We Gave You This Internet, Now Play by Our Rules

When we as technologists design a new product or provide advice and support, our assumptions and worldview necessarily color the work we do—and by extension the “rules” that we expect users to follow. We assume that we know how our users employ technology to communicate. We assume that we know what the concepts of "security" and "privacy" mean to our users. But those assumptions—and the security advice and design that they motivate—can fall apart when confronted with the on-the-ground realities that users face, often with harmful results. The world's most popular large-scale Internet platforms, often created and incubated in a monoculture, are not immune to this phenomenon. When users face risk beyond that anticipated by developers, the response is often that users should consider their threat model, change their behavior, or stop using certain tools altogether. In this talk, we argue that some of the assumptions we routinely bring to our work should be treated as security bugs, as they can relegate to second-class status those users who differently adapt technology to their lives. We question several common assumptions in the security community and tell stories of security issues that can stem from them, drawn from our extensive work with targeted communities around the world.