn't
personally
experienced
an
account
takeover
or
a
similar
event
is
not
on
high
alert.
A
So
just
in
case,
you
don't
believe
me.
I
want
to
show
you
some
stats.
Splash
data
is
a
password
manager
company
and
they
conduct
an
annual
analysis
of
commonly
used
passwords
for
the
past
five
years
straight.
The
most
common
passwords
have
been
the
number
string,
one
two
three
four
five
six
and
the
word
password
so
I
find
it
disturbing
that
any
app
is
allowing
people
to
choose
these
values
as
a
password
and
in
the
same
vein,
a
robo
forms.
A
Another
password
manager
company
commissioned
the
survey
of
a
thousand
people
in
the
US
and
the
UK
about
their
patented
practices.
So
a
thousand
people
is
a
fairly
small
sample,
but
it's
big
enough
to
give
us
a
sense
of
the
trends.
Only
eight
percent
of
the
respondents
said
that
they
used
a
password
manager
and
you
can
compare
that
to
25
percent
of
people,
23
percent.
Sorry,
who
said
that
they
always
use
the
exact
same
password
so
and
in
preparing
this
talk.
A
A
But
last
class's
spokesperson
told
me
that
they
have
8
million
users,
so
we
can
guesstimate
generously
that
about
20
million
people
use
password
managers
kind
of
adding
those
two
together,
doubling
it
than
adding
a
little
bit
more
and
if
that's
the
ballpark
figure,
then
that
is
about
6
percent
of
America's
2014
population
and
the
world
of
people
who
use
the
internet
or
who
use
software
is
way
bigger
than
just
America.
So
there's
a
lot
of
room
for
improvement
here,
especially
since,
as
I
said,
passwords
are
only
the
most
obvious
security
credential.
A
There
are
lots
of
other
habits
that
people
could
be
improving
and
I
mentioned
account
takeovers
before
that's
one
of
the
most
visible
problems
that
is
caused
by
people's
poor
security
habits.
So
if
you've
ever
worked,
support
or
talked
to
the
support
team,
you've
probably
had
to
deal
with
the
user
you've
heard
about
them,
so
some
of
the
mistakes
lead
to
these
issues
are
not
limited
to
the
you
know
normal
people
who
I
mentioned
in
the
beginning.
A
You
might
recognize
this
guy
Mark
Zuckerberg
is
pretty
widely
acknowledged
to
be
a
genius.
Even
if
you
don't
like
Facebook
as
a
product,
you
can
probably
admit
that
he's
a
great
CEO
Facebook
is
an
extremely
valuable
company.
He's
smart
person
he's
high
profile,
he's
presumably
more
tech
savvy
than
the
average
user,
and
he
is
the
type
of
person
who
a
bad
actor
might
target
specifically.
A
So
he
should
have
some
protections
in
place
right.
Well.
Recent
headlines
showed
us
that
Mark
Zuckerberg
used
the
password
da-da-da-da-da
on
at
least
three
different
social
media
profiles.
So
LinkedIn,
Twitter
and
Pinterest.
We
know
this
because
LinkedIn
had
a
breach
that
it
was
a
password
database
from
a
few
years
ago.
That
was
recently.
We
became
aware
that
this
would
happened
and
Zuckerberg
other
two
accounts.
A
The
Twitter
and
Pinterest
accounts
were
hacked,
so
that's
pretty
embarrassing
for
him
and
imagine
how
frustrating
it
is
for
Twitter
and
Pinterest,
because
you
know
they
didn't
do
anything
wrong,
and
here
they
are
having
to
deal
with
a
high
profile
account
takeover.
Every
other
company
that
had
to
deal
with
account
tapirs
account
takeovers
because
of
the
LinkedIn
breach
is
in
a
similar
situation
and
linked.
It
is,
you
know,
far
from
the
only
company
that
has
had
this
problem.
A
All
of
this
is
because
users
reuse
passwords
just
all
the
time,
and
this
specific
incident
showed
that
lots
of
people
use
their
LinkedIn
credentials
on
multiple
platforms,
and
it's
just
caused
problems
for
everybody.
