Rethinking Access Control and Authentication for the Home Internet of Things
summary
Argues access control should be capability‑centric rather than per‑device and demonstrates this with a 425‑participant online study that tests 22 capabilities across six household relationships, revealing strong, capability‑specific defaults (e.g., spouses get broad access, neighbors almost none) and widespread demand for contextual primitives: time of day, location of user/device, temporary access, and enforcement tied to usage history and consequence thresholds; prototypes for relationship‑based defaults and richer policy interfaces are sketched.
AI-written summary · about
chapters (16)
- 0:00Start
- 1:23From Single User to Multi User
- 2:00Vendors Still Treat It The Old Way!
- 2:33Please Enter Your Password
- 3:39Research Goals
- 4:05User Study
- 5:096 Relationships
- 5:3122 Capabilities
- 6:13425 Participants
- 7:29Comparison Between Capabilities
- 9:45Teenager vs. Child
- 12:00Factor: Location of User
- 12:24Factor: Location of Device
- 13:01Factor: Consequences
- 13:26Factor: Responsible Usage
- 13:54Factor: Understanding
related talks
39mDilemma in IoT Access Control: Revealing Novel Attacks and Design Challenges in Mobile-as-a-Gateway
47mPatterns of Authentication and Self-Announcement in IoT
42mThe Security We Need: Designing Usable IoT Security
29mSmartAuth: User-Centered Authorization for the Internet of Things
10mIoT: End of Shorter Days
19mSecurity and Privacy in a Hyper-connected World
33mThe Internet of (Better) Things
13m"Nobody's Happy": Design Insights from Privacy-Conscious Smart Home Power Users...