This paper proposes and experimentally validates a novel WiFi-based radar model for indoor WiFi sensing, which enables accurate measurement of the radial velocity of objects. A human respiratory monitoring system based on the proposed WiFi radar model is developed. The respiratory monitoring system also leverages principal component analysis (PCA) on the MIMO WiFi channel state information ratio (CSIR) information to extract the components related to human activities. Doppler frequency of respiratory motion is obtained from time-frequency analysis of the CSIR through short-time Fourier transform (STFT). Experimental results show that the WiFi-based radar model achieves high accuracy in velocity measurement with an average error of less than 1.5% and can be used to real-time monitor the respiration rate.

Secure messaging tools are an integral part of modern society. While there is a significant body of secure messaging research generally, there is a lack of information regarding users’ security and privacy perceptions and requirements for secure group chat. To address this gap, we conducted a survey of 996 respondents in the US and UK. The results of our study show that group chat presents important security and privacy challenges, some of which are not present in one-to-one chat. For example, users need to be able to manage and monitor group membership, establish trust for new group members, and filter content that they share in different chat contexts. Similarly, we find that the sheer volume of notifications that occur in group chat makes it extremely likely that users ignore important security or privacy notifications. We also find that respondents lack mechanisms for determining which tools are secure and instead rely on non-technical strategies for protecting their privacy—for example, self-filtering what they post and carefully tracking group membership. Based on these findings, we provide recommendations on how to improve the security and usability of secure group chat.

The privacy guaranteed by secure messaging applications relies on users completing an authentication ceremony to verify they are using the proper encryption keys. We examine the feasibility of social authentication, which partially automates the ceremony using social media accounts. We implemented social authentication in Signal and conducted a within-subject user study with 42 participants to compare this with existing methods. To generalize our results, we conducted a Mechanical Turk survey involving 421 respondents. Our results show that users found social authentication to be convenient and fast. They particularly liked verifying keys asynchronously, and viewing social media profiles naturally coincided with how participants thought of verification. However, some participants reacted negatively to integrating social media with Signal, primarily because they distrust social media services. Overall, automating the authentication ceremony and distributing trust with additional service providers is promising, but this infrastructure needs to be more trusted than social media companies.

Secure email is increasingly being touted as usable by novice users, with a push for adoption based on recent concerns about government surveillance. To determine whether secure email is ready for grassroots adoption, we employ a laboratory user study that recruits pairs of novice users to install and use several of the latest systems to exchange secure messages. We present both quantitative and qualitative results from 28 pairs of novices as they use Private WebMail (Pwm), Tutanota, and Virtru and 10 pairs of novices as they use Mailvelope. Participants report being more at ease with this type of study and better able to cope with mistakes since both participants are “on the same page.” We find that users prefer integrated solutions over depot-based solutions and that tutorials are important in helping first-time users. Finally, our results demonstrate that Pretty Good Privacy using manual key management is still unusable for novice users, with 9 of 10 participant pairs failing to complete the study.

Secure email is increasingly being touted as usable by novice users, with a push for adoption based on recent concerns about government surveillance. To determine whether secure email is ready for grassroots adoption, we employ a laboratory user study that recruits pairs of novice users to install and use several of the latest systems to exchange secure messages. We present both quantitative and qualitative results from 25 pairs of novice users as they use Pwm, Tutanota, and Virtru. Participants report being more at ease with this type of study and better able to cope with mistakes since both participants are "on the same page". We find that users prefer integrated solutions over depot-based solutions, and that tutorials are important in helping first-time users. Hiding the details of how a secure email system provides security can lead to a lack of trust in the system. Participants expressed a desire to use secure email, but few wanted to use it regularly and most were unsure of when they might use it.

Context: Conventional wisdom, inspired in part by Eric Raymond, suggests that open source developers should---and primarily do---develop software for developers like themselves. We refer to the production of software primarily for the benefit of developers as reflexivity, and we evaluate the applicability of this concept to open source software (OSS) by studying SourceForge projects. Objective: The goal of this research is to test Eric Raymond's assertions with respect to OSS success factors. Method: We present four criteria by which to assess project reflexivity in SourceForge. These criteria are based on three specific indicators: intended audiences, relevant topics, and supported operating systems. Results: We show in this short paper that 68% of SourceForge projects are likely reflexive (in the sense described by Raymond). Further, 76% of projects exceeding one million downloads are reflexive, 79% for projects exceeding ten million downloads, and 89% for projects exceeding one hundred million downloads. Conclusion: These results tentatively support Raymond's assertions that 1) OSS projects tend to be reflexive and 2) reflexive OSS projects tend to be more successful than irreflexive projects. Causality, however, is not addressed.