So
someone
who
reused
their
password
might
require
support
from
Twitter
from
Pinterest
or,
more
importantly,
from
a
bank
from
PayPal
all
these
various
companies
that
deal
with
some
really
sensitive
information
and,
from
the
company
point
of
view,
support
teams
are
really
expensive.
A
They
don't
scale
in
the
same
way
that
technology
does,
because
you
just
need
more
and
more
people
and
time
a
customer
has
to
interact
with
your
support
system.
It's
a
tax
on
their
goodwill.
They
get
frustrated
and
it
doesn't
really
matter
whether
it
was
something
that
you
were
responsible
for
in
the
first
place.
A
If
you
can't
fix
their
problem
easily,
they
will
get
frustrated
at
you,
regardless,
so
to
be
fair
of
Mark
Zuckerburg
situation
and
similar
situations
might
not
have
been
a
problem
in
the
first
place,
if
LinkedIn
has
done
a
better
job
protecting
their
passwords.
But
let
me
give
you
an
example
that
is
pure
user
error.
So
Verizon
did
a
study
in
2015
which
showed
that
23%
of
people
who
receive
phishing
emails,
open
them
and
11%
actually
open
attachments.
That's
a
lot
of
people
who
are
just
blindly
opening
things
or
here's.
A
A
If
you
ever,
you
know
something
happens
to
your
phone
and
what
I
do
is
just
take
a
screenshot
of
the
backup
codes
or
take
a
photo
with
my
phone,
which
kind
of
you
know,
defeats
the
purpose
of
the
backup
codes
and
also
isn't
particularly
secure
and
yet
I
do
it,
because
it's
the
path
of
least
resistance
and
there's
no
like
shaming
mechanism
in
place
from
the
website.
That's
telling
me,
hey,
I,
know
what
you're
about
to
do
and
you
shouldn't
do
it.
A
A
So
how
do
you
deal
with
this
general
problem
of
users?
Not
understanding
how
to
take
their
security
seriously
or
just
not
caring
enough
to
try
so
I
will
admit.
Technical
work
is
the
first
best
most
effective
way
for
you
to
do
something
about
this,
just
to
throw
some
basics
use
HTTPS
Everywhere,
let's
encrypt
David
presentation
yesterday
evening,
they're
a
great
resource.
A
If
you
want
to
do
this
at
low
cost,
if
you're,
storing
passwords
hash
them,
salt
them
use,
well-understood
crypto,
don't
roll
your
own
solutions,
find
cross-site
scripting
opportunities
on
your
website
and
eliminate
them,
enable
multiple
account
management
so
that
people
who
are
using
your
your
software
for
any
kind
of
business
case
can
switch
between
people
and
that
limits
the
need
for
them
to
share
passwords
and
do
that
kind
of
insecure
thing.
So
that
said,
technical
security
design
is
not
what
I'm
here
to
talk
about
and
I.
Don't
know
that
much
about
it
anyway.
A
So,
let's
assume
that
you,
you
know,
you
set
up
your
system
safely
from
an
infrastructure
point
of
view.
So
next
you
need
to
think
about
the
thing
that
I
want
to
talk
about,
which
is
behavior
design.
This
is
the
term
that's
fairly
intuitive.
It
basically
means
what
it
sounds
like,
but
you
know
I'll
explain
the
jargon.
It
has
a
lot
in
common
with
user
experience
design.
A
It
takes
a
careful
balance
of
limiting
the
options
that
are
available,
making
sure
the
right
options
are
available
and
incentivizing
the
desired
behavior,
so
behavior
design
might
involve
instructions
or
it
might
involve
the
GUI.
It
depends
on
the
actions
that
you're
trying
to
encourage
and
the
technology
that
you
are
building
specifically.
So
really,
this
is
more
of
a
mindset.
Then
it's
known,
separate
discipline
like
I
said
at
the
beginning
and
for
the
most
part
there
aren't
well-defined
defense
practices
outside
of
certain
kinds
of
marketing.
