Harassment impacts the safety and well-being of young adults in Pakistan. Prior research has largely focused on women, often imposing external definitions of harm and overlooking how individuals themselves understand and respond to harassment. This study examines how Pakistani young adults define, experience, and cope with harassment. Drawing on 33 semi-structured interviews guided by a human-centered threat modeling framework, we surface context-specific threat models. Participants’ definitions of harassment were shaped by gender norms, religious values, and moral judgments. Women described harassment as a routine part of life, tied to public visibility, modesty norms. Men also reported harassment, though framed by different dynamics such as pressure to maintain control, avoid vulnerability, and conform to masculinity. Across participants, formal reporting pathways were viewed as untrustworthy or unsafe. Our findings highlight the need for interventions that reflect local definitions of harm, address relational adversaries, and support safety within sociocultural contexts.

This work explores the security and privacy perceptions, practices, and challenges Pakistani immigrants face in the US. We also explore how parent-child dynamics affect immi-grants' learning about and adaptation to security and privacy practices in the US. Through 25 semi-structured interviews with Pakistani immigrants, we find that first-generation immigrants perceive heightened risks of discrimination, surveillance, and isolation due to their status as Muslim immigrants. They also report tensions regarding self-expression and self-censorship in online settings. In contrast, second-generation immigrants quickly adapt to life in the US and do not perceive most of these challenges. We find that first- and second-generation immigrants mutually support each other in learning to use technology and reacting to perceived threats. Our findings underscore an urgent need for tailored digital safety initiatives and designs that consider the unique needs of at-risk populations to ensure their security and privacy. Recognizing and addressing these challenges can foster more inclusive digital landscapes, empowering immigrant populations with resilience and agency.

Human-centered threat modeling is a practice that researchers use to identify security and privacy threats to people, as well as ways to mitigate those threats. Often this may be the first step toward understanding the security and privacy needs, perspectives, experiences, and practices of a group or community, so that researchers can learn how to better improve their overall safety. However, research in this area is relatively ad hoc as compared to the more well-developed field of threat modeling for systems, leading to a fragmented and incomplete understanding of how researchers should engage in this endeavor. The goal of this work is to systematize the practice of human-centered threat modeling, identifying the core components of a human-centered threat modeling exercise by studying the practices of researchers in the area. We gathered a corpus of 78 papers in this area, using qualitative analysis to understand the practices used by researchers to elicit a threat model. Our results include a framework for human-centered threat modeling, a guide for using the framework that is grounded in best practices, and a description of how human-centered threat modeling differs from systems threat modeling. Our work can be used to guide new and experienced researchers in the field as they work to center human safety in their practices.

Popular instant messaging applications such as WhatsApp and Signal provide end-to-end encryption for billions of users. These applications often rely on a centralized, application-specific server to distribute public keys and relay encrypted messages between the users. As a result, they prevent passive attacks but are vulnerable to some active attacks. A malicious or hacked server can distribute fake keys to users to perform man-in-the-middle or impersonation attacks. While typical secure messaging applications provide a manual method for users to detect these attacks, this burdens users, and studies show it is ineffective in practice. This paper presents KTACA, a completely automated approach for key verification that is oblivious to users and easy to deploy. We motivate KTACA by designing two approaches to automatic key verification. One approach uses client auditing (KTCA) and the second uses anonymous key monitoring (AKM). Both have relatively inferior security properties, leading to KTACA, which combines these approaches to provide the best of both worlds. We provide a security analysis of each defense, identifying which attacks they can automatically detect. We implement the active attacks to demonstrate they are possible, and we also create a prototype implementation of all the defenses to measure their performance and confirm their feasibility. Finally, we discuss the strengths and weaknesses of each defense, the load they impose on clients and service providers, and their deployment considerations.

The privacy guaranteed by secure messaging applications relies on users completing an authentication ceremony to verify they are using the proper encryption keys. We examine the feasibility of social authentication, which partially automates the ceremony using social media accounts. We implemented social authentication in Signal and conducted a within-subject user study with 42 participants to compare this with existing methods. To generalize our results, we conducted a Mechanical Turk survey involving 421 respondents. Our results show that users found social authentication to be convenient and fast. They particularly liked verifying keys asynchronously, and viewing social media profiles naturally coincided with how participants thought of verification. However, some participants reacted negatively to integrating social media with Signal, primarily because they distrust social media services. Overall, automating the authentication ceremony and distributing trust with additional service providers is promising, but this infrastructure needs to be more trusted than social media companies.

