[User] Please transcribe this text

[Assistant] And then finally in the third task we had them open up the settings panel, uhm, on their device for an application of their choice that they use regularly. Uhm, and then looking at those, uh, the permissions that were granted to that application of their choice that they use regularly.


[User] Please transcribe this text

[Assistant] Could they tell us whether or not that application has the ability to send SMS messages?


[User] Please transcribe this text

[Assistant] Uhm, and so what we found was that, uh, during the installation task, fewer than 20% of our participants, uh, stopped at that screen to actually look at it. We suspect this is probably an upper bound because they were in the laboratory, they knew that they were being observed, so maybe they, you know, did the task with a lot more diligence than they might at home. Uhm,


[User] Please transcribe this text

[Assistant] And then in the other task about, uh, you know, answering the question about could they, could the app that they're familiar with send SMS messages, uh, a majority of participants, uh, couldn't answer that question correctly even though they were looking at the list of granted permissions.


[User] Please transcribe this text

[Assistant] So basically, you know, people are habituated to just clicking through. So uhm, when you install an app, there's an install button and then that screen comes up right after you click install and there's another button in a similar spot.


[User] Please transcribe this text

[Assistant] Over 80% of the people just sort of clicked twice to go right through that screen. And when we asked them, you know, afterwards, they said, oh yea, they thought that was just like a license agreement. Uhm, so they know to skip past that.


[User] Please transcribe this text

[Assistant] So based on uhm, the qualitative results, uh, we had a couple suggestions on how the user experience could be improved. So one was that people were just, you know, habituated to...


[User] Please transcribe this text

[Assistant] Users should only be prompted when absolutely necessary when there's an actual risk.


[User] Please transcribe this text

[Assistant] Many people were simply unaware. So, again, the screen appears after they click the install button. Uh, many people thought that that was just sort of a license agreement. Uhm, and that they were supposed to click through it. Uhm, there are also many, you know, cognitive biases that might have.


[User] Please transcribe this text

[Assistant] Uh, you know, might have been at play here, so maybe choice supportive bias after clicking the install button. They didn't want to, you know, revisit that decision that they just made to install the application.


[User] Please transcribe this text

[Assistant] And so maybe, you know, presenting this information at a different point in the, the interaction would have yielded different results. So maybe before they click install, it shows the permissions. Or maybe at runtime, when the data is actually needed by the application, maybe then would be a better time.


[User] Please transcribe this text

[Assistant] We observed with the SMS thing, uhm, when we had them use an application that they're already familiar with, uh, the reason why most of them got that wrong is that they saw things like a request for network access and they didn't know that there was a separate permission for sending SMS.


[User] Please transcribe this text

[Assistant] Data. They thought maybe that's part of network access. And so in this case, there's so many different permissions that really knowing the entire set of permissions, uhm, is necessary to know what permissions an app is not requesting. And when you have, you know, a hundred some different permissions, that's obviously unreasonable.


[User] Please transcribe this text

[Assistant] So, you know, in this case, uhm, there are many different ways of granting permissions on mobile devices and this also applies for, you know, desktop platforms as well.


[User] Please transcribe this text

[Assistant] Uhm, in the case of Android, there were, you know, their install time warnings. Uhm, this is how it appears in, I guess, the more current versions of Android.


[User] Please transcribe this text

[Assistant] Uhm, the advantage of having the install time warnings, uh, for doing the permissions is that it's adaptable to, you know, a great, you know, basically every permission. You can do this because you're just, you know, you need a little space for text here and you have the text to describe the permission.


[User] Please transcribe this text

[Assistant] They're mostly that there's the limited real estate. So, you know, on your average device, uh, it's about these dimensions. You could really only fit three different permission requests on that screen. You're then relying on the user to know that they have to scroll down the screen to view additional permissions.


[User] Please transcribe this text

[Assistant] And so those are easy to overlook. Uhm, also when this is part of, you know, the installation flow, it's also easy to overlook because there are a lot of other decisions that they're making at that time.


[User] Please transcribe this text

[Assistant] And the last problem is that they lack, they lack context. So when you're granting future abilities, you have no idea in what sort of situations these abilities are actually going to be used because it's at install time. So when an application, say, asks for location access and install time,


[User] Please transcribe this text

[Assistant] You know, maybe to some people that would signal location specific features, which might be desirable, uhm, but it could also mean, uh, maybe behavioral advertising is being done based on location, which is, you know, something that people might find undesirable.


[User] Please transcribe this text

[Assistant] When it's done at, you know, a priori here, there's really no way of distinguishing the two.


[User] Please transcribe this text

[Assistant] Restaurants near them, and so then when they get a request for, you know, Yelp is requesting location access.


[User] Please transcribe this text

[Assistant] Likewise, you know, if you're using Angry Birds and all of a sudden it requests location,


[User] Please transcribe this text

[Assistant] It's not immediately obvious and so maybe that's being used for something else, uhm, and then the user might have a better idea of why they wanna, you know, decline giving, giving it that access.


[User] Please transcribe this text

[Assistant] Another nice thing about runtime warnings is that they can be dynamic. So in the case, you know, here maybe we have Bluetooth pairing. So in this case, because it's at runtime, we can show the name of the device that it's trying to pair with. Whereas if this were done at install time, basically there's no way of doing that. You can't predict in the future what all the devices would be.


[User] Please transcribe this text

[Assistant] These have drawbacks as well. So, you know, the primary one is habituation. So, users tend to see these as a barrier to the primary task. They're doing something, all of a sudden this dialogue appeared. I need to swap this away so that I can continue doing what I was already, you know, trying to do.


[User] Please transcribe this text

[Assistant] Uhm, so Microsoft got a lot of flack for this in, uh, Windows Vista. So they had this, uh, user account control whenever an application required any sort of elevated privileges. It would throw one of these runtime warnings and basically trained people to click continue whenever they saw one of these.


[User] Please transcribe this text

[Assistant] So this begs the question, uhm, maybe we could use some sort of mechanism that doesn't interrupt the user's flow so that these aren't seen as a barrier to the primary task.


[User] Please transcribe this text

[Assistant] So, you know, one thing Apple's doing is curation. So, in the iTunes store, uhm, when you download an app, there aren't any sort of permission requests because there's a screening process. If you're a developer, your app is reviewed by some sort of opaque process, uhm,


[User] Please transcribe this text

[Assistant] And that's the problem is, you know, they're, you know, Apple's goal is to try and review these to prevent, you know, security and privacy issues for end users without asking end users to dedicate, you know, effort to making decisions often incorrectly on their own.


[User] Please transcribe this text

[Assistant] Uhm, but the problem with this is that the process is completely opaque, so, you know, it's relying on humans to do the review. They could automate this, but a lot, in a lot of the cases, uhm, these things are really hard to detect automatically, so there's some...


[User] Please transcribe this text

[Assistant] You know, human review board, uhm, which of course, you know, is then subject to human error, uhm, and some of it is, you know, very subjective.


[User] Please transcribe this text

[Assistant] Uhm, so, you know, people probably remember the PATH fiasco, uhm, or fiascos, because this happened twice. Uhm, PATH is a popular social networking app, uhm,


[User] Please transcribe this text

[Assistant] It turns out the iOS app, uhm, two years ago, three years ago, was accessing users' address books on their iOS devices, which was against Apple's terms of service. Now obviously, if it's against the terms of service, one would think that as part of the curation process, that would have been detected. It wasn't, and the app was used by millions of users.


[User] Please transcribe this text

[Assistant] This happened again with PATH, uhm, a year or two ago. It was another thing that it was doing which should have been caught by the review process but wasn't.


[User] Please transcribe this text

[Assistant] So, there are problems with that. It's also resource intensive if you're, you know, hiring humans to be looking at millions of apps.


[User] Please transcribe this text

[Assistant] So there are other approaches, uhm, that, you know, don't involve the user being interrupted. So, uhm, trusted UI is...


[User] Please transcribe this text

[Assistant] When I say trusted UI, I mean system widgets that are drawn by the OS. So in this case, you know, maybe for some ability, the developer specifies, uh, where on the screen a system drawn widget should appear, such as a button or some sort of chooser. And then the only way of granting that ability is that through interacting with that system drawn widget.


[User] Please transcribe this text

[Assistant] In this case, you know, a malicious app can't spoof that to try and get the permission because the spoofed one doesn't actually


[User] Please transcribe this text

[Assistant] Get the data. So, you know, imagine sending SMS messages. If the only way of sending SMS on the platform is through this system drawn button, uhm, it's relying on the user clicking on that button as part of their interaction with the application. It's not, you know, interrupting them.


[User] Please transcribe this text

[Assistant] Uhm, it's part of the flow here. So, you know, you can imagine other ones maybe with, you know, for using the camera. There's a shutter button and so then the only way of taking photos is by clicking that shutter button.


[User] Please transcribe this text

[Assistant] Then it's part of the user's flow, there's no way of spoofing those buttons to capture the data anyway, and the user's not being interrupted.


[User] Please transcribe this text

[Assistant] Another advantage of using trusted UI components is then granting subsets of the data. So you can have choosers. Uhm, for instance, you know, in this picture we have maybe a calendar widget.


[User] Please transcribe this text

[Assistant] Uhm, you know, accessing photos in an application. And you know, this is nothing new. So we have this on desktop operating systems. So usually when you open a file, all those widgets are drawn by the OS. Developers don't usually implement the file open or file save widgets.


[User] Please transcribe this text

[Assistant] These have, you know, drawbacks though, so, you know.


[User] Please transcribe this text

[Assistant] What I refer to as asynchronous requests and what I mean is, uh, things that are triggered by the user's environment. So, you know, imagine, you know, you have some app for some Wi-Fi provider.


