SOUPS 2019
2019-08-11..2019-08-13
Santa Clara, United States
SOUPS ·
[SOUPS 2019, SOUPS 2020, SOUPS 2021, SOUPS 2022, SOUPS 2023, SOUPS 2024, SOUPS 2025]
who it's for
usable security researchers, privacy researchers, ux researchers, security engineers, product managers, app developers, system administrators, investigative journalists
topics
two-factor authentication usability; FIDO U2F evaluations; password manager adoption; UPSP privacy perception scale; SA-6 security attitude scale; browser security warning design; GDPR right of access abuse; website data deletion and opt-out; browser-based multiparty computation; phishing site certificate analysis; smart home data perceptions; cooperative accessibility for privacy
| title | author | length |
|---|---|---|
| Investigative Journalism in the Digital Age: Privacy, Security and the Media | Jennifer Valentino-DeVries | 01h 01m |
Covers concrete collaborations between reporters and technologists, reproducing an academic finding that 6,000 kids apps include more than half that leak… | ||
| Cooperative Privacy and Security: Learning from People with Visual Impairments | Jordan Hayes, Smirity Kaushik | 23m |
Researchers shadow 8 people (3 blind, 2 low-vision, 3 allies) across 13 two-day shadowing sessions with exit interviews and memos, documenting that screen… | ||
| Privacy and Security Threat Models and Mitigation Strategies of Older Adults | Alisa Frik | 23m |
Qualitative study of 46 semi-structured interviews with English-speaking adults aged 65–95 living alone, in independent housing, or senior facilities finds… | ||
| Evaluating Users’ Perceptions about a System’s Privacy: Differentiating Social | Oshrat Ayalon | 22m |
Develops and validates a 27‑item UPSP scale from three online studies (n=1,313) that separates users’ perceived system privacy into institutional, social, and… | ||
| A Self-Report Measure of End-User Security Attitudes (SA-6) | Cori Faklaris | 19m |
SA-6 is a six-item scale that asks about routine, expert attention, knowledge, motivation, interest, and active learning and is scored 1–5 then averaged… | ||
| The Effect of Entertainment Media on Mental Models of Computer Security | Kelsey R. Fulton | 21m |
Study reports n=19 semi-structured interviews and shows entertainment media shapes concrete security beliefs: people learn that hackers only target important… | ||
| A Typology of Perceived Triggers for End-User Security and Privacy Behaviors | Laura A. Dabbish | 23m |
Survey of 852 MTurk respondents reports 1,947 recent S&P behavior changes and classifies the immediate prompts: social triggers drive 39% of events, proactive… | ||
| Replication: No One Can Hack My Mind Revisiting a Study on Expert and Non-Expert | Karoline Busse | 19m |
Replication of a 2015 survey reproduces the original’s main findings but with precise differences: 288 MTurk non-experts and 75 experts (mostly EU) replace the… | ||
| "Something isn't secure, but I'm not sure how that translates into a problem" | Daniel Zappala | 28m |
Redesign of Signal warnings replaces vague “safety numbers” with device identifiers grouped for easier reading, adds a privacy check flow that blocks next… | ||
| "I was told to buy a software or lose my computer. I ignored it": A study | Camelia Simoiu | 22m |
A representative survey of 1,180 US adults finds 3% of US adults report ransomware during 2016–17, median demand $250 and mean $510, and only 4% paid; about… | ||
| Enhancing Privacy through an Interactive On-demand Incremental Information | Hye-Chung Kum | 22m |
Research builds an interactive record-linkage interface that reveals PII only on-demand incremental disclosure, logs every access, and enforces a hard budget… | ||
| From Usability to Secure Computing and Back Again | Lucy Qin, Peter Flockhart | 21m |
A usable MPC deployment called Web-MPC platform runs in the browser and is deployed for Boston workforce studies with over 100 companies contributing salary… | ||
| Certified Phishing: Taking a Look at Public Key Certificates of Phishing Websites | Vincent Drury | 21m |
Collected nearly 10,000 valid phishing certificates and about 40,000 valid benign certificates and compare issuer, validation type and subject fields. Most… | ||
| Monday Lightning Talks | Ann-Marie Horcher, Alana Maurushat, Pavithren V.S. Pakianathan, Robbie MacGregor | 22m |
Summaries: a Star Wars themed web app maps eight classic secure design principles to movie scenes and provides an interactive Star Wars web game for teaching… | ||
