Comparing the Usability of Cryptographic APIs

Acar, Yasemin; Backes, Michael; Fahl, Sascha; Garfinkel, Simson L.; Kim, Doowon; Mazurek, Michelle L.; Stransky, Christian

doi:10.1109/sp.2017.52

Cited by 142 publications

(142 citation statements)

References 29 publications

Supporting

Mentioning

137

Contrasting

Unclassified

Order By: Relevance

“…Indeed, it has a similar rate to another security study where professionals were requested to code crypto API: 1571 people started the task, 660 dropped without taking any action, eventually only 337 (21%) arrived at the end (Acar et al 2017). Table 5 summarizes the demographic information about our participants that completed the task.…”

Section: Study Executionmentioning

confidence: 74%

Graphical vs. Tabular Notations for Risk Models: On the Role of Textual Labels and Complexity

Labunets

Massacci

Tedeschi

2017

2017 ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM)

View full text Add to dashboard Cite

Abstract[Background] Security risk assessment methods in industry mostly use a tabular notation to represent the assessment results whilst academic works advocate graphical methods. Experiments with MSc students showed that the tabular notation is better than an iconic graphical notation for the comprehension of security risks.[Aim] We investigate whether the availability of textual labels and terse UML-style notation could improve comprehensibility. [Method] We report the results of an online comprehensibility experiment involving 61 professionals with an average of 9 years of working experience, in which we compared the ability to comprehend security risk assessments represented in tabular, UML-style with textual labels, and iconic graphical modeling notations.[Results] Tabular notation are still the most comprehensible notion in both recall and precision. However, the presence of textual labels does improve the precision and recall of participants over iconic graphical models.[Conclusion] Tabular representation better supports extraction of correct information of both simple and complex comprehensibility questions about security risks than the graphical notation but textual labels help.

show abstract

Section: Study Executionmentioning

confidence: 74%

Graphical vs. Tabular Notations for Risk Models: On the Role of Textual Labels and Complexity

Labunets

Massacci

Tedeschi

2017

2017 ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM)

View full text Add to dashboard Cite

show abstract

“…Their results exhibit that their approach considerably helps 73% of the participants to produce more secure code by employing security guidance from the documentation [11]. Yasemin et al suggested that documentation with secure and easy-to-use code examples of cryptographic APIs could help developers in using the API correctly [8]. Researchers have also developed static analysis tools that facilitate the use of cryptography.…”

Section: Related Workmentioning

confidence: 99%

The Impact of Developer Experience in Using Java Cryptography

Hazhirpasand

Ghafari

Krüger

et al. 2019

2019 ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM)

View full text Add to dashboard Cite

Background: Previous research has shown that crypto APIs are hard for developers to understand and difficult for them to use. They consequently rely on unvalidated boilerplate code from online resources where security vulnerabilities are common.Aims and method: We analyzed 2,324 open-source Java projects that rely on Java Cryptography Architecture (JCA) to understand how crypto APIs are used in practice, and what factors account for the performance of developers in using these APIs.Results: We found that, in general, the experience of developers in using JCA does not correlate with their performance. In particular, none of the factors such as the number or frequency of committed lines of code, the number of JCA APIs developers use, or the number of projects they are involved in correlate with developer performance in this domain.Conclusions: We call for qualitative studies to shed light on the reasons underlying the success of developers who are expert in using cryptography. Also, detailed investigation at API level is necessary to further clarify a developer obstacles in this domain.

show abstract

“…Even though the importance of the usability of security APIs has been identified and discussed [9,15,16,19], not much work has been done to evaluate the usability of security APIs. Gorski and Iacono [17] presented 11 characteristics that need to be considered when evaluating the usability of security APIs.…”

Section: Related Workmentioning

confidence: 99%

Fighting Against XSS Attacks. A Usability Evaluation of OWASP ESAPI Output Encoding

Wijayarathna¹,

Arachchilage²

2019

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

Cross Site Scripting (XSS) is one of the most critical vulnerabilities exist in web applications. XSS can be prevented by encoding untrusted data that are loaded into browser content of web applications. Security Application Programming Interfaces (APIs) such as OWASP ESAPI provide output encoding functionalities for programmers to use to protect their applications from XSS attacks. However, XSS still being ranked as one of the most critical vulnerabilities in web applications suggests that programmers are not effectively using those APIs to encode untrusted data. Therefore, we conducted an experimental study with 10 programmers where they attempted to fix XSS vulnerabilities of a web application using the output encoding functionality of OWASP ESAPI. Results revealed 3 types of mistakes that programmers made which resulted in them failing to fix the application by removing XSS vulnerabilities. We also identified 16 usability issues of OWASP ESAPI. We identified that some of these usability issues as the reason for mistakes that programmers made. Based on these results, we provided suggestions on how the usability of output encoding APIs should be improved to give a better experience to programmers.

show abstract

Comparing the Usability of Cryptographic APIs

Cited by 142 publications

References 29 publications

Graphical vs. Tabular Notations for Risk Models: On the Role of Textual Labels and Complexity

Graphical vs. Tabular Notations for Risk Models: On the Role of Textual Labels and Complexity

The Impact of Developer Experience in Using Java Cryptography

Fighting Against XSS Attacks. A Usability Evaluation of OWASP ESAPI Output Encoding

Contact Info

Product

Resources

About