Consensual Software O'Reilly Security Conference

15d8946b2d4141db558701c2327ceb25?s=47 Danielle Leong
October 31, 2017
Programming
0
47

Consensual Software O'Reilly Security Conference

15d8946b2d4141db558701c2327ceb25?s=128

Danielle Leong

October 31, 2017
Tweet

Want more?

15d8946b2d4141db558701c2327ceb25?s=48 dmleong
0
58
15d8946b2d4141db558701c2327ceb25?s=48 dmleong
22
7.9k
15d8946b2d4141db558701c2327ceb25?s=48 dmleong
0
60
3ab1249be442027903e1180025340b3f?s=48 reverentgeek
12
680
A9a491b0fcbe0fbce3d64063a37add99?s=48 rmw
3
360
766b9746b59e6f09e280cd33cf4ed419?s=48 skipperchong
0
230
61857dafbd287b3027c4dcea9008ad3c?s=48 carmenhchung
8
470
06f8b41980eb4c577fa40c41d5030c19?s=48 keathley
8
270
C0390e8b11079f8761c0cd3274ed61cb?s=48 productmarketing
3
330
C35e01544a0dd94a2cf1619ee8a42ebb?s=48 clairelew
4
750
6bb82b13cda86d3b821fa44100335ddf?s=48 thoeni
1
190
B3ace07412a5178ea778e7eec161fc0a?s=48 jcasabona
4
270

Transcript

  1. 1.

    Consensual Software Danielle Leong Application Engineer GitHub

  2. 2.

    Consensual Software: Prioritizing Trust & Safety ! @tsunamino 2 @tsunamino

  3. 3.

    Consensual Software: Prioritizing Trust & Safety ! @tsunamino 3 @tsunamino

  4. 4.

    Consensual Software: Prioritizing Trust & Safety ! @tsunamino 4 @tsunamino

  5. 5.
    None
  6. 6.

    Consensual Software: Prioritizing Trust & Safety ! @tsunamino 6 @tsunamino

  7. 7.
    None
  8. 8.

    Consensual Software: Prioritizing Trust & Safety ! @tsunamino 8 @tsunamino

  9. 9.

    Consensual Software: Prioritizing Trust & Safety ! @tsunamino 9 @tsunamino

  10. 10.
    None
  11. 11.

    Danielle Leong @tsunamino @consentsoftware

  12. 12.

    Consensual Software: Prioritizing Trust & Safety ! @tsunamino 12 @tsunamino

    GitHub
  13. 13.

    Title Text @tsunamino

  14. 14.

    Build systems that empower inclusive and healthy communities and encourage

    good online citizenship. Discourage behavior that is destructive or threatens personal safety. @tsunamino
  15. 15.

    Security protects the company from bad actors. We protect people

    from other people. http://www.pewresearch.org/fact-tank/2015/11/10/key-takeaways-mobile-apps/
  16. 16.

    •Not using full names on social media sites •Not using

    real photos for avatars •Turning off location tracking data •Regularly Googling name, address, & phone numbers •Using a burner phone number service & PO boxes •Turning off direct messages •Not live posting on social media during vacation Keeping your info private is hard
  17. 17.

    60% of Americans will not download an app if they

    discover how much personal information the app requires Pew Research Center
  18. 18.

    90% of smartphone owners say having clear information about how

    their data will be used is “very” or “somewhat” important when choosing to download an app Pew Research Center
  19. 19.

    Software isn’t built with privacy or safety in mind @tsunamino

  20. 20.

    What if software respected personal boundaries @tsunamino

  21. 21.

    What if software asked for your consent? @tsunamino

  22. 22.

    Consensual Software: Prioritizing Trust & Safety ! @tsunamino 22 https://www.youtube.com/watch?v=oQbei5JGiT8&t=1s

  23. 23.

    Consensual Software: Prioritizing Trust & Safety ! @tsunamino 23

  24. 24.

    Consensual Software: Prioritizing Trust & Safety ! @tsunamino 24

  25. 25.
    None
  26. 26.

    Consensual software needs to go beyond GDRP and ePrivacy Regulations

    @tsunamino
  27. 27.

    Consensual software is a design pattern that asks for the

    user’s consent to interact with them or their data @tsunamino
  28. 28.

    Consent to interact with the person @tsunamino

  29. 29.

    How can this feature be used to hurt someone? @tsunamino

  30. 30.
    None
  31. 31.

    Principle of least privilege but for people’s information @tsunamino

  32. 32.
    None
  33. 33.

    Features should be opt-in, not opt-out @tsunamino

  34. 34.
    None
  35. 35.
    None
  36. 36.

    Consent to use a person’s data @tsunamino

  37. 37.

    Determine what information is private @tsunamino

  38. 38.

    Private Public •Full names (current or former) •Birthday •Government IDs

    •Phone numbers •Addresses •Passwords •Biometrics •IPs •Credit card/bank info •Geographic locations •Intimate photos •Info the user has consented to be public •Likes •Avatars •Handles or usernames Semi-Private •Email addresses •City of residence •Race •Gender •Sexual orientation
  39. 39.

    What kind of information are you sharing by default? @tsunamino

  40. 40.
    None
  41. 41.
    None
  42. 42.
    None
  43. 43.
    None
  44. 44.

    Audit your site @tsunamino

  45. 45.

    New user flows @tsunamino

  46. 46.

    ❌ Bad

  47. 47.

    ✅ Good

  48. 48.

    ❌ Bad

  49. 49.

    What does your privacy settings page look like? @tsunamino

  50. 50.

    LinkedIn Privacy settings are

  51. 51.

    Need to go beyond having a bunch of toggles. It

    must be incorporated into every aspect of the product @tsunamino
  52. 52.
    None
  53. 53.

    Have a clear privacy policy that defines consent @tsunamino

  54. 54.
    None
  55. 55.
    None
  56. 56.

    @tsunamino Consensual software is a design pattern that asks for

    the user’s consent to interact with them or their data
  57. 57.

    Things to do • Ask how a feature can be

    used to hurt someone • Audit your site, especially new user flows • Streamline your privacy settings pages • Have a clear privacy policy that defines consent @tsunamino
  58. 58.

    Don’t wait until something catastrophic happens @tsunamino

  59. 59.

    Ways to find me on the internet • @tsunamino •

    @consentsoftware • consensualsoftware.com
  60. 60.

    Thanks!