The Hugh Thompson Show, featuring Dr. Lorrie Cranor

### Overview In this concluding session of RSA Conference 2020, Program Committee Chair Hugh Thompson hosts a discussion centered on the conference's overarching theme: the "human element." Thompson explores human vulnerabilities through personal anecdotes and social engineering parallels before inviting Dr. Lorrie Cranor, a leading researcher on security and privacy from Carnegie Mellon University, to discuss human behavior, password choices, IoT security labels, and modern deception.

### Key Topics - **Human Factors and Social Engineering:** Thompson discusses human cognitive traits as inherent "zero days" that attackers exploit. He references Dale Carnegie's *How to Win Friends and Influence People* as an early handbook for social engineering principles, noting that sincere compliments and personalization parallel tactics used in phishing. - **Personal Exploits and Heuristics:** Thompson shares an anecdote regarding his obsession with puzzles and extreme couponing, explaining how deep-seated personal traits can be manipulated to trigger targeted actions like phishing clicks. - **Password Strength and Mental Models:** Dr. Lorrie Cranor discusses a decade of research at Carnegie Mellon examining how users assess and select passwords versus their empirical strength. - **IoT Security and Privacy Nutrition Labels:** Research on consumer comprehension of IoT privacy/security risks and how perceived inconvenience affects purchasing behavior. - **Deception, Deep Fakes, and Phishing Resilience:** The challenges humans face evaluating synthetic media and social engineering.

### Technical Details & Research Findings - **Password Predictability:** Cranor highlighted audience experiments demonstrating the disconnect between user perception and actual password entropy. Users typically judged `I love you 88` and `I eat kale 88` as equally secure due to identical character lengths and number patterns; however, Cranor stated that `I eat kale 88` is "four trillion times better" because `I love you` is among the most commonly chosen phrases. - **Character Positioning:** Similarly, comparing `SpongeBob01` and `Sponge01Bob`, moving digits or special characters into the middle of a string dramatically increases strength compared to standard trailing numbers, which follow common user habits and automated cracking dictionaries. - **IoT Security Labels:** Cranor described an initiative (IoTSecurityPrivacy.org) designing nutrition-style security and privacy labels for smart devices. User studies showed consumers accurately grasp risk indicators (identifying what increases or decreases risk). However, purchasing intent did not always align with risk reduction: features like multi-factor authentication on a smart speaker were perceived as inconvenient, reducing likelihood to buy. Concerns varied by device type, with smart speakers prompting more concern than smart light bulbs, while smart toothbrushes raised unexpected privacy issues around data transmission (e.g., brushing habits sent to insurers). - **Phishing and Media Authentication:** Discussing threats from deepfakes generated using tools like GANs, Cranor noted that despite advanced synthetic media, users still frequently fall for simple plain-text email attacks, though general awareness of routine phishing has modestly improved.

### Takeaways - Security controls cannot evaluate human risk purely on rigid rule-checklists (e.g., character length and symbol inclusion) without accounting for human predictability and common patterns. - Usability remains a dominant hurdle: users frequently reject proven security enhancements (like MFA on IoT devices) when perceived convenience is degraded. - While users have developed moderate resilience against basic phishing attacks over time, mitigating social engineering and synthetic deception remains an ongoing challenge.