[User] Please transcribe this text

[Assistant] Uhm, then join this network, but that's no longer part of the user's flow because now they're making a decision ahead of time. And obviously to, you know, if you're having them push the button frequently until they're within range, that's no longer, you know, it's still not part of their natural flow. So this, you know, there are some limits to what trusted UI can be used for.


[User] Please transcribe this text

[Assistant] And then finally, uh, there's what I refer to as implicit access. So in some cases, maybe that the risk, the risk associated with a request is just so minimal, maybe it should just be granted without bothering the user.


[User] Please transcribe this text

[Assistant] And in this case, uhm, you know, we should have maybe some sort of attribution mechanism so that when permissions are granted automatically to minimize habituation, if something does go wrong, uh, there should be information about what app was responsible. So provenance.


[User] Please transcribe this text

[Assistant] Uhm, so in this case, you know, maybe changing the time on your device.


[User] Please transcribe this text

[Assistant] Uhm, you're not gonna wanna have like a runtime warning every time an app wants to maybe update the clock. You can think of some, you know, James Bond-esque, uh, plot that relies on changing the time on someone's phone, but that seems really unrealistic and in most cases it's pretty benign and the damage can be undone once it's identified.


[User] Please transcribe this text

[Assistant] So in this case, maybe we could just annotate, uhm, the settings panel to say what was the last application to modify that setting so that if it's, you know, if it's abused, someone knows which application is responsible, they can remove that application.


[User] Please transcribe this text

[Assistant] So looking at all these permission granting mechanisms, uhm, if our utility function is to only interrupt the user when absolutely necessary, we can sort of build a hierarchy here.


[User] Please transcribe this text

[Assistant] So uhm, you know, least utility is the install time warning, uhm, because users see these every single time and, you know, the best case would be the implicit access where users aren't being asked at all to make any decisions. And,


[User] Please transcribe this text

[Assistant] I argue that one of the big problems that we see on platforms today is that most operating systems just pick one permission granting mechanism and roll with that one for all the decisions. So, in the case of Android, it's all install time warnings. On iOS,


[User] Please transcribe this text

[Assistant] Uhm, they actually have, uh, there are five current runtime warnings, uhm, and the rest is completely opaque to the user.


[User] Please transcribe this text

[Assistant] But maybe we should choose which permission mechanism to use, uhm, based on risk or something else. Uhm, researchers, people who are, I guess,


[User] Please transcribe this text

[Assistant] Uhm, yeaah, there are, there are certainly, uh, mismatched incentives, which is a big issue. Uhm, but I think one of the things that's really overlooked is that developers are under a lot of different constraints and security is just a very small portion of that. And so frequently, you know, they just want some sort of guidance on how to implement it. And right now there's, you know,


[User] Please transcribe this text

[Assistant] You know, well, we'll just make a warning and let the user deal with that. But I think that if there's, you know, some guidance saying that this is, you know, here are the current best practices, uhm, users will be more satisfied. And also, you know, in some, to some extent the companies are sort of incentivized to do the right thing. So if, you know, one platform has a reputation for...


[User] Please transcribe this text

[Assistant] Apps, you know, abusing data, then, you know, they're gonna take a hit on that, so it's in the company's best interest to keep their users happy, uhm, and feel like, you know, they're in control of how the personal information is shared.


[User] Please transcribe this text

[Assistant] We reasoned about this, uhm, and we came up with this flowchart.


[User] Please transcribe this text

[Assistant] On how to make decisions about, uh, which permission granting mechanism to use based on risk and a few other things.


[User] Please transcribe this text

[Assistant] So, you know, the first step is this notion that we're calling revertibility. So if a device makes a change, can the device be reverted to a previously known good state? So maybe, you know, one example of that is say changing the time. You know, obviously you can change the time back, little harm is likely done.


[User] Please transcribe this text

[Assistant] In that case, grant the permission, uh, maybe have some attribution mechanisms so that, you know, users can undo it if it's abused. But, you know, maybe, uh, you know, the damage can't be undone. So then the question is severity. So,


[User] Please transcribe this text

[Assistant] You know, you could probably think of all sorts of, you know, freak occurrences where that could cause lasting damage, but for the most part, uhm, that's just an annoyance and, you know, once it stops, the harm is, you know, over.


[User] Please transcribe this text

[Assistant] In that case, yeah, implicitly grant the permission and again have the attribution mechanism. But if none of that applied, then the question is, did the user initiate the, you know, the action through their natural flow with, you know, with the app? And if so,


[User] Please transcribe this text

[Assistant] If not, you know, maybe it's something that's generated by the environment, you know, one of these asynchronous requests. Uhm, if a subset of the data can be, you know, granted or, you know, we can apply some sort of granularity to what's being requested, then, you know, you can have some sort of chooser widget from trusted UI as well. And if none of that applies, then the question is, uhm, is the permission needed


[User] Please transcribe this text

[Assistant] In the future, if so, the only way of doing that would be at install time. Uhm, so, you know, a scenario there might be you have some security software so that if your phone is ever stolen, you can go to a website and it wipes the device. Obviously, you're not gonna want to have some sort of runtime warning come up asking the person who now possesses your device if they really want to, you know, destroy the data on it. That has to be granted in the future.


[User] Please transcribe this text

[Assistant] If it can be done runtime, then, you know, have some sort of runtime warning or confi- you know, confirmation dialogue. Otherwise, you know, we're stuck doing it at install time.


[User] Please transcribe this text

[Assistant] So, going through the whole spectrum of different Android permissions, uhm, we can actually really reduce the number of user interactions here. So, you know, prior to applying this flowchart to the Android permission system, 100% of the abilities are granted at install time.


[User] Please transcribe this text

[Assistant] But using this methodology, we can reduce that to about 6% of the permissions. And in fact, a majority of them are, could just be implicitly granted and we can have some sort of attribution mechanism to tell users, you know, this happened if you're interested.


[User] Please transcribe this text

[Assistant] Of course, this is just looking at the total number of permissions and this doesn't reflect how frequently each of this, each of these permissions are exercised. Uhm, that's actually a project that, uh, we're working on this summer. We're hooking those APIs and actually logging them in the field to look at how frequently different permissions are requested on devices.


[User] Please transcribe this text

[Assistant] So, we can reduce a lot of these. Uhm, and so the next part of the talk is looking at what are these attribution mechanisms that we might want to explore.


[User] Please transcribe this text

[Assistant] So we're, we're referring to this as a begging forgiveness instead of asking for permission because we're, you know, telling people after the fact what app was responsible for a particular change.


[User] Please transcribe this text

[Assistant] So the question is, are these really necessary? Uhm.


[User] Please transcribe this text

[Assistant] Uhm, only about, only 22% of our participants understood that applications running in the background could be just as responsible for a device misbehavior as applications running in the foreground.


[User] Please transcribe this text

[Assistant] The corollary to this is the vast majority of users, uhm, simply, you know, when something misbehaves on their phone, they simply blame whichever app


[User] Please transcribe this text

[Assistant] It depends, I mean, so the scenario that we were asking about, uhm, is like data overages, for instance, uhm, they would, you know, they say, oh, well, you know, I was using this app last, so that must be responsible. Uhm, I'll get into that a little more later, but I, we didn't look at it from that perspective, uhm, when we asked about specific misbehaviors, uhm, I'm sure,


[User] Please transcribe this text

[Assistant] Yeah, no, I agree. That's not something we asked about. Uhm, yeah, yeah, I think instability is probably one issue. Uhm, we were talking about, you know,


[User] Please transcribe this text

[Assistant] Other things that could be controlled by the permission systems. Uhm, so in answering, yeaah.


[User] Please transcribe this text

[Assistant] Yeah, I think, I mean that's the, that's the point. So in, I guess before Microsoft, I guess this was...


[User] Please transcribe this text

[Assistant] Anecdotally, on the desktop, people were much more, you know, people would just blame the OS.


[User] Please transcribe this text

[Assistant] You know, if we're going to start adding new attribution mechanisms to the OS, obviously, we don't want to rely on a big, you know, user education campaign because that's really costly and really these would just be new features that appear in the OS. We want to see if users would discover these and so, uhm,


[User] Please transcribe this text

[Assistant] To explore this, we looked at new features that have appeared in Android over the time to see how quickly users become aware of these types of audit mechanisms. So uhm, right at the time that we were doing this, Android 4 had been out for about a year and it added this new feature, uh, for


[User] Please transcribe this text

[Assistant] Data usage, uhm, so in the settings panel, you can click this, it brings up a panel, it shows your, the graph of your data usage over the past month, and if you scroll down, it'll show the applications, uhm, by order of how much data they use.


[User] Please transcribe this text

[Assistant] So, you know, this is not something that they were, you know, publicizing or training users on. And so we wanted to see, given that this has been in deployment for about a year, uhm, are users aware of this and would they take advantage of it?


[User] Please transcribe this text

[Assistant] So, you know, we provided a scenario and asked how they would, you know, investigate a data overage and we had an open-ended text box, uhm, for them to describe what they would do on their device. Uhm, and then we split people based on what OS they used on their device and what we found was that almost three quarters of


[User] Please transcribe this text

[Assistant] Uhm, a lot of other people said that, you know, they'd call their provider or they would call, you know, Google or Apple, uhm, who obviously would have no idea, uhm, and those support calls are really costly. So clearly the platforms and the providers have an incentive to making this, you know, information accessible.


[User] Please transcribe this text

[Assistant] And so the conclusion from this was that a lot of users, uhm, you know, incorrectly or not expect to see, uh, this type of information in the settings panels.


[User] Please transcribe this text

[Assistant] And so that's useful for like one-time system changes where something in settings is modified. What about ongoing misbehaviors? So, you know, imagine something like, you know, vibrating the phone constantly or playing music. Uhm, where do people look for those sort of things?


