Eva Galperin (Electronic Frontier Foundation)

"Hey Siri, Find My Ex" Threat Modeling for Domestic Abuse Cases

An abuser who knows you intimately, knows your family and friends, and may have physical access to your home and devices is one of the most difficult attackers to thwart in the world of digital privacy and security. A determined abuser has all of the persistence, ingenuity, and patience of an APT. This talk will discuss some of the tools that abusers use to stalk, spy on, and harass their victims, the ways in which the use of those tools can be detected or stopped, and how we can build better products and platforms that are resistant to being used for abuse.

Stefan Savage (UC San Diego)

Why isn’t security research making us more secure?

Over the last 25 years, research in computer security has flourished -- thousands of papers written, systems tested, insights gleaned and proposals made. At the same time, public and private sectors have spent untold hundreds of billions to implement cybersecurity efforts. In spite of these efforts, few would confidently argue that this investment in security has produced a commensurate reduction in real-world security outcomes. Why not?

In this talk I’ll opine on this “why not?” question and, in particular, the role of the security research community in this matter. Where do real-world security failures arise and why hasn’t the research community been effective in addressing these failures? What structural challenges and incentives focus the research community in ways that limit its impact? And, perhaps most importantly, what might the security research community do to improve this situation?