Secure email is increasingly being touted as usable by novice users, with a push for adoption based on recent concerns about government surveillance. To determine whether secure email is ready for grassroots adoption, we employ a laboratory user study that recruits pairs of novice users to install and use several of the latest systems to exchange secure messages. We present both quantitative and qualitative results from 28 pairs of novices as they use Private WebMail (Pwm), Tutanota, and Virtru and 10 pairs of novices as they use Mailvelope. Participants report being more at ease with this type of study and better able to cope with mistakes since both participants are “on the same page.” We find that users prefer integrated solutions over depot-based solutions and that tutorials are important in helping first-time users. Finally, our results demonstrate that Pretty Good Privacy using manual key management is still unusable for novice users, with 9 of 10 participant pairs failing to complete the study.

Secure email is increasingly being touted as usable by novice users, with a push for adoption based on recent concerns about government surveillance. To determine whether secure email is ready for grassroots adoption, we employ a laboratory user study that recruits pairs of novice users to install and use several of the latest systems to exchange secure messages. We present both quantitative and qualitative results from 25 pairs of novice users as they use Pwm, Tutanota, and Virtru. Participants report being more at ease with this type of study and better able to cope with mistakes since both participants are "on the same page". We find that users prefer integrated solutions over depot-based solutions, and that tutorials are important in helping first-time users. Hiding the details of how a secure email system provides security can lead to a lack of trust in the system. Participants expressed a desire to use secure email, but few wanted to use it regularly and most were unsure of when they might use it.

The World Wide Web has become the most common platform for building applications and delivering content. Yet despite years of research, the web continues to face severe security challenges related to data integrity and confidentiality. Rather than continuing the exploit-and-patch cycle, we propose addressing these challenges at an architectural level, by supplementing the web's existing connection-based and server-based security models with a new approach: content-based security. With this approach, content is directly signed and encrypted at rest, enabling it to be delivered via any path and then validated by the browser. We explore how this new architectural approach can be applied to the web and analyze its security benefits. We then discuss a broad research agenda to realize this vision and the challenges that must be overcome.

Private Webmail 2.0 (Pwm 2.0) improves upon the current state of the art by increasing the usability and practical security of secure email for ordinary users. More users are able to send and receive encrypted emails without mistakenly revealing sensitive information. In this paper we describe four user interface traits that positively affect the usability and security of Pwm 2.0. In a user study involving 51 participants we validate that these interface modifications result in high usability, few mistakes, and a strong understanding of the protection provided to secure email messages. We also show that the use of manual encryption has no effect on usability or security.

The use of TLS proxies to intercept encrypted traffic is controversial since the same mechanism can be used for both benevolent purposes, such as protecting against malware, and for malicious purposes, such as identity theft or warrantless government surveillance. To understand the prevalence and uses of these proxies, we build a TLS proxy measurement tool and deploy it via a Google AdWords campaign. We generate 2.9 million certificate tests and find that 1 in 250 TLS connections are proxied. The majority of these proxies appear to be benevolent, however we identify over 1,000 cases where three malware products are using this technology nefariously. We also find numerous instances of negligent and duplicitous behavior, some of which degrade security for users without their knowledge.

Extensive research has been performed on improving TCP performance in multi-hop wireless networks, but there have been relatively few experimental evaluations of this work. To make it easier to conduct research in this area, we are releasing WiFu, an open-source toolkit for developing experimental wireless transport protocols. WiFu provides for user-space development of reliable transport and rate control algorithms, greatly simplifying the implementation effort required. In this paper, we describe the architecture of the WiFu toolkit, which decomposes transport protocols into smaller components that enable rapid, plug-and-play development of new variants. We present experiments to demonstrate that the performance of WiFu compares favorably to the Linux kernel for wireless networks. We illustrate the utility of WiFu by using it to conduct experiments with several wireless transport protocols, and show that the performance of some protocols differs significantly from previously reported results.

Video streaming on the Internet is increasingly using Dynamic Adaptive Streaming over HTTP (DASH), which allows a client to dynamically adjust its video quality by choosing the appropriate quality level for each segment based on the current download rate. In this paper we examine the impact of Scalable Video Coding (SVC) on the client's quality selection policy. Given a variable download rate, when should the client try to maximize the current segment's video quality, and when should it instead play it safe and ensure a minimum level of quality for future segments? We use a combination of analysis, dynamic programming, and simulation to show that a client should use a diagonal quality selection policy, which combines prefetching with backfilling to balance both of these concerns. We also illustrate the conditions that affect the slope of the diagonal policy.

It is well known that TCP performs poorly in wireless mesh networks. There has been intensive research in this area, but most work uses simulation as the only evaluation method; however, it is not clear whether the performance gains seen with simulation will translate into benefits on real networks. To explore this issue, we have implemented ATP, a transport protocol designed specifically for wireless ad hoc networks. We choose ATP because it uses a radically different design from TCP and because reported results claim significant improvement over TCP. We show how ATP must be modified in order to be implemented in existing open-source wireless drivers, and perform a comprehensive performance evaluation on a mesh testbed under different operating conditions. Our results show that the performance of ATP is highly sensitive to protocol parameters, especially the epoch timeout value. To improve its performance we design an adaptive version that utilizes a self-adjustable feedback mechanism instead of a fixed parameter. We illustrate its advantages by using a measurement study to compare it with the original ATP and to a standard TCP Tahoe implementation.