A
So
I
do
want
to
acknowledge
that
behavior
design
is
often
paired
with
technical
work.
It's
not
something
that
happens
in
isolation.
It's
usually
a
multi
team
effort.
For
example,
have
you
ever
set
up
an
account
and
face
the
list
of
password
rules?
I'm,
not
even
going
to
ask
you
to
raise
your
hands,
because
I
know
that
all
of
you
have
so
it'll
be
something
like
must
contain
a
capital
letter,
a
number,
an
asterisk
three
money
signs,
your
grandma's
maiden,
name,
etc,
and
in
the
system
there's
the
written
explanation
which
is
integrated
into
the
website
design.
A
That's
why
this
is
a
multi
team,
multi
layer
efforts
like
I,
said
before
a
group
of
people
who
are
really
good
at
behavior
design
is
sleazy
marketers,
at
least
they
do
it
the
most.
Obviously
so
I'm
not
saying
that
all
marketing
is
sleazy.
Marketing
is
really
important
and
useful,
but
certain
techniques
are
pretty
obnoxious.
So
you
know
those
pop
ups
that
make
you
feel
bad
about.
Closing
them
like
this
one,
so
this
pop-up
from
greatest
calm
and
I'm,
not
trying
to
call
them
out
specifically
eight
million
and
three
websites.
A
You
still
use
this
technique,
but
this
pop-up
makes
you
say
that
you
are
not.
You
don't
want
to
be
your
healthiest
self
in
order
to
close
it,
and
there
is
a
little
bit
of
cognitive
dissonance,
even
if
it's
just
a
moment
when
you're
faced
with
this-
and
it
makes
you
more
likely
to
say
yes,
I-
want
to
give
you
my
email,
blah
blah
and
so
that
this
is
an
example
behavior
design
and
which
comes
from
excellent,
confirm,
shaming,
tumblr.com.
A
So
another
weird
behavior
design
thing
is
amazon.
Making
you
claims
that
you're,
not
yourself
if
you
want
to
log
out,
so
I
if
I
want
to
log
out
of
amazon,
which
I
don't
actually
do
pretty
much
ever,
but
if
I
did,
I
would
have
to
say
that
I
was
not
Sonya,
which
is
weird.
I
am
Sonya,
so
there's
this
moment
of
feeling
strange
about
doing
the
things
that
they
don't
want
me
to
do,
and
hence
lets
people.
Do
it
less
times
so.
A
I
have
another
example
which
doesn't
come
with
a
screenshot,
so
you're
just
going
to
have
to
use
your
imagination
and
doesn't
move
an
example
that
I
approve
of
when
you
sign
up
for
a
stripe
account
stripe
is
a
payments
processor
which
I
assume
most
of
you
know
just
in
case
they
encourage
you
to
turn
on
two-factor
authentication
and
then
every
other
time
that
you
visit
the
stripe
dashboard.
There
is
a
yellow
banner,
that's
asking
you
to
enable
2fa,
and
it's
still
there
on
top
of
everything
else,
pressuring
you
to
secure
your
account.
A
So
it's
a
visual
distraction
and
stripe
is
forcing
you
to
think
about
to
FA
every
time
you're
on
their
website.
So
this
is
a
behavior
design
technique
that
I
like
to
call
irritating
the
user
until
they
do
what
you
want.
It's
not
effective
on
everyone,
but
it
works
often
enough
to
be
worth
the
effort.
I'm
sure
stripes
have
seen
increased
usage
of
two-factor
authentication
because
of
that
bars
hovering
over
everything.
A
Let's
look
at
what
not
to
do
so
thought
works,
developer,
Sam,
neuen,
blogged,
about
a
security
flaw
in
a
plugin
for
visual
studio
code
and
visual
studio
code.
In
case
you
don't
know,
is
an
open
source
code
editor.
He
gave
me
permission
to
use
his
screenshots
and
to
use
this
example.