[User] Please transcribe this text

[Assistant] So on Android, again, uhm, there's a notification bar, uhm, there is on iOS as well. Uhm, in this case, you know, you have this little icon that appears here and users can expand that to yield more information. So here, you know, it'll show you who the text from, you know, the text message is from and, you know,


[User] Please transcribe this text

[Assistant] Maybe what it, what it says. Uhm, and so the question is, you know, are users aware of this feature? And do they know if they can go here to yield more information? Can they, do they know to expand that?


[User] Please transcribe this text

[Assistant] So we did a laboratory experiment where we basically implemented all these attribution features. So we did one in the settings panel, uhm, and one in the notification bar, uhm, in our experimental condition to provide attribution information for misbehaviors. Uhm, and then we had a control condition which just was a stock version of Android.


[User] Please transcribe this text

[Assistant] Uhm, it was double blind, uhm, we didn't know which phone people had until after the experiment.


[User] Please transcribe this text

[Assistant] And so as I said, we had an ongoing annoyance, uhm, in this case it was vibration, so during the experiment we had one application just start randomly vibrating the phone. Those in the experimental condition would see this icon appear and if they expanded it, it would say which icon, you know, which application it is.


[User] Please transcribe this text

[Assistant] Otherwise, in the control condition, the only way of finding this information out is by going through the task list and killing each individual application until the misbehavior stops. Uhm, when the phone stops vibrating, then it was probably the last application that you killed.


[User] Please transcribe this text

[Assistant] For a one-time settings change, we modified the wallpaper. And Android actually has this, uh, you can change it in two places. You can, like, click on the background and then this widget pops up. And so we annotated that by, um, you know, adding this text here. So either by user or name of app in an application.


[User] Please transcribe this text

[Assistant] Again, only in the experimental condition. Uhm, in the control condition, there really is no way of determining what application is responsible if the wallpaper is to change. Uhm, you can look through


[User] Please transcribe this text

[Assistant] Like I showed you at the beginning, you can go through all your applications to see which ones have the ability but if you have multiple applications with this ability installed on the device, there's really no way of knowing which was ultimately responsible.


[User] Please transcribe this text

[Assistant] The goal for the study was to see, you know, given these annotations, whether participants would be able to correctly attribute the undesired behavior to a specific app.


[User] Please transcribe this text

[Assistant] Uhm, and also we designed the experiment so that they had several applications that were running in the background all with the same permissions so that any of them could have plausibly been responsible.


[User] Please transcribe this text

[Assistant] So in our protocol, uhm, so we randomized, uhm, the first two tasks and the second two tasks. I'm just showing these as an example. Uhm, so, you know, in this iteration, maybe the wallpaper one was first and then the vibration. So we had it...


[User] Please transcribe this text

[Assistant] What we're calling implicitly first, which was we, you know, we had it just happen without drawing any attention to it. And we told participants that they were there to review apps. And so we had them review uhm, three different drawing apps. Uhm, drawing apps because each of them had the ability to change the wallpaper.


[User] Please transcribe this text

[Assistant] And then we had them, uh, interact with a, uh, widget. And the reason why we had them do that is because then when they're interacting with the widget, they'd be able to see the, the desktop background so that when the wallpaper changed, uhm, they're likely to notice it. Since these phones, you know, required modifying the OS to implement all this stuff,


[User] Please transcribe this text

[Assistant] We had to use our own phones that we provided to them and so we figured that if the, you know, if it changed between tasks and they didn't see it immediately change, they might not notice it, the background changed because it's not their phone.


[User] Please transcribe this text

[Assistant] Uhm, so, you know, when we were examining that widget, uhm, we, uh, changed the background. We, uh, beavered them.


[User] Please transcribe this text

[Assistant] Uhm, and then we looked at the reviews that we had them write for each of the applications to see if they mentioned this in any of their reviews. So whether they noticed it, and then without prompting them, uhm, that we did this and that this was part of the experiment,


[User] Please transcribe this text

[Assistant] We wanted to see if they would comment on it, uhm, and if they would on their own go through and use the attribution mechanisms and find them to try and, uh, identify the cause of this mis- misbehavior.


[User] Please transcribe this text

[Assistant] Uhm, and then as part of the, you know, the fourth thing they did after those three timer apps, play with the Dice app. Uhm, the reason for that was, it was a Dice app that they had to shake so that we could be assured that it was in their hands and so they felt it when it started vibrating randomly.


[User] Please transcribe this text

[Assistant] And again, we looked at the reviews to see if they notice this on their own and use the attribution mechanisms on their own.


[User] Please transcribe this text

[Assistant] After this, we did, I guess, explicit misbehaviors. We told them, you know, you may have noticed this happen before. We're gonna cause one of the apps to change the background. You have five minutes to go through and identify which app is responsible. So we did this in case, you know, participants, you know, either didn't notice it the first time or weren't sure. And then finally we had an exit survey.


[User] Please transcribe this text

[Assistant] So what we found was, you know, for the vibration, in this case there was a notification icon that appeared and if they expanded that in the experimental condition, it would say the name of the app. And we found that, you know, participants were significantly more likely to attribute the cause of this misbehavior correctly when they had those mechanisms.


[User] Please transcribe this text

[Assistant] Uhm, and what we found was that, uh, two participants in the control condition actually did go through and kill every app until they found the one that, that stopped the vibration, which was actually a lot higher than we were expecting. We weren't expecting any people to, to know to do that, which was interesting.


[User] Please transcribe this text

[Assistant] Uhm, what was also interesting was that uhm, on all the devices we instrumented the OS so that we knew exactly where they were clicking on the screen and what widgets they were interacting with.


[User] Please transcribe this text

[Assistant] And what we found was that, you know, 90% of the people in the experimental condition did. Uhm, but so did 70% of the people in the control condition. Uhm, so they, you know, thought that looking up there might yield some information. Uhm, so that suggests that, you know, where we put it for the other participants was a really intuitive spot, just those in the control condition weren't able to find it there.


[User] Please transcribe this text

[Assistant] Wallpaper change, uhm, so again, this was statistically significant.


[User] Please transcribe this text

[Assistant] Uhm, but it was only about 34% in the experimental condition noticed it, uhm, less than 8 in the control.


[User] Please transcribe this text

[Assistant] Uhm, the difference is, you know, this is significantly lower than the random guessing because every participant saw this while they were looking at that widget. So most of them didn't randomly guess when they were wrong. They simply blamed the widget that they were using at the time that the misbehavior occurred. Yeaah.


[User] Please transcribe this text

[Assistant] Fewer people noticed it during the first task. So this was uhm, during the explicit, you know, misbehavi- when we told them, you know, an app on your phone just changed the wallpaper.


[User] Please transcribe this text

[Assistant] You know, figure out which is responsible. Most people noticed it, uhm, during the first task, they just didn't comment on it in their reviews because they weren't sure which was actually responsible. Many more people commented, uh, on the vibration task because, uh, you know, they were using one of the apps when it started. Uhm, or,


[User] Please transcribe this text

[Assistant] So anyway, uhm, you know, so this wasn't random guessing, it was just blaming the widget because that's what they were doing.


[User] Please transcribe this text

[Assistant] So uhm, you know, most people just admitted to random guessing when they got it incorrect.


[User] Please transcribe this text

[Assistant] What was interesting was that, uh, up to 20 p- 20% of the participants, uh, simply inferred abilities based on UI features. So, uh, for instance, the wallpaper change, uh,


[User] Please transcribe this text

[Assistant] So the application that was usually identified was one where participants somehow stumbled on a button for change wallpaper and so figured, oh, because there's a button for change wallpaper it must be this application because I didn't see that button in other ones. When, you know, really, you know, the features aren't


[User] Please transcribe this text

[Assistant] The feat, you know, an application's abilities don't necessarily correlate with the UI elements.


[User] Please transcribe this text

[Assistant] When we asked them to specifically identify an app, we also had them, uh, rate their confidence with, you know, confidence in getting the correct answer on a five-point Likert scale. And what we found was that, you know, those in the experimental condition, not only were they more likely to be right, but they were also a lot more confident in those decisions.


[User] Please transcribe this text

[Assistant] So even those, uh, in the control condition who managed to get it right did so with low confidence.


[User] Please transcribe this text

[Assistant] So uhm, you know, this sort of confirmed our previous findings from the survey that


[User] Please transcribe this text

[Assistant] You know, where we, you know, put these things in the OS were intuitive to most participants. Uhm, one question is, you know, in the second task when they were doing the wallpaper thing, uhm, it was, there was a significant difference, but it was only about 30% were able to correctly, uh, notice these attribution mechanisms. Should this be considered a success? I would argue that yes, because uhm, what we've seen in practice is that,


[User] Please transcribe this text

[Assistant] Usually there are a small number of savvy users who tend to explore, you know, these sort of features, uhm, and then they're the ones who end up writing app reviews. And a lot of users put, you know, a lot of weight on the app reviews. So,


[User] Please transcribe this text

[Assistant] To give a good example of this, uhm, about a year or two ago, Instagram had changed their privacy policy, uh, to say that, you know, all photos that you upload are property of Instagram and can be used for advertising purposes. So literature over the past 20 years tells us that almost no one reads privacy policies.


[User] Please transcribe this text

[Assistant] Yet, this was, you know, in the New York Times the next day, and it was because there's a small number of people who do, uhm, and when they find something that's really, you know, that really defies expectations, they disseminate that knowledge. And so, even though, you know, only about a third of participants were able to use the attribution mechanism here, uhm,


[User] Please transcribe this text

[Assistant] But, you know, if something truly bad's happening, then the few that are able to find these, uh, these mechanisms, uh, will probably disseminate that to the larger, uh, public. The public at large. So, the last part,


[User] Please transcribe this text

[Assistant] I want to talk about is, uh, when these decisions, you know, when, when the decision to confront the user with


[User] Please transcribe this text

[Assistant] Uh, you know, a permission request at, you know, runtime is, is necessary. How can we make those more informative?


