Privacy and threat in practice: Lessons from at-risk user populations

Description

The security community has spent decades trying to define what secure systems look like in theory and how to achieve them in practice. However, this effort has largely focused on the machine components of the systems rather than the human needs and processes they are meant to enable.

This leads us to ask: Is a theoretically secure system any good if it doesn’t address users’ real-world threat models? Is the security community today meeting the needs of a global audience or simply building tools and features for itself? Do we know how to understand what people really need?

Drawing on over a decade of experience studying the intersection of human and computer systems, Scout Brody explores the mismatch between security wisdom and user realities, focusing particularly on a recent study of low-income New York City residents that reveals a significant gap between their lived experience and the way our community thinks about secure communications. Scout also shares best practices for professionals seeking to understand their target users before building, selecting, or deploying secure computer systems.