One of the main goals of BitTorrent is to reduce load on Web servers by encouraging clients to share content between themselves. However, BitTorrent's current design relies heavily on the original source to serve a disproportionate amount of the file. We modify standard BitTorrent software so that a source determines the current popularity of each of the blocks of a file and tries to serve only those blocks that are rare. Using extensive PlanetLab experiments, we show that this modification can save a significant amount of the source's upload bandwidth, with the tradeoff of some increased peer download time. In addition, there are individual experiments that both save bandwidth and have a faster download time than standard BitTorrent. We examine some of the more exceptional experiments, explore alternative algorithms, and provide insight for further improvements.

As wireless devices continue to become more prevalent, heterogeneous wireless networks - in which communicating devices have at their disposal multiple types of radios - will become the norm. Communication between nodes in these networks ought to be as simple as possible; they should be able to seamlessly switch between different radios and network stacks on the fly in order to better serve the user. To make this a possibility, we consider the challenging problems of when two communicating devices should decide to switch to a different radio, and which radio they should choose. We design an autonomous and intelligent radio switch (AIRS) decision algorithm that uses predicted radio availability and user profiles to choose the best available radio for two adjacent devices. The decision algorithm uses several parameters to avoid switching radios too frequently. We use a simulation study to evaluate the best settings for several parameters, then show that the AIRS system performs better than several alternative algorithms. AIRS is able to provide dynamic, but stable radio switching, while balancing the competing objectives of high throughput and low power consumption.

Multicast transport is a challenging problem because the source must provide congestion control and reliability for a tree, rather than a single path. This problem is made even more difficult in mobile ad hoc networks due to problems caused by contention, spatial reuse, and mobility. In this paper, we design a hop-by-hop multicast transport protocol, which pushes transport functionality into the core of the network. Although this requires per-flow state, a hop-by-hop approach simplifies congestion control, enables local recovery of lost packets, and provides low delay and efficient use of wireless capacity. We use a simulation study to demonstrate the effectiveness of this approach and compare its efficiency to application-layer multicast.

Routing in a mobile ad hoc network is challenging because nodes can move at any time, invalidating a previously-discovered route. Multicast routing is even more challenging, because a source needs to maintain a route to potentially many group members simultaneously. Providing scalable solutions to this problem typically requires building a hierarchy or an overlay network to reduce the cost of route discovery and maintenance. In this paper, we show that a much simpler alternative is possible, by using source specific semantics and relying on the unicast routing protocol to find all routes. This separation of concerns enables the multicast routing protocol to focus on minimizing join latency, repair latency, and control overhead. We design a routing protocol based on these principles and demonstrate its effectiveness through simulations.

Communication between wireless devices ought to be as simple as possible; they should be able to seamlessly switch between different radios and network stacks on the fly in order to better serve the user. To make this a possibility, we consider the challenging problem of predicting link quality in a changing mobile environment. In this paper we present an algorithm that uses Weighted Least Squares Regression to predict whether a given link can meet application requirements in terms of throughput, delay, and jitter. We use a simulation study to demonstrate that our algorithm is able to predict link quality accurately and stably in a frequently changing mobile environment. The prediction algorithm is more accurate than several alternative algorithms, and the overhead caused by the link measurements is negligible in terms of throughput and power consumption.

In this paper we consider the problem of distinguishing whether frame loss at the MAC layer has occurred due to mobility or congestion. Most ad hoc routing protocols make the faulty assumption that all frame loss means the destination node has moved, resulting in significant overhead as they initiate the repair of routes that have not been broken. We design a mobility detection algorithm, MDA, that properly detects the cause of a lost frame, then coordinates with the routing protocol so that it reacts properly. This approach dramatically reduces routing protocol overhead and significantly increases application throughput. We use a simulation study to demonstrate the effectiveness of MDA and to determine the proper setting for MDA parameters.

Devices with multiple wireless interfaces are becoming increasingly popular. We envision that these devices will become the building block for future mesh networks, providing seamless connectivity across a range of heterogeneous devices. Although these devices typically implement frequency sharing, using either direct sequence spread spectrum (DSSS) or frequency hopping spread spectrum (FHSS), they may still interfere with one another. In this paper we provide a novel radio interference avoidance (RIA) algorithm that solves the problem of interference between IEEE 802.11 and Bluetooth. We then extend this algorithm to other types of DSSS and FHSS combinations. Though the algorithm is limited to devices with both of these interfaces, this is a very common case. We analytically derive the expected value of the response time for RIA and run simulations to demonstrate its effectiveness. Our results indicate that RIA is able to eliminate interference with a very short response time. RIA also outperforms adaptive frequency hopping, a solution proposed by the IEEE 802.15 co-existence working group.