[User] Please transcribe this text

[Assistant] So uhm, this is actually work that I just presented at CHI.


[User] Please transcribe this text

[Assistant] Uhm, so what we looked at here was iOS. So iOS 6, which has been out for about a year now.


[User] Please transcribe this text

[Assistant] Uhm, added runtime permission requests for five different things. So any app that requests location, contacts, photos, calendars, or Bluetooth pairing, uh, there's a runtime request like this that's shown the first time the app requests that ability.


[User] Please transcribe this text

[Assistant] Once it's allowed, then, you know, the user never sees it again for that particular app. They can go to a settings panel to revisit that decision, uhm, but the app never bothers them again.


[User] Please transcribe this text

[Assistant] What they added though, uhm, over previous runtime warnings was the ability for developers to add a sentence here to explain to users, uhm, why the data is needed. And there are actually no constraints on this. Developers can use this feature, they can opt not to use it, and they can supply whatever text they want. And so what we wanted to look at is, uhm,


[User] Please transcribe this text

[Assistant] Whether having this information actually impacts user behavior, are people more likely to grant permission requests when developers add this text here? Uhm, and does the content of it actually matter? Uhm, so given that developers have enormous freedom in terms of putting whatever text they want there, uhm, how much of a role does that have in users making the decisions about this?


[User] Please transcribe this text

[Assistant] And so the next question is then, uh, adoption. So given that this has been available for about a year, uhm, how many apps are actually using it? Uhm, and, you know, what are developers' perceptions? Why do they choose to use it? Uhm, why don't they use it? And, you know, when left to their own devices, what sort of text might they include?


[User] Please transcribe this text

[Assistant] So uhm, we did an online experiment again, where we showed people screenshots, uhm, we did.


[User] Please transcribe this text

[Assistant] Uhm, a couple different variations of this and so we had a control condition where we, uh, had a set of a dozen applications and applications that did have these strings and we just photoshopped them out. Uhm, we showed those to some people and then we showed the ones with the strings to other people and we asked whether they would approve the request.


[User] Please transcribe this text

[Assistant] And what we found was that there was a statistically significant effect by having this text there. People were actually more likely to approve the request. The effect size is relatively small, but there is an effect. We controlled for, you know, the order.


[User] Please transcribe this text

[Assistant] So looking at, uh, you know, when we did this within subjects, uhm, that didn't have any effect, uhm, and also app familiarity. Since we wanted to use apps that actually use this feature, uhm, we asked people, you know, whether they've used this app before, how much do they trust the app, and we actually found that that didn't correlate, uhm, at all.


[User] Please transcribe this text

[Assistant] I was actually going to end it on this, uhm, so there are a lot more details of the study which I could talk about, uhm, but we did a follow-up experiment where we actually did vary the information content and what we found was that there was absolutely no effect, uhm, based on the text that we included. They were in every case significantly more likely to approve it than in the control condition. So even in, you know,


[User] Please transcribe this text

[Assistant] The, the con, the, the no information case that we used was, uh, you know, the app needs access to your contacts because it needs access to your contacts. Uhm, you know, no information beyond, you know, not having that string there, uhm, yet we found, you know, a significant effect. Uhm,


[User] Please transcribe this text

[Assistant] And so, yeaah, what we found, you know, we found that this is probably the same effect as this famous study, uhm, from the 70s, where they had people asking to cut in line at the copy machine and giving all sorts of excuses. So, you know, and the control condition was, may I use the copy machine? Uh, but then they had this, uh, statement saying, you know,


[User] Please transcribe this text

[Assistant] And so, this appears to be the same effect, uhm, that, that we saw, uhm, online, which is any explanation, uh, will do when people are actually a lot more complicit when you give them something.


[User] Please transcribe this text

[Assistant] Uhm, we don't have a good explanation for why, uhm, but based on all of our results from that experiment we have, you know, some suggestions. So one is that, uhm, maybe instead of letting developers


[User] Please transcribe this text

[Assistant] There might be some consistency, uhm, and that also avoids having, you know, this placebo condition of no real added information.


[User] Please transcribe this text

[Assistant] Uhm, and so with that I will leave it there.


[User] Please transcribe this text

[Assistant] Yeah, well I think that, you know, part of this might, I think there might be some human element to this, which is given that developers, you know, write whatever they want here. Based on, so we built a corpus of over 4,000 apps, uhm,


[User] Please transcribe this text

[Assistant] It's in the Chi paper, uhm, and we're extracting these strings from real apps and looking at the variety of, you know, different explanations in there. Uhm, I, you know, obviously this probably correlates with the size of the company, but there were a lot of, you know, ones that clearly had no oversight, uhm, you know, things with typos in them, things that were just, you know,


[User] Please transcribe this text

[Assistant] We suspect we're a result of developers just not understanding the API correctly and having, you know, like code in there. Uhm, and I suspect though that because there wasn't a


[User] Please transcribe this text

[Assistant] I guess editorial, there wasn't any editorial oversight that might have created more of a human element that this is a, you know, a person who wrote this as opposed to something in, you know.


[User] Please transcribe this text

[Assistant] Succinct, I was gonna say succinct legalese, but that's, that might be an oxymoron. Uhm, something that's, you know, heavily sanitized.


[User] Please transcribe this text

[Assistant] Uhm, again, we don't have a good explanation for the effect other than there was an effect. Uhm, I think that might be part of it. I think another part of it might be simply


[User] Please transcribe this text

[Assistant] You know, habituation, so maybe by having a wide variety of different ways of saying the same thing, um, each of these dialogues looks slightly different so people may, you know, pay more attention to them and are less likely to, you know, click one button over the other. I don't know.


[User] Please transcribe this text

[Assistant] Uh, that's, yeaah, that's something I'd like to explore, uhm, at some point. Uhm, we've been talking about that, looking at, you know, what the impact is on developers and developers, you know, willingness to use trusted UI components.


[User] Please transcribe this text

[Assistant] Uhm, it's not something we've looked at yet, but I agree that that is an important point. I think that's probably a big barrier somewhat, uhm, to this.


[User] Please transcribe this text

[Assistant] In here, but uhm, we did a lot of studies looking at, you know, risks and people's, you know, actual concerns over, you know, various things that could happen using their phone data. Uhm, and we found that location is really towards the bottom of the list, uhm, which is interesting because if you look at, say, the,


[User] Please transcribe this text

[Assistant] In the case of location, um, you know, viewing like Google Maps and getting a thing about, you know.


[User] Please transcribe this text

[Assistant] Because it's being used for, you know, something other than in-app features, uhm, and so being able to disambiguate those cases, uhm, I think that's the next important step is being able to determine what users will find unexpected, uhm, just based on context, uhm, which is something that, you know, we're not doing right now.


[User] Please transcribe this text

[Assistant] You know, thing to make a donation. So a lot of malware, you know.


[User] Please transcribe this text

[Assistant] Uh, authors are using that, uhm, to incur, you know, thousands of dollars on people's phone bills, which might be, you know, under ten messages.


[User] Please transcribe this text

[Assistant] Now granted, you know, if you call up the phone company and argue that it's fraudulent, you can probably get that reversed, but...


[User] Please transcribe this text

[Assistant] I thought you meant something else which is something we have looked at. I thought you meant focus as in that's the primary use for the application. That's the focus of the application is mapping. Uhm, so one thing that we did do is, uh, we tried to train a classifier by looking at


[User] Please transcribe this text

[Assistant] Unreliable, you know, correlations uhm, between categories of apps and the permissions that are requested.


[User] Please transcribe this text

[Assistant] Uhm, but that, that's something different. Uhm, yeaah, I mean, at the same time, there are probably different, you know, reasons why you, having it requested in the background, you know, might be useful, uhm, in some cases. So for instance, you know, caching, uhm,


[User] Please transcribe this text

[Assistant] The GPS on your device is assisted because the chip by itself is pretty weak and running on just the chip, you know, sometimes can take minutes to get an accurate fix.


[User] Please transcribe this text

[Assistant] When there are runtime permissions, we then have a small sample of people that we then have a, you know, follow up to, you know, thing pops up and asks, you know,


[User] Please transcribe this text

[Assistant] Why, you know, why do you believe it was requesting this and then there's a feedback mechanism that puts the, you know, the responses from that back into maybe reviews or some sort of quantifiable thing on the app download page that other users might be able to take into account when they're, you know, looking at the application. So, you know, when you see an application and it says that, you know,


[User] Please transcribe this text

[Assistant] I think it was, uh, Heather Lipford at UNC Charlotte, uhm,


[User] Please transcribe this text

[Assistant] built this system where they were providing these annotations for, uh, Facebook apps, uhm, basically showing how many people in their, you know, friend network have installed this or, you know, approve of this app, uhm, and they found that that was actually really persuasive to people downloading apps.


[User] Please transcribe this text

[Assistant] I mean, I can just say that we definitely observed that, that a lot of developers, uhm, not a lot, but uhm,


[User] Please transcribe this text

[Assistant] When we built this corpus of apps that we were going through,


[User] Please transcribe this text

[Assistant] We found that a lot of them, uhm, have a secondary, well, I guess a primary dialogue that first comes up saying, you know, that it's just a pop-up that develop, that the developer wrote saying, you know, you're gonna, you're going to see a request for this, you know, for, you know, your contacts.


[User] Please transcribe this text

[Assistant] Now, I expect that the first part of this quote, uhm, sums up how you feel about passwords. Uhm, but do you have any idea who said it? Well, everybody said it. And if you have any idea when it was said?


[User] Please transcribe this text

[Assistant] In other words, we're likely stuck with passwords for quite a while yet to come.


[User] Please transcribe this text

[Assistant] So what's so bad about passwords? Well, as usual, XKCD explains the problem best. Passwords are hard for people to remember and easy for computers to guess. And so what do we do in a situation like that?