So
Sam
was
trying
out
Visual
Studio
code
and
he
realized
that
it
didn't
have
a
built
in
spell
checker,
which
is
a
feature
that
he
wanted.
So
he
decided
to
look
for
an
extension
through
they're
sort
of
quasi
marketplace
search
platform.
A
I
have
mixed
feelings
about
this
design.
On
the
one
hand,
I
like
that
the
readme
and
license
buttons
are
more
then
the
download
from
the
cloud
right
now
button,
which
is
the
one
on
the
far
right,
but
you
can
download
without
doing
any
due
diligence
actually
check
this
I
downloaded
like
20
megabytes,
in
order
to
just
check
this
one
thing,
the
extension
once
you
click
that
cloud
button
just
download
automatically,
which
makes
this
a
big
problem.
A
Anyone
editing
private
code
should
not
be
using
a
spell
checker
that
sends
data
via
HTTP,
that's
totally
insecure
and
if
you're
working
for
a
company
like
github,
just
use
our
hosts
as
an
example
who
has
a
lot
of
users,
the
business
has
a
lot
of
sensitive
data
which
affects
all
those
users,
so
exposing
code
that
may
be
used
in
production
can
cause
all
kinds
of
problems.
You
don't
want
to
do
that.
A
Of
course,
the
pushback
on
this
concern
is
that
people
should
be
responsible
for
vetting
everything
that
they
install
and
Visual
Studio
code
shouldn't
have
to
worry
about
naive
users,
and
there
is
a
legitimate
argument
to
be
made
there
that
everyone
is
responsible
for
everything
that
they
put
on
their
own
computer.
On
the
other
hand,
people
are
just
not
going
to
do
that.
It's
not
going
to
happen
because
they're,
not
thinking
about
it
or
you
know,
maybe
they
are
lazy,
maybe
they're
just
distracted
or
you
know
some
people
might
think.
Because
of
the
way.
A
This
interface
is
designed
that
the
extensions
are
vetted
by
Visual
Studio
code.
They
would
be
wrong,
but
they
might
think
that
anyway
and
many
users
just
consider
the
issue
consciously
at
all.
So
hypothetically,
the
interface
could
pop
up
a
disclaimer
after
you
click
on
that
cloud
button.
Instead
of
downloading
instantly,
you
could
say
something
like
are
you
sure
you
want
to
download
now?
Remember
extensions.
Have
access
to
your
data
if
you're
handling
sensitive
information,
it's
a
good
idea
to
look
at
the
readme
and
license
first
and
then
you
can.
A
Let
people
click
through
that
if
they
don't
care,
but
it's
the
reminder
hey.
This
is
something
you
can
do
to
be
safer
and
in
fact,
a
lot
of
behavior
design
is
really
just
telling
people
stuff.
You
know
conveying
information
with
words
and
in
other
domains.
This
is
usually
called
copywriting,
which
is
an
art
that
is
sometimes
neglected
when
it
comes
to
product
design.
Copywriting,
usually
lives
with
marketing
and
I
personally
think
that
it's
misguided
to
silo
these
two
domains.
A
So
when
you're,
including
copywriting
in
the
user
interface
and
when
you're,
including
it
in
the
planning
phase
of
the
user
interface,
it's
like
leaving
comments
in
your
code
to
explain
what
it
does,
except
it's
aimed
at
explaining
to
the
user
instead
of
say.
Other
developers
like
I
said
marketing
is
full
of
behavior
design
and
it's
not
all
shady
stuff,
like
the
pop-ups
that
make
you
say,
no
I
don't
want
to
keep
my
firstborn
child.
Maybe
you've
heard
the
phrase
benefits
not
features.
This
is
my
favorite
slide,
so
get
ready
for
it.
A
It
has
pink
on
it.
So
you
know
the
idea
behind
benefits
over
features
is
that,
instead
of
pitching
people
on
the
mechanism
of
your
products,
you
should
explain
how
it
will
improve
their
life.
