I Do and I Understand. Not Yet True for Security APIs. So Sad

Abstract

Usable security puts the users into the center of cyber security developments. Software developers are a very specific user group in this respect, since their points of contact with security are application programming interfaces (APIs). In contrast to APIs providing functionalities of other domains than security, security APIs are not approachable by habitual means. Learning by doing exploration exercises is not well supported. Reasons for this range from missing documentation, tutorials and examples to lacking tools and impenetrable APIs, that makes this complex matter accessible. In this paper we study what abstraction level of security APIs is more suitable to meet common developers' needs and expectations. For this purpose, we firstly define the term security API. Following this definition, we introduce a classification of security APIs according to their abstraction level. We then adopted this classification in two studies. In one we gathered the current coverage of the distinct classes by the standard set of security functionality provided by popular software development kits. The other study has been an online questionnaire in which we asked 55 software developers about their experiences and opinion in respect of integrating security mechanisms into their coding projects. Our findings emphasize that the right abstraction level of a security API is one important aspect to consider in usable security API design that has not been addressed much so far. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

A Survey on Developer-Centred Security

“…SecAPIs broadly fall into two categories, security primitives which required security knowledge to understand and security controls which were found to be a more appropriate abstraction level for developers. Unlike other APIs, SecAPIs do not well support learning-by-doing [70].…”

Bitcoin’s APIs in Open-Source Projects: Security Usability Evaluation

“…Although their focus is on cryptographic APIs, most of their suggested principles apply equally well to other security APIs. Lo Iacono and Gorski (2017) in [28] note that most of the research investigating the APIs' usability of security is related to cryptography. They point out that security APIs include more than cryptographic APIs.…”

Will You Trust This TLS Certificate?

“…The participants were not primed to expect security tasks, but before accepting them, we made sure that they knew what TLS certificates were. We decided not to limit our sample to security professionals, as it turns out that the majority of developers work with security features from time to time [30]. The whole experiment took about 30 to 40 minutes per participant (pre-task questionnaire, task, post-task interview).…”