[User] Please transcribe this text

[Assistant] But perhaps a better solution is to use the computer in the form of a password manager.


[User] Please transcribe this text

[Assistant] It's the top recommendation, but fewer than half of people actually use one. Now, I'd like to get a count out of this group. And I was gonna set up a Zoom poll.


[User] Please transcribe this text

[Assistant] But I quit reading the instructions after page three. It was just getting too complicated.


[User] Please transcribe this text

[Assistant] And for those of you who put none in the chat, I have just one thing to say.


[User] Please transcribe this text

[Assistant] Shame on you. You really should be using a password manager.


[User] Please transcribe this text

[Assistant] And you gotta be careful because every once in a while one of them shuts down. Now, we expect certain things from a password manager.


[User] Please transcribe this text

[Assistant] Difficulty using it and lack of trust are the main reasons that people give up, uhm, using a password manager.


[User] Please transcribe this text

[Assistant] Also, some websites force you to change your password on a regular basis. I have a ramp on why that's a bad idea. But some password managers will automate that process for you. Now,


[User] Please transcribe this text

[Assistant] So it sounds like there's a consensus. A password manager stores your passwords.


[User] Please transcribe this text

[Assistant] That definition raises some questions. So for example, where does it store your passwords? On your machine?


[User] Please transcribe this text

[Assistant] Well, then how do you get your passwords when you're at a friend's house? Well, that means it probably stores it in the cloud, but whose cloud?


[User] Please transcribe this text

[Assistant] If it's them, can you trust them not to use it, not to lose it or abuse it?


[User] Please transcribe this text

[Assistant] And of course it costs them money to manage those user accounts. Some of them have more than a million users. Managing that many users costs money and they have to pay for the cloud resources. And then there's this to worry about. What if they get hacked?


[User] Please transcribe this text

[Assistant] Last December I got this notification from LastPass. Apparently someone stole their database.


[User] Please transcribe this text

[Assistant] Your protection depends solely on the strength of your master password, according to Bruce Schneier in his blog. And this is the kind of event that leads people to stop trusting their password manager. So let's think about a different approach.


[User] Please transcribe this text

[Assistant] You can carry a piece of paper with everything you need to get your passwords. And it's not great if you lose that piece of paper.


[User] Please transcribe this text

[Assistant] But it's nothing close to the problems you have if you lost that booklet with all your passwords in it.


[User] Please transcribe this text

[Assistant] People from the HP Atala division came to visit, came to see us. Atala was a security company with close ties to the finance industry that HP had recently bought.


[User] Please transcribe this text

[Assistant] So when you click on that button, you can see where the mouse is pointing.


[User] Please transcribe this text

[Assistant] Your username and password get filled into the website. And if it's a phishing site, well, your settings won't show up. And so clicking the button does nothing.


[User] Please transcribe this text

[Assistant] I believe this is probably the first application that deserves the term password manager and a lot of the features that we see today.


[User] Please transcribe this text

[Assistant] They treated one factor as your master password, and the second factor is the local database holding the nicknames and your user ID for the site.


[User] Please transcribe this text

[Assistant] So if Wells Fargo wanted to distribute it to their customers, they could pay HP $1 per account and have their logo on the button.


[User] Please transcribe this text

[Assistant] We're serious security folks, and they felt that this approach was secure.


[User] Please transcribe this text

[Assistant] And started to migrate to other browsers, mainly Firefox.


[User] Please transcribe this text

[Assistant] Because the people who developed Chrome cited our research in their academic paper when they published it on the browser. So I produced a version for Chrome, uhm, instead of a toolbar.


[User] Please transcribe this text

[Assistant] Chrome lets developers produce plugins they call extensions.


[User] Please transcribe this text

[Assistant] And you can see that this extension here really is a blatant copy of what Bing did. Now I wasn't entirely happy with it.


[User] Please transcribe this text

[Assistant] Most of the time, but when they're not, it's really annoying that they aren't synchronized across your machines.


[User] Please transcribe this text

[Assistant] Uhm, personas are what you call it when you have a Facebook account for work and one for home.


[User] Please transcribe this text

[Assistant] And you want to use different credentials for them, or you have a shared machine at home and everyone uses the same Netflix login. That would be one persona, but each person wants their own Instagram credentials. So each person would have their own persona.


[User] Please transcribe this text

[Assistant] And the big problem for me personally was that it only found the password field about half the time. And I found autofill to be the most, uh, uh, user friendly feature of the whole thing.


[User] Please transcribe this text

[Assistant] Google told developers that we'd have to update our extensions.


[User] Please transcribe this text

[Assistant] And here I am talking to you over a year later, and I only got it in the Chrome store for testing in January of this year.


[User] Please transcribe this text

[Assistant] There's no persistent background page, just a transient service worker that can stop at any time. And when it does stop, it loses its memory.


[User] Please transcribe this text

[Assistant] Uhm, and then since I was out of work, I decided to fix the things I didn't like about the earlier version.


[User] Please transcribe this text

[Assistant] And then I finally came upon my solution for those two. Let Google do the heavy lifting.


[User] Please transcribe this text

[Assistant] Uhm, there's no need for user accounts and cloud storage. The browser takes care of the synchronization forming.


[User] Please transcribe this text

[Assistant] The bookmarks also synchronize with your mobile devices, even without the extension installed.


[User] Please transcribe this text

[Assistant] Uh, you don't lose your settings if you have to reinstall the extension. I don't know if you've experienced this with other extensions, but if you uninstall them, typically you lose all your stored data and have to reconstruct it if you reinstall.


[User] Please transcribe this text

[Assistant] And finally, you can use different browsers because you can import your bookmarks to them. Uhm, I had to deal with one problem.


[User] Please transcribe this text

[Assistant] That's confusing for programs people can usually figure it out, but there is a pretty simple solution.


[User] Please transcribe this text

[Assistant] Uh, site password itself will delete one of, will, will delete the duplicates automatically if they're identical. And we'll ask the user which one to use if they're not.


[User] Please transcribe this text

[Assistant] So let me give you a little taste of password, a site password, and I can show a demo later if time permits.


[User] Please transcribe this text

[Assistant] You'll see something like this page, and the password field says click site password. So you click on the site password icon, that little thing that looks like a calculator, uhm, and you see this form that you fill in.


[User] Please transcribe this text

[Assistant] Now, remember a piece of paper I mentioned?


[User] Please transcribe this text

[Assistant] And it creates a file with a nicely formatted table of your settings for each site. You can print it out and carry it in your pocket.


[User] Please transcribe this text

[Assistant] And it will now remember your settings so you won't see this warning again for that domain. And if you're at a friend's house, well, there's a webpage for that.


[User] Please transcribe this text

[Assistant] So it's basically the same form, and if you have access to your bookmarks, you can just paste in the bookmark to get all your settings.


[User] Please transcribe this text

[Assistant] Now, site password has extensive instructions, and my hope is that no one will ever read them. And I'll talk about that when I talk about usability.


[User] Please transcribe this text

[Assistant] Uhm, there may be times when you have to provide your own password. Uhm, maybe you can't satisfy the password rules.


[User] Please transcribe this text

[Assistant] Uh, that's never happened in my 10 years of use and testing on over 300 sites, but there's a website called dumbpasswordrules.com and there are actually four


[User] Please transcribe this text

[Assistant] A site password will store this password for you in the bookmark.


[User] Please transcribe this text

[Assistant] Its primary function is to calculate passwords, but you can also use it to store them when you have to.


[User] Please transcribe this text

[Assistant] Usability isn't quite the right thing. We're interested in usable security.


[User] Please transcribe this text

[Assistant] Now many of these don't apply to site password, but several of them do. Uhm, make the easy way the secure way.


[User] Please transcribe this text

[Assistant] Once you set up a site, it's actually easier to log in with site password than it is to type even a simple password that you use everywhere. So we got that one covered. Uhm, explicit authorization.


[User] Please transcribe this text

[Assistant] And for expressiveness, here it's, it's the password rules. Uh, password rules at sites can get pretty funky.


[User] Please transcribe this text

[Assistant] I also believe that a help button is a crutch for developers. I've actually heard more than one say, oh, we'll just explain that in the help rather than trying to figure out how to make it obvious what to do. You also want to encourage good practices.


[User] Please transcribe this text

[Assistant] I didn't follow that advice and, uh, it took me three tries to log into Netflix on my new Smart TV because I got confused between lowercase L and uppercase I. And so I was careful about that this time.


[User] Please transcribe this text

[Assistant] And it seems then they'll just follow the moving cursor and go to the correct place. And then there's a pet peeve of mine.


[User] Please transcribe this text

[Assistant] And when you look at the field, there's nothing there because the field wasn't focused for you. I absolutely hate that. So I try to do better than that.


[User] Please transcribe this text

[Assistant] Uh, I haven't been completely successful. There's still some things I'm not happy with.


[User] Please transcribe this text

[Assistant] That placeholder, click here for password, uhm, doesn't show up all the time. There are a few pages where I simply can't figure out why it's not showing. I spent the better part of a week at one website, and I never did figure out why it didn't. I resorted to a tool tip, but how do you make it obvious to the user?


[User] Please transcribe this text

[Assistant] Hold your mouse over the password field for a second or two. That's how long it takes for the tooltip to show up.


[User] Please transcribe this text

[Assistant] You have to click twice to get your password. Once to close the pop-up and once to insert the password. Yuck. If I close the pop-up when you mouse out, it's too easy to do that accidentally. Double yuck. So instead what I do.


[User] Please transcribe this text

[Assistant] Put your password on the clipboard where any other application running on your machine can read it.


[User] Please transcribe this text

[Assistant] The big problem is that the articles on this I read say that they're not as secure as the stand-alone password managers. Except for the fact that any password manager, uhm, you know,


[User] Please transcribe this text

[Assistant] By making it too easy to just keep using weaker reuse passwords.