| "We Can't Live Without Them!" App Developers' Adoption of Ad Networks and Their | Abraham H. Mhaidli | 23m |
Mixed-methods study with a 49‑person survey and 10 interviews shows independent app developers integrate ad network SDKs by default, pick networks from forums… | ||
| Usability Smells: An Analysis of Developers’ Struggle With Crypto Libraries | Nikhil Patnaik | 23m |
Analysis of 2491 Stack Overflow questions across seven crypto libraries including OpenSSL, Libsodium, BouncyCastle, SJCL, crypto‑js, NaCl and PyCrypto extracts… | ||
| System Administrators Prefer Command Line Interfaces, Don't They? An Exploratory Study | Leonardo A. Martucci | 23m |
An online survey of 306 respondents who work with firewalls finds that 70% primarily use GUIs and 60% prefer GUIs while only about 32% prefer CLIs; recruitment… | ||
| Keepers of the Machines: Examining How System Administrators Manage Software Updates | Frank Li | 21m |
Study surveys 102 administrators and interviews 17, maps updates into five stages and documents concrete pain points: admins use Ansible or Chef plus custom… | ||
| Communicating Device Confidence Level and Upcoming Re-Authentications in Continuous | Sarah Delgado Rodriguez | 22m |
An Android prototype called Authenticator Android app simulates behavioral biometric continuous authentication, locks at a 20% device confidence level and… | ||
| Exploring Intentional Behaviour Modifications for Password Typing on Mobile Touchscreen | Lukas Mecke | 23m |
Prestudy (N=114) yields visual key-shape annotations that 80%+ of participants correctly interpret; lab study (N=24) runs 37 tasks across two sessions one week… | ||
| Why people (don’t) use password managers effectively | Sarah Pearman, Shikun Aerin Zhang | 24m |
Semi-structured interviews with 30 participants reveal concrete differences: 9 no-tool, 12 built-in, 7 third-party, 2 other and built-in users frequently reuse… | ||
| Of Two Minds about Two-Factor: Understanding Everyday FIDO U2F Usability | Simon Parkin | 24m |
Two studies test real-world FIDO U2F use: a 15-person lab comparison of three keys (e-pass, secure click, Yubikey) versus SMS OTPs, and a 15-person diary with… | ||
| A Usability Study of Five Two-Factor Authentication Methods | Jonathan Dutson | 22m |
A two-week, between-subjects study with 72 participants and a 30-person within-subjects setup study compares SMS, TOTP, push, pre-generated printed codes, and… | ||
| Personal Information Leakage by Abusing the GDPR 'Right of Access' | Mariano Di Martino | 22m |
Researchers test 55 organizations across finance, retail, entertainment and news by sending GDPR right‑of‑access requests using forged or public data and… | ||
| An Empirical Analysis of Data Deletion and Opt-Out Choices on 150 Websites | Yixin Zou | 20m |
Manual content analysis of 150 websites (stratified by traffic) inspects email opt-outs, targeted‑ad opt-outs and data‑deletion flows using an 82‑question… | ||
| The Fog of Warnings: How Non-essential Notifications Blur with Security Warnings | Anthony Vance | 22m |
Online experiment on Firefox with 600 participants uses a Batman image classification task to inject 15 repeated performance notifications and a one-time… | ||
| Tuesday Lightning Talks 1 | Naomi Shiffman, Jim Fenton, Jim Lane, Isha Ghosh | 24m |
Four lightning reports give concrete claims and artifacts: a Firefox Heartbeat survey of 6,600 Firefox users finds 93% want warrants for browser… | ||
| “There is nothing that I need to keep secret”: Sharing Practices and Concerns | Abdulmajeed Alqhatani | 21m |
30 semi-structured interviews of wearable fitness users reveal concrete sharing behaviors and privacy tradeoffs: participants sort recipients into six… | ||
| "I don't own the data": End User Perceptions of Smart Home Device Data | Madiha Tabassum | 22m |
Semi-structured study with 23 semi-structured interviews of users owning three or more smart devices finds users know devices collect sensitive audio/video but… | ||
| More than Smart Speakers: Security and Privacy Perceptions of Smart Home Personal | Noura Abdi | 22m |
Semi-structured interviews with 17 Echo/Google Home users and grounded theory coding reveal that users hold incomplete mental models of the SPA ecosystem… | ||
| Tuesday Lightning Talks 2 | Amin Rabinia, Conor Gilsenan, Walter Berggren, Maggie Oates | 21m |
Proposes a concrete privacy engineering paradigm that defines privacy = consistency of informational behaviors with reasonable expectations and embeds it in a… | ||
| nothing matches | ||