Patrick Gage Kelley

Measuring password guessability for an entire university

Despite considerable research on passwords, empirical studies of password strength have been limited by lack of access to plaintext passwords, small data sets, and password sets specifically collected for a research study or from low-value accounts. Properties of passwords used for high-value accounts thus remain poorly understood. We fill this gap by studying the single-sign-on passwords used by over 25,000 faculty, staff, and students at a research university with a complex password policy. Key aspects of our contributions rest on our (indirect) access to plaintext passwords. We describe our data collection methodology, particularly the many precautions we took to minimize risks to users. We then analyze how guessable the collected passwords would be during an offline attack by subjecting them to a state-of-the-art password cracking algorithm. We discover significant correlations between a number of demographic and behavioral factors and password strength. For example, we find that users associated with the computer science school make passwords more than 1.5 times as strong as those of users associated with the business school. while users associated with computer science make strong ones. In addition, we find that stronger passwords are correlated with a higher rate of errors entering them. We also compare the guessability and other characteristics of the passwords we analyzed to sets previously collected in controlled experiments or leaked from low-value accounts. We find more consistent similarities between the university passwords and passwords collected for research studies under similar composition policies than we do between the university passwords and subsets of passwords leaked from low-value accounts that happen to comply with the same policies.

i read my Twitter the next morning and was astonished: a conversational perspective on Twitter regrets

We present the results of an online survey of 1,221 Twitter users, comparing messages individuals regretted either saying during in-person conversations or posting on Twitter. Participants generally reported similar types of regrets in person and on Twitter. In particular, they often regretted messages that were critical of others. However, regretted messages that were cathartic/expressive or revealed too much information were reported at a higher rate for Twitter. Regretted messages on Twitter also reached broader audiences. In addition, we found that participants who posted on Twitter became aware of, and tried to repair, regret more slowly than those reporting in-person regrets. From this comparison of Twitter and in-person regrets, we provide preliminary ideas for tools to help Twitter users avoid and cope with regret.

Curated city: capturing individual city guides through social curation

We report on our design of Curated City, a website that lets people build their own personal guide to the citys neighborhoods by chronicling their favorite experiences. Although users make their own personal guides, they are immersed in a social curatorial experience where they are influenced directly and indirectly by the guides of others. We use a 2-week field trial involving 20 residents of Pittsburgh as a technological probe to explore the initial design decisions, and we further refine the design landscape through subject interviews. Based on this study, we identify a set of design recommendations for building scalable social platforms for curating the experiences of the city.

The Future of Networked Privacy: Challenges and Opportunities

Building on recent work in privacy management and disclosure in networked spaces, this two-day workshop examines networked privacy challenges from a broader perspective by (1) identifying the most important issues researchers will need to address in the next decade and (2) working to create actionable solutions for these privacy issues. This workshop comes at a critical time for organizations, researchers, and consumers, as content-sharing applications soar in popularity and more privacy and security vulnerabilities emerge. Workshop participants and organizers will work together to develop a guiding framework for the community that highlights the future challenges and opportunities of networked privacy.

Balancing Security and Usability in Encrypted Email

End-to-end encryption is the best way to protect digital messages. Historically, end-to-end encryption has been extremely difficult for people to use, but recent tools have made it more broadly accessible, largely by employing key-directory services. These services sacrifice some security properties for convenience. The authors wanted to understand how average users think about these tradeoffs. They conducted a 52-person user study and found that participants could learn to understand properties of different encryption models. Users also made coherent assessments about when different tradeoffs might be appropriate. Participants recognized that the less-convenient exchange model was more secure overall, but considered the registration models security sufficient for most everyday purposes.

Molecular tetris: crowdsourcing molecular docking using path-planning and haptic devices

Many biological processes, including immune recognition, enzyme catalysis, and molecular signaling, which is still an open problem in biological sciences. We present Molecular Tetris, a game in which a player can explore the binding between a protein receptor and ligand. This exploration is similar to the game Tetris with atomic forces guiding best fits between shapes. This game will be utilized for crowdsourced haptic-guided motion planning. Haptic touch devices enable users to feel the interactions of two molecules as they move the ligand into an appropriate binding site on the receptor. We demonstrate the method on a critical piece of human immune response, ligand binding to a Major Histocompatibility Complex (MHC) molecule. Through multiple runs by our users, we construct a global roadmap that finds low energy paths to molecular docking sites. These paths are comparable to a highly-biased roadmap generated by Gaussian sampling around the known bound state. Our users are able to find low energy paths with both a specialized force-feedback device and a commodity game console controller.

Interactive design and simulation of tubular supporting structure

Abstract This paper presents a system for design and simulation of supporting tube structure. We model each freeform tube component as a swept surface, and employ boundary control and skeletal control to manipulate its cross-sections and its embedding respectively. With the parametrization of the swept surface, a quadrilateral mesh consisting of nine-node general shell elements is automatically generated and the stress distribution of the structure is simulated using the finite element method. In order to accelerate the complex finite element simulation, we adopt a two-level subspace simulation strategy, which constructs a secondary complementary subspace to improve the subspace simulation accuracy. Together with the domain decomposition method, our system is able to provide interactive feedback for parametric freeform tube editing. Experiments show that our system is able to predict the structural character of the tube structure efficiently and accurately.

Immaculacy: a game of privacy

With the intent of addressing growing concerns regarding online privacy, Immaculacy is an interactive story that immerses the player in a slightly dystopian world littered with privacy issues. Events unfold in the narrative based on hidden scores kept during gameplay and calculated based on specific decisions made by the player. Ultimately, we hope to create an engaging environment that helps players consider the decisions they are making in their own lives. We give the player experience with many privacy issues through their explorations of a world of hyper surveillance and connectivity.