[User] Please transcribe this text

[Assistant] Now I wanted to get some experience with this. I never used those. So uhm, I set up the Chrome


[User] Please transcribe this text

[Assistant] Browser, a couple of sites with the Chrome browser. And uhm,


[User] Please transcribe this text

[Assistant] I like to say there are four things a password net should, password manager should never do and Chrome does four and a half of them. Uhm, the first thing it does that isn't good


[User] Please transcribe this text

[Assistant] It could be an FAQ or a contact us page, a page that nobody thinks has any security implications. There's even an attack


[User] Please transcribe this text

[Assistant] There is a way that the browser can block these attacks that isn't available to extensions, but I verified that the Chrome browser doesn't do it.


[User] Please transcribe this text

[Assistant] About the funky password rules that my power company cited simply did not generate a legal password for that site.


[User] Please transcribe this text

[Assistant] The browser will warn you if you've created weak passwords, but only after you explicitly check. It doesn't tell you at the time you put them in to be managed.


[User] Please transcribe this text

[Assistant] It also assumes that any element of my password holds a password. Now many sites don't do that. They have other things they don't want shown on the screen.


[User] Please transcribe this text

[Assistant] Only way to replace it with dots is to put a, uh,


[User] Please transcribe this text

[Assistant] Make the TLS certificate available to extensions so I can't test it myself in my extension.


[User] Please transcribe this text

[Assistant] So people will know if they've got a strong master password. I don't enforce that, but I'll let you know if it's weak.


[User] Please transcribe this text

[Assistant] And I failed. Uhm, there is a very nice piece of code. It's very highly upvoted on Stack Overflow.


[User] Please transcribe this text

[Assistant] And it tells you that you should use the same password for mail.google.com and maps.google.com. That's good.


[User] Please transcribe this text

[Assistant] Unfortunately, it also says you should use that same password for google.evil.com, which is probably not a good idea. Uhm, accessibility features are interesting.


[User] Please transcribe this text

[Assistant] Of course, that means I only produced about 10 lines of code per workday, and I don't know how happy you'd be if I was part of your team when you were in a rush.


[User] Please transcribe this text

[Assistant] I also think it's a big problem when login pages rely on jQuery.


[User] Please transcribe this text

[Assistant] Worst of all is a password manager that doesn't convey trust, that doesn't give you the warm fuzzies I mentioned, because then you'll give up using password managers, and that's the worst of all. So how does a site password do on the security?


[User] Please transcribe this text

[Assistant] Get your New York Times password, just because it was on the same page as NYTimes.com.


[User] Please transcribe this text

[Assistant] But that tool is so good that I'm using it even though the distribution is now just over a megabyte.


[User] Please transcribe this text

[Assistant] You know, that might work for a site password because the site itself doesn't add what's called salt. But your master password is safe from that.


[User] Please transcribe this text

[Assistant] And of course I mentioned it's not, not a good idea to leave a password on the clipboard any longer than necessary.


[User] Please transcribe this text

[Assistant] Bookmarks are very well protected from code running on web pages, but not from now or on your machine. They're just stored in a file on your machine.


[User] Please transcribe this text

[Assistant] But if Google gets hacked, well life as we know it ends. So I'm not going to worry about that.


[User] Please transcribe this text

[Assistant] I chose to make the site password visible by default. Watching it change as you type.


[User] Please transcribe this text

[Assistant] And I originally 12, chose a 12 character site password because back when the first time I did this, too many sites, uh, wouldn't take longer ones.


[User] Please transcribe this text

[Assistant] That's about all an attacker who gets just your bookmarks can do. They know where you log in and what your user ID is, but no clue about your site or master passwords.


[User] Please transcribe this text

[Assistant] Offline attacks are more serious. So if the attacker steals a password database, which stores the hashes of users' passwords and starts guessing, that can be fast and undetectable.


[User] Please transcribe this text

[Assistant] And that attack is still there with site password, but it works differently. Say that you create an account at a rogue site.


[User] Please transcribe this text

[Assistant] The bad guy now knows your user ID and site password and can probably guess your nickname for the site. And now he starts guessing master passwords. Now you can't eliminate that threat with site password.


[User] Please transcribe this text

[Assistant] But you can mitigate it with a strong master password. According to that Dropbox tool,


[User] Please transcribe this text

[Assistant] That means at a million guesses per second, it would take almost a year to guess even a 12 character master password. But then there's a mitigation that's not available.


[User] Please transcribe this text

[Assistant] Now one of the things I missed from not going to the office is hearing other people's war stories. The crazy stuff they ran into and how they dealt with it. Uhm, I hope you enjoy mine.


[User] Please transcribe this text

[Assistant] Uhm, as I said, it took me six months to find the password fields on all of my test sites.


[User] Please transcribe this text

[Assistant] And that was the most common reason the earlier version didn't find the password field. Fixing that got me from 50 or so of my test sites to over 80.


[User] Please transcribe this text

[Assistant] I don't know if they still do, I forgot to check for this talk.


[User] Please transcribe this text

[Assistant] There are sites, two of my test sites, actually add CSS at runtime that takes an invisible password field and makes it visible. And that too doesn't count as a mutation, so I had to write more special code.


[User] Please transcribe this text

[Assistant] More crazy stuff. Uh, one site actually changes the look of the login form depending on the URL you use to get there. And that required even more special code.


[User] Please transcribe this text

[Assistant] Except I've been told by someone who knows that the design is so flawed that it's not particularly useful. But it'd require more special code. And then there's the bank.


[User] Please transcribe this text

[Assistant] That clears the username and password field two seconds after I fill them in. Not if I type them in, but if they're auto filled by site password. I have no idea what that's for. And I couldn't even figure out where in their code they were doing it.


[User] Please transcribe this text

[Assistant] Loaded up the website, sitepassword.info for testing, and the password field said click site password, which I found annoying, so I had a special case for that URL.


[User] Please transcribe this text

[Assistant] When it doesn't, you have to go look at something called the offset apparent.


[User] Please transcribe this text

[Assistant] Was on the documentation page, but I only saw it when I accidentally scrolled the page. It was just off the piece of code that I was looking at. That was two days down the drain out of six months.


[User] Please transcribe this text

[Assistant] Uhm, at least one other password manager gets it right. And my understanding is they actually have a special case just for that one website. I just can't bring myself to do that. Uhm, and then there's the really crazy stuff.


[User] Please transcribe this text

[Assistant] Uhm, each one of those is going to show up as a phishing warning the first time you encounter a new one, because I can't be sure that it's really bankone.com is the right, is the actual site.


[User] Please transcribe this text

[Assistant] Uhm, my health insurance company is training me to be fished.


[User] Please transcribe this text

[Assistant] That any element can be given an ID. That's how you say, I want to associate this piece of code when you click that, that element.


[User] Please transcribe this text

[Assistant] I went back to show someone this problem, but they've changed how they do the login, so that's no longer a problem. But I still have to have code in my distribution to deal with that case. So how bad is all of this craziness?


[User] Please transcribe this text

[Assistant] A future work, I'd love to do user studies, but that's really hard for someone working alone. Uhm, so I'm asking for your help. If you're willing, try it out and give me your feedback.


[User] Please transcribe this text

[Assistant] Site password now works on all the major browsers. Safari, Firefox, and most Chromium browsers. You know, Brave, Edge, Opera. Uhm, but I need to do a lot more testing on them.


[User] Please transcribe this text

[Assistant] And I'm keeping my eye on mobile but I won't be building a site password app until those security issues I talked about get fixed.


[User] Please transcribe this text

[Assistant] Here's where I got most of my information. Don't bother copying them down. You can get them from that GitHub site.


[User] Please transcribe this text

[Assistant] The Osch thesis is absolutely amazingly comprehensive and the paper provides a good summary.


[User] Please transcribe this text

[Assistant] So takeaways? Use a password manager. Can't stress that enough. My son uses the one built into Chrome. And in spite of all the problems I pointed out, I haven't told him not to use it out of fear he won't use a password manager at all. Some autofill without user action.


[User] Please transcribe this text

[Assistant] Uhm, be ready in case they raise their prices too much or you will go out of business.


[User] Please transcribe this text

[Assistant] That's the problem. Uhm, Mark Stigler,


[User] Please transcribe this text

[Assistant] The problem there is you can't log in from a friend's house if you don't have your bookmarks. So uhm.


[User] Please transcribe this text

[Assistant] Who decided that they wouldn't be using passwords for very long anyway, so it wasn't worth the effort.


[User] Please transcribe this text

[Assistant] Well, you know, a lot of it comes down to usability. You know, there's the gag about why is mommy crying and the answer is two factor authentication.


[User] Please transcribe this text

[Assistant] Who have more interesting things to do than worry about computer security.


[User] Please transcribe this text

[Assistant] You know, if it's the kind of code where, you know, the webpage says we just texted you a code, type it into this webpage, that's pretty easy for a man in the middle to defeat.


[User] Please transcribe this text

[Assistant] The ones that use a backchannel, where they put up a QR code on the page, you scan it with the phone, and the phone contacts the server by a different channel. Those are much harder for attackers to get into.


[User] Please transcribe this text

[Assistant] But you know what, you have to make assumptions about what physical devices people have. I mean, the, uh, the Fido keys, the Ubi keys, that's a wonderful second factor. I use mine a lot.


[User] Please transcribe this text

[Assistant] The coefficients on dummy variables or something which we call dummy variables in econometrics. So first of all, what do we mean by a dummy variable?


[User] Please transcribe this text

[Assistant] Whether an individual's gender affects some dependent variable, we might create a variable which we call sex, which is equal to 1 if an individual is a female, let's say, and it takes on a value of 0 if they are a male.


[User] Please transcribe this text

[Assistant] And we might be interested in finding out whether there was any sort of bias in wage rates.