So,
for
example,
Google's
tagline
wouldn't
be
enter
text
into
a
search
bar
and
get
results.
It
would
maybe
be
something
like
all
the
Internet's
information
at
your
finger
fingertips,
even
that
maybe
doesn't
quite
get
to
the
core.
So
maybe
it
should
be.
You
know,
know
the
answers
before
your
friends,
something
that
appeals
to
people's
unsatisfied
needs
and
leverages
human
nature.
A
So
as
much
as
you
can
do
the
sort
of
social
tie-ins
that
tie
in
with
how
people
navigate
status
in
their
normal
lives,
you
know
the
better.
So
this
also
plays
into
security,
focused
behavior
design.
You
can
explain
security
benefits
instead
of
security
features.
So,
instead
of
saying
like
the
password
acquirement
is
XYZ,
you
can
say
longer
passwords
protect
your
sensitive
information,
so
we
require
at
least
12
characters.
You
should
require
at
least
12
characters
and
hopefully
give
people
the
opportunity
to
use
much
longer
passwords
if
they
want
to.
A
So
your
pitch
to
get
users
to
do
something
like
turn
on
two-factor
authentication
is
not
just
protect
your
account,
but
it's
something
like
keep
your
data,
your
customer
data
out
of
everybody
else's
hands
that
makes
it
more
compelling
to
them
to
go
through
the
hassle,
so
behavior
design
doesn't
always
have
to
be
situated
on
the
user
interface.
You
have
lots
of
opportunities
to
communicate
with
your
users.
You
can
do
things
like
send
lifecycle,
emails,
that
educate
them
and
point
them
to
next
steps.
A
So
here's
an
example:
behavior
designs
beyond
the
UI
pandora
sent
this
email
to
my
dad
in
response
to
the
LinkedIn
breach
that
I
mentioned
earlier,
explaining
that
his
username
was
found
in
the
Leif
data
and
asking
him
to
change
his
password
as
I
mentioned
in
the
beginning,
I
was
going
to
talk
a
lot
about
passwords
and
now
that
I'm
almost
done
passwords
are
actually
a
great
example
of
the
trade-offs
that
come
with
security.
Usually
good
security
habits
are
inconvenient.
That's
why
they
work.
A
And,
of
course,
you
know
the
opposite
business
case
for
putting
work
into
security
focus
behavior
design
is
that
it
will
reduce
your
PR
problems
down
the
road
and
I
mean
PR
public
relations
not
flow
requests.
However,
you
know
that
trade-off
might
not
be
attractive.
You
might
not
want
to
do
it,
and
so
I
would
encourage
you
to
if
you
decide
to
incorporate
any
of
these
principles,
a
B
test,
everything
that
you
can
and
see
how
your
actual
users
respond
to
it.
I
assume
that
you
know
your
business
and
your
products
better
than
I
can.
A
But
you
know,
if
you
can
spare
the
time
and
resources,
please
do
incorporate
more
security
focus,
behavior
design
into
your
products
or
your
service
or
whatever
you're,
making
I
encourage
you
to
at
least
try
it.
Users,
probably
won't.
Thank
you
directly.
You
know
the
quote:
unquote
normal
people
aren't
thinking
about
this,
but
I'm
happy
to
thank
you.
I
will
thank
you.
Let
me
know
that
you
did
it
and
I
will
give
you
all
the
things
and
you
can
feel
good
about
helping
people
take
care
of
themselves
when
they
wouldn't
necessarily
do
it
on
their
own.
A
So
that's
it
I'm
Sonja.
My
website
is
Sonja
Ellen
mancom,
my
twitter
handle
is
at
Sonja
and
man.
I
put
a
copy
of
this
talk
on
my
website.
The
URL
was
at
the
beginning,
I,
don't
know
if
you
guys
saw
that
or
not.
So.
If
you
want
to
go
into
more
depth,
feel
free
to
do
that
and
also
feel
free
to
contact
me
if
you
want
to
talk
about
this
stuffs,
I
love
talking
about
it
all
right.
Thank
you.