SOUPS 2020
2020-08-10..2020-08-11
-- online --
SOUPS ·
[SOUPS 2019, SOUPS 2020, SOUPS 2021, SOUPS 2022, SOUPS 2023, SOUPS 2024, SOUPS 2025]
as the organisers put it
SOUPS brings together an interdisciplinary group of researchers and practitioners in human-computer interaction, security, and privacy.
| title | author | length |
|---|---|---|
| Passworld: A Serious Game to Promote Password Awareness and Diversity in an Enterprise | Gokul Chettoor Jayakrishnan, Gangadhara Reddy Sirigireddy, Sukanya Vaddepalli, Vijayanand Banahatti, Sachin Premsukh Lodha, Sankalp Suneel Pandit | 10m |
A serious game called Passworld game teaches concrete password heuristics (use of uppercase, digits, symbols, avoiding predictable patterns) and is deployed as… | ||
| “You still use the password after all” – Exploring FIDO2 Security Keys in a Small | Florian M. Farke, Lennart Lorenz, Theodor Schnitzler, Philipp Markert, Markus Dürmuth | 05m |
A small life‑science software company deploys FIDO2 security keys as an optional primary login method for 8 employees, 4 weeks, with data from server logs and… | ||
| Knock, Knock. Who’s There? On the Security of LG’s Knock Codes | Raina Samuel, Philipp Markert, Adam J. Aviv, Iulian Neamtiu | 13m |
Knock Codes on LG phones are studied with 351 mobile participants who create 1,138 codes and a derived blocklist of 30 codes; estimated deployment is… | ||
| An Empirical Study of Wireless Carrier Authentication for SIM Swaps | Kevin Lee, Benjamin Kaiser, Jonathan Mayer, Arvind Narayanan | 05m |
Study signs up at five prepaid carriers and repeatedly convinces customer service to transfer numbers by exploiting weak challenges: asking for the last… | ||
| Lessons Learnt from Comparing WhatsApp Privacy Concerns Across Saudi and Indian | Jayati Dev, Pablo Moriano, L Jean Camp | 05m |
Survey of n=674 WhatsApp users in Saudi Arabia and India finds clear differences: Saudis show significantly higher concern about being contacted by strangers… | ||
| Realizing Choice: Online Safeguards for Couples Adapting to Cognitive Challenges | Nora McDonald, Alison Larsen, Allison Battisti, Galina Madjaroff, Aaron Massey, Helena M. Mentis | 05m |
A prototype safety-settings interface is tested with seven couples (six remote, one in-home) who set controls for email, banking, passwords, shopping, and… | ||
| Blind and Human: Exploring More Usable Audio CAPTCHA Designs | Valerie Fanelle, Sepideh Karimi, Aditi Shah, Bharath Subramanian, Sauvik Das | 10m |
A three-session online study with 67 visually impaired participants (33 completed all sessions) creates 39 audio CAPTCHAs using Audacity, served via an… | ||
| Usable Sexurity: Studying People’s Concerns and Strategies When Sexting | Chris Geeng, Jevan Alexander Hutson, Franziska Roesner | 05m |
Survey of adults who have sexted (N=247) finds top concerns are sexts “getting out,” blackmail, receiving unsolicited nudes, device hacks, and… | ||
| Towards Understanding Privacy and Trust in Online Reporting of Sexual Assault | Borke Obada-Obieh, Lucrezia Spagnolo, Konstantin Beznosov | 14m |
Study analyzes interviews and focus groups with 35 participants (survivors and support workers) about online third‑party reporting apps (OTPRSs). Findings show… | ||
| Replication: On the Ecological Validity of Online Security Developer Studies | Anastasia Danilova, Alena Naiakshina, Johanna Deuter, Matthew Smith | 05m |
Replication hires 43 freelancers on Freelancer.com, asks them to implement password storage in JSF or Spring, scores submissions with a security scale, and… | ||
| An Ethnographic Understanding of Software (In)Security and a Co-Creation Model | Hernan Palombo, Armin Ziaie Tabari, Daniel Lende, Jay Ligatti, Xinming Ou | 15m |
1.5 years of participant observation inside a small network-access software company produces concrete findings: two embedded PhD researchers analyze code… | ||
| Why Can't Johnny Fix Vulnerabilities: A Usability Evaluation of Static Analysis Tools | Justin Smith, Lisa Nguyen Quang Do, Emerson Murphy-Hill | 05m |
Study evaluates four static analyzers including Find Security Bugs, RIPS and Flawfinder plus one commercial tool using heuristic walkthroughs and a follow-up… | ||