[User] Please transcribe this text

[Assistant] But what does the coefficient on our dummy variable represent in this case? Because we talked about what the coefficients mean on our sort of normal continuous variables. They represent the sort of marginal effect of that variable if we held all our variables constant. So what's the interpretation of a


[User] Please transcribe this text

[Assistant] If an individual is, let's say, female, and it takes on a value of zero otherwise.


[User] Please transcribe this text

[Assistant] So the idea here is that if I take my sort of average wage rate for females, and I take away the average wage rate for males,


[User] Please transcribe this text

[Assistant] Then all these sort of other variables which are being held constant are going to cancel, so I'm just going to be left with beta p.


[User] Please transcribe this text

[Assistant] And normally in econometrics, we think about this wage premium as actually probably being negative. Or in other words, we expect males to command some sort of wage premium over females. That's just sort of an empirical fact that's sort of been proved in a number of studies. There is still some sort of gender bias in the workforce.


[User] Please transcribe this text

[Assistant] But by introducing this particular concept in this particular terms here, I'm not meaning to open up a discussion. Merely what I wanted to do is to demonstrate what the coefficient or what the interpretation is of a coefficient on a dummy variable. Okay, so let's think about another


[User] Please transcribe this text

[Assistant] So, what does Beta P represent in this particular case? Well, the idea here is that Beta P represents the increased number of wars which a country which had had a civil war in the last 10 years, let's say,


[User] Please transcribe this text

[Assistant] In the next video we're going to talk about what it means when we interact our dummy variables with continuous variables. I'll see you then.


[User] Please transcribe this text

[Assistant] Yeah, I guess so. That's like a, uh, that's an interesting die, too, that she has.


[User] Please transcribe this text

[Assistant] But it's good that you thought that out. Yeaah. So intently.


[User] Please transcribe this text

[Assistant] Okay, so one of the first things that you do is when, once you buy your land, you put and identify a marker on the land that shows that the land has been purchased and that you own it. This is all a pre-day overlook in the valley.


[User] Please transcribe this text

[Assistant] And so my guess is that very soon there'll be so many more returnees that will be living here. We are standing on a land that I own.


[User] Please transcribe this text

[Assistant] Which I will be joined very shortly by at least 13 to 15 other


[User] Please transcribe this text

[Assistant] Uhm, sustainable. By sustainable, I mean we do everything on the land. We, uhm, we use the land for shelter. We use the land for food. As you look around now, you can see that there's corn growing in abundance.


[User] Please transcribe this text

[Assistant] But we are also in the process right now of determining what other trees and what other foods and what other medicines that we're going to plant on our land.


[User] Please transcribe this text

[Assistant] Hello everyone and welcome to Sorted Food. Today we're gonna be taste testing and talking about a bunch of interesting topics in the world of food.


[User] Please transcribe this text

[Assistant] I know what you mean by a teeth thing. But it's essentially whey protein that's bound together with oil, sweetened with natural sweeteners and natural flavourings, and then extruded. So, ultra-processed, but not with the things you'd associate typical child-like cereals to have, i.e. the sugar and the carbs.


[User] Please transcribe this text

[Assistant] In the sense that it reminds me of freeze-dried strawberries. It tastes nice. It's very sweet. It's quite creamy.


[User] Please transcribe this text

[Assistant] But I feel like there's also an awful lot going on in there, probably to keep it as it is.


[User] Please transcribe this text

[Assistant] Which is far from you. Apply to a treat so that I guess when you're in space you don't feel like you're missing out. How does the freeze drying process work? So you freeze it to very low temperatures.


[User] Please transcribe this text

[Assistant] And then you put it under pressure to get rid of the water through sublimation. Okay.


[User] Please transcribe this text

[Assistant] But the only thing being removed is water. Would you have that as a snack? I don't think I'd want to eat a whole one of those. Maybe there's a place for it. But I think more it's for like the novelty of like museums and stuff like that and getting kids to fall in love with the idea of space, which is cool as a kid.


[User] Please transcribe this text

[Assistant] Given how expensive the process is, its association to the space program, like astronaut food, its novelty, its cool, I think you could pay a fiver for that.


[User] Please transcribe this text

[Assistant] It's not something I would ever buy for myself but I think it would be a fun thing for kids.


[User] Please transcribe this text

[Assistant] Two closhers. You've got two choices for breakfast. Which would you like? No more context than that. Peanut butter on toast for me all day long.


[User] Please transcribe this text

[Assistant] Every day we all make dozens of decisions around food based on mood and place and price and taste and all those things.


[User] Please transcribe this text

[Assistant] But, there's some elements we can't necessarily track. What this product does is look at nutrition, a level of processing, and its impact on the environment as ingredients. The product is a website and or an app.


[User] Please transcribe this text

[Assistant] So Nova is a level of processing.


[User] Please transcribe this text

[Assistant] So raw ingredients, like a banana, that has had no element of processing, it's a scratch ingredient, is NOVA 1. In theory, that's better.


[User] Please transcribe this text

[Assistant] So this is a non-for-profit NGO. It launched about 10 years ago, but this year they've added the eco score because we're all more conscious about the impact that we're having on the environment and basically it taps into information that's already available, but it is completely set


[User] Please transcribe this text

[Assistant] But now you've got the app. You can start to scan other products that haven't yet been uploaded. It puts all that information from the label through their calculations. You can actually help to add to the database too.


[User] Please transcribe this text

[Assistant] From my understanding, I think it's a bit like Wikipedia. 15 years ago at university we were told not to trust it because it's a bit sketchy.


[User] Please transcribe this text

[Assistant] This is open source, there's still stuff adding to it, but it goes through such independent...


[User] Please transcribe this text

[Assistant] It is completely free, as long as you've got a smartphone to download the app, or you can access it on desktop as well. So it's free, no price, but there is one question of course.


[User] Please transcribe this text

[Assistant] Or simply not a fan. Oh, I'm definitely up for giving


[User] Please transcribe this text

[Assistant] Yes, so they are removing more carbon dioxide from the atmosphere than their own carbon footprint as a business.


[User] Please transcribe this text

[Assistant] That's what interested me, because I thought, wow, a carbon negative dairy ice cream, they make one with clotted cream as well, vanilla, it's delicious. There are ways of putting livestock into rotations that mean they sequest carbon and that that is possible in crop rotations. That's not what they're doing here.


[User] Please transcribe this text

[Assistant] That ice cream might not on its own be carbon negative, but as a brand, all the things they do is.


[User] Please transcribe this text

[Assistant] And that's what these external audits kind of do, is they take all of that into account. So, they've recently changed their entire ice cream factory to renewable energy.


[User] Please transcribe this text

[Assistant] They do clever things in water recycling, so the heat that comes off of the ice cream as it cools, they use to heat the next batch of cold milk. So they're doing very clever things to reduce their impact. They're also working on indirect stuff, so they're working with farmers to help them reduce the impact, because the dairy or the oats and whatever else they're using,


[User] Please transcribe this text

[Assistant] Because as a planet, we need to get to carbon net zero, and these guys are negative.


[User] Please transcribe this text

[Assistant] They do admit that dairy is still the most costly in terms of carbon ingredient they use, which is why they're introducing more and more


[User] Please transcribe this text

[Assistant] Of course. There was a pretty girl there who lost her head over me. Eight years ago. Oh, of course.


[User] Please transcribe this text

[Assistant] Have you proposed? Or does one propose in these modern times?


[User] Please transcribe this text

[Assistant] Both of you. Close your eyes and take my arm. The face of war is ugly. And not for the young.


[User] Please transcribe this text

[Assistant] People go forward, they fight for themselves and make things better for themselves. More food, a good bed, jokes to make and time to laugh. Then the filthy come and try to stop it. They want to take away from people all the good they've made for themselves.


[User] Please transcribe this text

[Assistant] Well, then you take your gun and you fight until you've killed all such.


[User] Please transcribe this text

[Assistant] What's the matter with you? Why shouldn't we sing? Because I've been hearing something. You've been hearing your own head. A witch. I hear it. I've been hearing it for a


[User] Please transcribe this text

[Assistant] He's not a man of science. He's not a man who kills. And therefore no danger to us.


[User] Please transcribe this text

[Assistant] I have heard about men like you, the civilized men, who are sorry. This, this kind is nothing. They will go when their bosses go.


[User] Please transcribe this text

[Assistant] You see, Dr. Bonhardin, you were wrong about many things. I am a man who kills.


[User] Please transcribe this text

[Assistant] We all have big dreams in our life. Many of us also know how to achieve it, but fail to work hard and achieve our dreams.


[User] Please transcribe this text

[Assistant] Have you ever noticed that we always have enough time to watch our favorite movie, or play our favorite sport, or go out to our favorite restaurant?


[User] Please transcribe this text

[Assistant] But not have enough time to clean our house or complete our office work or learn a new skill.


[User] Please transcribe this text

[Assistant] Personal growth is impossible without plenty of productive work from our side. Personal growth is impossible without plenty of productive work from our side. And one of the biggest challenges of being productive is laziness. Laziness is natural in normal human beings love to sit lazy unless they are forced by our circumstances to do otherwise.


[User] Please transcribe this text

[Assistant] Is it possible to be lazy and start working for our own goals? Is it possible to be energetic all the time?


[User] Please transcribe this text

[Assistant] In this video, you will get 10 powerful tips to overcome laziness. Number 1 is physical activity.


[User] Please transcribe this text

[Assistant] Find at least 30 minutes for exercise every day. It will improve our blood circulation and will keep us active and energetic all day.


[User] Please transcribe this text

[Assistant] Simple low intensity exercises could cut fatigue by half and increase energy by at least 20%. Walking is the simplest way to increase your energy levels.


