Usable Security and Privacy

The course introduces the area of usable privacy and security, including research-related literature in the area. The course consists of lectures and seminars which include presentations by students followed by discussions. In the first part, there are short introductory lectures on legal principles for data protection and PETs (Privacy Enhancing Technologies); HCI principles, concepts, and methods; and an overview of the area usable privacy and security. Students specialise in selected topics related to usable privacy and security, for instance tools and methods for usable monitoring and control (including communication of privacy policy), mental models for technology used for protecting privacy and security, usable configurations of technology for privacy protection and security controls (for instance systems for secret sharing, access control, and firewall rules), usable privacy and security alerts, user-centred privacy and security by design and privacy protection by default, usability of authentication and identity management, including the handling of authentication data, HCI patterns, and dark patterns (also basic decision-making models), and education in cyber security awareness. The course also includes a practical assignment to collect user requirements, develop prototypes of user interfaces, or carry out usability assessments of privacy or security solutions.