We are concerned with the fundamental problem of event ordering in multiplayer peer-to-peer games. Event ordering, even without faults, requires all-to-all message passing with at least two rounds of communication \cite{keidar01}. Multiplayer games add real-time constraints to this scenario. To meet this challenge, we develop an event scoping mechanism that uses N-Trees for event propagation. Unlike traditional application-layer multicast, N-Trees organize peers by their application-level scope of interest, instead of by their delay-based shortest-path tree. This organization allows peers which are close by in the virtual world to order events without needing to communicate with other peers that are farther away. We show the asymptotic analysis of N-Trees indicates that they will perform well for scalable peer-to-peer event ordering. We also provide an analysis of N-Trees in comparison to other distributed architectures for peer-to-peer games.

Current ad hoc multicast routing protocols have been designed to build and maintain a tree or mesh in the face of a mobile environment, with fast reaction to network changes in order to minimize packet loss. However, the performance of these protocols has not been adequately examined under realistic scenarios. Existing performance studies generally use a single, simple mobility model, with low density and often very low traffic rates. We explore the performance of ad hoc multicast routing protocols under scenarios that include realistic mobility patterns, high density and high traffic load. We use these scenarios to identify cases where existing protocols can improve their performance. Based on our observations, we make a series of recommendations for designers of multicast protocols.

We are developing a distributed architecture for massively-multiplayer games. In this paper, we focus on designing a low-latency event ordering protocol, called NEO, for this architecture. Previous event ordering protocols prevent several types of cheats at the expense of operating at the latency of the slowest player. We broaden the definition of cheating to include four common protocol level cheats and demonstrate how NEO prevents these cheats. At the same time, NEO has a playout latency independent of network conditions and adapts to network congestion to optimize performance.

Current network-layer multicast routing protocols build multicast trees based only on hop count and policy. If a tree cannot meet application requirements, the receivers have no alternative. In this paper, we propose a general and modular architecture that integrates alternate path routing with the network's multicast services. This enables individual multicast receivers to reroute a multicast tree according to their needs, subject to policy restrictions. Our design focuses on the two primary components of this architecture - a loop-free path installation protocol and a scalable, distributed path computation algorithm. Based on a simulation study, we demonstrate that using alternate path routing enables receivers to find acceptable paths nearly as well as a link-state protocol, with much lower overhead. We also show that our approach scales to large networks and that performance improves as a multicast group grows in size.

The multicast address allocation problem requires Internet domains to allocate unique addresses to multicast applications from a globally-shared space. We develop a theoretical framework for multicast allocation algorithms that is influenced by subcube allocation in hypercube computer systems. Based on this framework we derive complexity results for the address allocation problem and describe several new allocation algorithms that use a hypercube model for address representation.

To support IP multicast, domains must assign a unique multicast address to each application from a limited, globally-shared address space. We examine the performance of several classes of address allocation algorithms within the context of the MASC architecture. This study is the first of its kind to model the generalized multicast address allocation problem and consider non-contiguous allocation algorithms. We find that prefix-based allocation outperforms our non-contiguous algorithm, despite the apparent advantages of non-contiguous allocation. We also verify the benefit of using worst-fit for new allocations.

Quality of service routing for multicast enables a group member to find and install a branch of the multicast tree that can meet its QoS constraints. The most promising protocols in this area use receiver-oriented path searching heuristics to find feasible routes. In this paper, we examine the performance of the path searching heuristics used by these protocols, to determine which techniques are the most effective. We find that several low-overhead path searching heuristics are effective, and that generic path searching can work as well as targeted, QoS-specific searching.

We consider the possibility that single-source multicast (SSM) will become a universal multicast service, enabling large-scale distribution of content from a few well-known sources to a general audience. Operating under this assumption, we explore the problem of building the traditional IP model of any-source multicast on top of SSM. Toward this end, we design an SSM proxy service that allows any sender to efficiently deliver content to a multicast group. We demonstrate the performance improvements this service offers over standard SSM and describe extensions for access control, dynamic proxy discovery, and multicast proxy distribution.

Alternate path routing has been well-explored in telecommunication networks as a means of decreasing the call blocking rate and increasing network utility. However, aside from some work applying these concepts to unicast flows, alternate path routing has received little attention in the Internet community. We describe and evaluate an architecture for alternate path routing for multicast flows. For path installation, we design a receiver-oriented alternate path protocol and prove that it reconfigures multicast trees without introducing loops. For path computation, we propose a scalable local search heuristic that allows receivers to find alternate paths using only partial network information. We use a simulation study to demonstrate the ability of local search to find alternate paths approximately as well as a link-state protocol, with much lower overhead.