arXiv subjects

John Sadik

Publications and source records attributed to John Sadik.

6 recordsLinked to original sources

arXiv2026

A Multi-Month Study of Git Commit Signing

Git commit signing, introduced in 2012, is one mechanism for establishing commit provenance in software supply chains, yet developer-controlled adoption remains rare and developers' experiences using it are understudied. To examine this experience, we conducted a three-month study with senior undergraduate and graduate computer science students (n = 22), whom we treat as proxies for junior developers. Participants configured commit signing independently, used it across four coursework projects, extended it to a second device, examined an external repository containing anomalous commits, and answered security-reasoning prompts. We found that while almost all participants successfully signed every commit and rated routine signing positively, many faced friction during setup, multi-device configuration, and repository verification. Despite signing all semester, they struggled to spot anomalous commits during verification, with over a quarter finding none. Additionally, nearly half expressed at least one misconception regarding signing guarantees or key management. Without isolating whether these difficulties stemmed from tooling, education, or understanding, we conclude that making signing easier is not enough to ensure effective security use. Rather, secure adoption also requires tools and education that support signature verification against authorized identities, interpretation of missing signatures and unknown keys, and correct reasoning about key-lifecycle operations.

cs.CR↗

arXiv2026

Analysis of Commit Signing on Github

Securing the open-source software supply chain requires verifying the provenance of every code contribution. While end-to-end (E2E) cryptographic commit signing is widely promoted to achieve this, little is known about how developers actually use it at scale. We fill this gap by analyzing 2,737,649 GitHub accounts, identifying 71,694 active contributors, and examining 16,112,439 commits across 874,198 repositories to characterize their commit-signing and key-management practices throughout GitHub's history. We demonstrate that the vast majority of signed activity is generated automatically by GitHub's web interface rather than by individual developers. Genuine E2E commit signing is exceptionally rare, and the few developers who adopt it practice it erratically, frequently abandoning it over time or leaving expired keys unrevoked. Ultimately, we show that manual key management creates a false sense of security across the open-source community, and we outline structural platform interventions to resolve this failure.

cs.SE↗

arXiv2026

"Setting up TLS authentication was hell": A Usability Study of Client Certificate Authentication

"Cryptography turns a security problem into a key management problem." Despite decades of research effort towards usable key management, it remains unclear whether key management issues are inherent to every cryptographic system or merely artifacts of specific designs. To investigate, this paper presents a user study of mutual TLS (mTLS) usability, tracking 46 senior and graduate computer science students, highly technical users who configured client certificates, used them for routine authentication over a semester-long course, and managed credentials across multiple devices. Our results show that initial setup and setting up credentials on a second device are difficult, while routine authentication is easy once configured. Nevertheless, perceived usability remained low, and alarmingly, only 9 percent of participants fully understood mTLS security implications and key management. Our findings demonstrate that usability challenges shift across the credential lifecycle depending on system architecture. We conclude by offering design recommendations for future key management systems to better support users across the complete credential lifecycle.

cs.CR↗

arXiv2024

A Large-Scale Survey of Password Entry Practices on Non-Desktop Devices

Password managers encourage users to generate passwords to improve their security. However, research has shown that users avoid generating passwords, often giving the rationale that it is difficult to enter generated passwords on devices without a password manager. In this paper, we conduct a survey ($n=999$) of individuals from the US, UK, and Europe, exploring the range of devices on which they enter passwords and the challenges associated with password entry on those devices. We find that password entry on devices without password managers is a common occurrence and comes with significant usability challenges. These usability challenges lead users to weaken their passwords to increase the ease of entry. We conclude this paper with a discussion of how future research could address these challenges and encourage users to adopt generated passwords.

cs.HC↗

arXiv2024

Security Advice for Parents and Children About Content Filtering and Circumvention as Found on YouTube and TikTok

In today's digital age, concerns about online security and privacy have become paramount. However, addressing these issues can be difficult, especially within the context of family relationships, wherein parents and children may have conflicting interests. In this environment, parents and children may turn to online security advice to determine how to proceed. In this paper, we examine the advice available to parents and children regarding content filtering and circumvention as found on YouTube and TikTok. In an analysis of 839 videos returned from queries on these topics, we found that half (n=399) provide relevant advice. Our results show that of these videos, roughly three-quarters are accurate, with the remaining one-fourth containing factually incorrect advice. We find that videos targeting children are both more likely to be incorrect and actionable than videos targeting parents, leaving children at increased risk of taking harmful action. Moreover, we find that while advice videos targeting parents will occasionally discuss the ethics of content filtering and device monitoring (including recommendations to respect children's autonomy) no such discussion of the ethics or risks of circumventing content filtering is given to children, leaving them unaware of any risks that may be involved with doing so. Ultimately, our research indicates that video-based social media sites are already effective sources of security advice propagation and that the public would benefit from security researchers and practitioners engaging more with these platforms, both for the creation of content and of tools designed to help with more effective filtering.

cs.SI↗

arXiv2024

Ocassionally Secure: A Comparative Analysis of Code Generation Assistants

$ $Large Language Models (LLMs) are being increasingly utilized in various applications, with code generations being a notable example. While previous research has shown that LLMs have the capability to generate both secure and insecure code, the literature does not take into account what factors help generate secure and effective code. Therefore in this paper we focus on identifying and understanding the conditions and contexts in which LLMs can be effectively and safely deployed in real-world scenarios to generate quality code. We conducted a comparative analysis of four advanced LLMs--GPT-3.5 and GPT-4 using ChatGPT and Bard and Gemini from Google--using 9 separate tasks to assess each model's code generation capabilities. We contextualized our study to represent the typical use cases of a real-life developer employing LLMs for everyday tasks as work. Additionally, we place an emphasis on security awareness which is represented through the use of two distinct versions of our developer persona. In total, we collected 61 code outputs and analyzed them across several aspects: functionality, security, performance, complexity, and reliability. These insights are crucial for understanding the models' capabilities and limitations, guiding future development and practical applications in the field of automated code generation.

cs.CR↗