Distinguished Practitioner Keynote: When Security Meets Compatibility

When Security Meets Compatibility
Emily Stark, Tech Lead and Manager, Chrome Security Team, Google

Abstract: Over the past decade, HTTPS adoption has risen dramatically. The Web PKI has shifted seismically, with browsers imposing new requirements on CAs and server operators. These shifts bring security and privacy improvements for end users, but they have often been driven by incompatible browser changes that break websites, causing frustration for end users as well as server operators. Security-positive breaking changes involve a plethora of choices. Should browsers roll out a change gradually, or rip the band-aid off and deploy it all at once? How do we advertise the change and motivate different players in the ecosystem to update configurations before they break? How do different types and amounts of breakage affect the user experience? And the meta-question: how do we approach such quandaries scientifically? Drawing from several case studies in the HTTPS ecosystem, I'll talk about the science of nudging an ecosystem: methods that the web browser community has developed, and lessons we've learned, for measuring how best to get millions of websites to improve security while minimizing the frustrations of incompatibility.

ABOUT THE SPEAKER

Emily Stark is a tech lead and manager on the Chrome Security team. Her team builds Chrome features that help people make safe decisions on the web, using a research-driven approach. Her work includes promoting HTTPS adoption, making HTTPS more usable and secure, and improving many of Chrome's user-facing security and privacy features, from warnings to DevTools to URL display. She holds degrees in computer science from Stanford University and MIT, and has published work from both academia and industry in top-tier computer security research venues.

Video

Slides