[User] Please transcribe this text

[Assistant] We spend so much of our time on unproductive tasks that we often get very less sleep. This will again leave you lazy next day. Sleep at least 6 to 8 hours every day. It will make us more energetic, active and productive.


[User] Please transcribe this text

[Assistant] Number four. Aim to minimize inactive time. Observe yourself every day and keep a mental record of your inactive time. Try your level best to minimize it. Limit watching TV and browsing internet unnecessarily. You could decide not to watch a movie on TV, which you could have already watched before.


[User] Please transcribe this text

[Assistant] Number 5. Keep a schedule. Writing is very boring, but it is very effective. Write down all of the tasks which you need to do and mark it as done when each task is finished. It will remind us how unproductive we are and we could measure our improvement using it. Number 6. Take one bite at a time.


[User] Please transcribe this text

[Assistant] Break down the tasks into manageable chunks. Take one chunk at a time and complete it. Huge tasks will create a mental block even before we start working on it. Each completed small task will motivate us to work on the next.


[User] Please transcribe this text

[Assistant] Number seven, reward yourself. Most often our dreams are so huge that we will get the results only after a long time.


[User] Please transcribe this text

[Assistant] Till then we could reward ourselves for completing each stage or milestone. The reward could be your favorite meal, or a movie, or a dress.


[User] Please transcribe this text

[Assistant] Number nine, challenge yourself. Continuous improvement is the key to success, and we should challenge ourselves every day.


[User] Please transcribe this text

[Assistant] Though we should learn from others, do not compare yourself with others since our objective is not to achieve something which is already achieved by others, but to set new benchmarks.


[User] Please transcribe this text

[Assistant] If we are doing the same job which we do not like, we should seriously think about finding and living our passion. If you found this video helpful, then please like this video and subscribe to our channel, and press the notification bell to get future video notifications.


[User] Please transcribe this text

[Assistant] Try to see like what she was up to, man. Dude.


[User] Please transcribe this text

[Assistant] I just wanted to make sure that she was qualified to be president.


[User] Please transcribe this text

[Assistant] I just wanted to make sure Hillary wasn't like dangerous or something.


[User] Please transcribe this text

[Assistant] Number one, can we help like babies in Russia? Cause it's like adoption, serious issue for especially my dad.


[User] Please transcribe this text

[Assistant] Nah, it was about both, dude. It was about adopting, adopting information about whether or not you was qualified. Wow, you guys aren't even Jew funny. Miller's got more humor in his left pinky and you have your whole body. And I would call it to the show if I wasn't testified before the Intelligence Committee.


[User] Please transcribe this text

[Assistant] Yeaah, I'm saying that I IM'd you so they don't know what you're responding to.


[User] Please transcribe this text

[Assistant] Yeah, yeah, I don't necessarily disagree with you, I was just thinking you should spell that out and not leave that hanging. Oh, well I thought that was quite obvious.


[User] Please transcribe this text

[Assistant] Not for a lot of people. I mean I don't think, I don't think you, you know, necessarily recognize the sort of level that


[User] Please transcribe this text

[Assistant] The general point that she just can't. Well what was the other point that you made the other day, which is like if you've tried to get through hard choices, like the world did not need another. Yeah, no, that's not a good book.


[User] Please transcribe this text

[Assistant] Can you read this in the Miller voice? Maybe? Might be funny.


[User] Please transcribe this text

[Assistant] You're like Roberto Benini's cousin in the deleted scene in Life is Beautiful in the DVD commentary. Bop bop bop. Except that's a 90s reference, that's too recent.


[User] Please transcribe this text

[Assistant] You know what, I think Andy, the impression that you do that I think is very legit is uh, is Bill Maher. I really like your Bill Maher impression.


[User] Please transcribe this text

[Assistant] But it's pretty wrong. I had no idea. I thought they had a little, a little nice little Japanese huts built for them by FDR, and they did a couple of weeks, and then it was like, okay, you're not a spy, here's a pad on the back, go back to your rice shop. But three years, Billy, not so good by friends and historians, see?


[User] Please transcribe this text

[Assistant] Tickets available at spinstopsunit.org forward slash bookings.


[User] Please transcribe this text

[Assistant] Well, evacuation in a certain sense, we're all evacuating in slow motion towards the inevitability of death, see? Anyways, if Tampa's still standing...


[User] Please transcribe this text

[Assistant] And that's a statue joke right there, which I won't even spell out.


[User] Please transcribe this text

[Assistant] It's like Star Trek episode 3 in season 4 when Kirk goes and meets the Green People.


[User] Please transcribe this text

[Assistant] I have to say, Miller is extremely attentive, uh, to being implicated in any kind of lawsuit. Yeaah. He, I mean, did you notice the way he perked up there? He sounds like he was on Ambien the whole interview and all of a sudden the guy's like, aah, it's not gonna do good, it's a gas station, it's a hurricane zone, it's because of the liberals. Well, uh, well, uh, you're gonna have to determine. Make your own call, make your own call.


[User] Please transcribe this text

[Assistant] That's something you're gonna have to refer to my attorney for. Anyways.


[User] Please transcribe this text

[Assistant] Welcome to the League of Nations. That was when we tried to have international law before black people could vote. Keep making.


[User] Please transcribe this text

[Assistant] Made a lot more sense. But then Gandhi was going up and down. Do you remember Ben Kingsley and Gandhi? And he's yelling at his wife?


[User] Please transcribe this text

[Assistant] Sounds like a meeting of a Swedish town hall in 1820. Did you know they had those? A friend of mine is quite the scholar, he told me about that in Greece. Can I have another drink?


[User] Please transcribe this text

[Assistant] Yeah, of course he did, but I think he was saying it. I feel like Dennis Miller is not in any way, and he never would develop a conscience or good politics, but his, his sort of just basic grouchiness is starting to infect his conservatism crowd as well. Like he's just getting sick of everybody.


[User] Please transcribe this text

[Assistant] I save all my statue jokes from below. Sorry, ya prick.


[User] Please transcribe this text

[Assistant] I don't consume media at all, because ever since Obama stopped being president, now people are being mean to Trump, so we're not all getting along in peace and love anymore.


[User] Please transcribe this text

[Assistant] Like when I called Obama a socialist narcissist, I was trying to bring us together, but now it's hopeless.


[User] Please transcribe this text

[Assistant] I was blessed enough to take a middling talent and out of date cultural references with pseudo-intellectualism and turn it into a multi-million dollar career. Now I'm going to go to Italy. So I appreciate life.


[User] Please transcribe this text

[Assistant] I used to make Star Trek references and say we should invade Iraq and then look up Roman names of Roman senators in a dictionary and these idiots bought into it to the tunes of millions of dollars. And now I get to go to Greece and find out that the internment actually not so good.


[User] Please transcribe this text

[Assistant] I'm just sitting in a chair like Michael Corleone, except that's a better reference than I usually provide, and I have no excuse because I'd be too fucking lazy to have my brother killed.


[User] Please transcribe this text

[Assistant] Yeah, because of all of the 18 year olds doing anthropology at Brown who were offended because they listened to AM Talk Radio. What is he talking about?


[User] Please transcribe this text

[Assistant] Can I tell you something? Somebody tweeted a meme once and it's a picture of like Ryan Gosling in a really nice looking suit and it says beta cuck phase and then in the middle there's a picture of Sertovich looking bloated and it's like


[User] Please transcribe this text

[Assistant] Beginning of alpha malehood beginning and then there's a later picture of Sertovich looking extremely bloated. It says alpha malehood achieve.


[User] Please transcribe this text

[Assistant] You know, we go to that, I agree with you, but we go to that well a lot. I have to be honest, I really think that I have been involved in some of those conversations that made a little bit more sense than he just made.


[User] Please transcribe this text

[Assistant] No, of course not. It's too much. No more. Hello?


[User] Please transcribe this text

[Assistant] Well everybody has great ideas for a really good way to like set yourself up at a new job. Just like go in and immediately make demands of your new colleagues that are rude. Hit people, insult their content, tell them to stop doing different pictures. Guys!


[User] Please transcribe this text

[Assistant] Florida live with Damon Dury, weekdays three to six on AMA 20, your conversation station.


[User] Please transcribe this text

[Assistant] Shifting Time, San Jose is an interactive video installation that juxtaposes the past and present using the viewer's body as the interface to navigate between different times.


[User] Please transcribe this text

[Assistant] In this piece, commissioned by the city of San Jose for a new terminal of the San Jose International Airport,


[User] Please transcribe this text

[Assistant] Viewers first encounter a projected still image.


[User] Please transcribe this text

[Assistant] As they walk closer to the projection wall, the surface disrupts, revealing deeper moments of time in the pre-recorded video clips.


[User] Please transcribe this text

[Assistant] Viewers are able to shift between past and present by moving towards and away from the projection wall.


[User] Please transcribe this text

[Assistant] Shifting Time, San Jose, continues Utterback's Liquid Time series, which uses her custom software to deconstruct the video frame as the unit of playback.


[User] Please transcribe this text

[Assistant] This strategy of fragmentation allows multiple moments to appear simultaneously and speaks to the possibilities of digital tools as well as the fluidity of our personal memories.


[User] Please transcribe this text

[Assistant] Unlike the previous liquid timepieces, Shifting Time, San Jose.


[User] Please transcribe this text

[Assistant] Extends the period of time depicted from seconds to decades.


[User] Please transcribe this text

[Assistant] In this work, high definition video footage from the present blends with archival film footage from the 1920s through the 1960s.


[User] Please transcribe this text

[Assistant] Each of the 20 scenes in Shifting Time San Jose pairs footage of a historic site or activity in the San Jose area with complimentary contemporary footage.


[User] Please transcribe this text

[Assistant] Other scenes show people working at industries long gone, paired with employees in the current high-tech sector.


[User] Please transcribe this text

[Assistant] Leisure and travel scenes from past eras are paired with their contemporary counterparts.