| Keynote: Maybe We Have Been Doing This Wrong?: Protester as Persona | Matt Mitchell | 21m |
Argues that privacy and security work routinely misses marginalized people and offers concrete fixes: runs CryptoHarlem workshops teaching operational… | ||
| Security, Availability, and Multiple Information Sources: Exploring Update Behavior | Christian Tiefenau, Maximilian Häring, Katharina Krombholz, Emanuel von Zezschwitz | 05m |
Mixed-method study maps a five-phase update process (information, decision, preparation, testing, post-install) and quantifies obstacles: a 67‑participant… | ||
| An investigation of phishing awareness and education over time: When and how to best | Benjamin Reinheimer, Lukas Aldag, Peter Mayer, Mattia Mossano, Reyhan Duezguen, Bettina Lofthouse, Tatiana von Landesberger, Melanie Volkamer | 05m |
A 12‑month field study with 409 voluntary participants drawn from a 2,200‑employee public agency shows an on‑site phishing tutorial improves detection for… | ||
| An Exploratory Study of Hardware Reverse Engineering — Technical and Cognitive Process | Steffen Becker, Carina Wiesen, Nils Albartus, Nikol Rummel, Christof Paar | 06m |
An exploratory behavioral study trains 22 students for 14 weeks then analyzes the top eight plus one expert on a realistic netlist task using logs, semi… | ||
| Industry Responses to the European Directive on Security of Network and Information | Ola Aleksandra Michalec, Dirk van der Linden, Sveta Milyaeva, Awais Rashid | 05m |
30 UK interviews map how Operational Technology security lacks shared norms and shows inconsistent expertise, arguing NIS risks becoming a tick box. The paper… | ||
| "You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and Management | Noura Alomar, Primal Wijesekera, Edward Qiu, Serge Egelman | 15m |
Researchers conduct 53 interviews with practitioners and report concrete findings: organizations treat bug bounty programs as replacements for internal testing… | ||
| User Mental Models of Cryptocurrency Systems - A Grounded Theory Approach | Alexandra Mai, Katharina Pfeffer, Matthias Gusenbauer, Edgar Weippl, Katharina Krombholz | 14m |
Qualitative study of N=29 users uses Grounded Theory to map two concrete mental models — an incomplete mental model (missing details) and an incorrect mental… | ||
| Cloudy with a Chance of Misconceptions: Exploring Users' Perceptions and Expectations | Dominik Wermke, Nicolas Huaman, Christian Stransky, Niklas Busch, Yasemin Acar, Sascha Fahl | 05m |
Survey of 200 cloud office users in the US and Germany using online panels (Amazon Mechanical Turk and Clickworker) measures perceptions of Google Docs and… | ||
| From Intent to Action: Nudging Users Towards Secure Mobile Payments | Peter Story, Daniel Smullen, Alessandro Acquisti, Lorrie Faith Cranor, Norman Sadeh, Florian Schaub | 15m |
Mixed-methods study tests two nudges — a protection motivation theory nudge and a combined PMT + implementation intention plan — with 20 interviews and a… | ||
| Do Privacy and Security Matter to Everyone? Quantifying and Clustering User-Centric | Natã M. Barbosa, Zhuohao Zhang, Yang Wang | 05m |
Online survey of 631 US participants quantifies what motivates and blocks smart‑home purchases: top motivators are convenience, ease of use, price/cost savings… | ||
| Enhancing Privacy through the Visual Design of Privacy Notices: Exploring the Interplay | Agnieszka Kitkowska, Mark Warner, Yefim Shulman, Erik Wästlund, Leonardo A. Martucci | 15m |
A 620-person online experiment tests visual tweaks: policy text stays constant while some versions add anthropomorphic comic framing and some add switches next… | ||
| "I Have a Narrow Thought Process": Constraints on Explanations Connecting Inferences | Emilee Rader, Samantha Hautea, Anjali Munasinghe | 05m |
Study measures how people link platform-derived traits to themselves and finds explanations hinge on memory and plausibility. Participants who actually saw… | ||
| Replication: Why We Still Can't Browse in Peace On the Uniqueness and Reidentifiability | Sarah Bird, Ilana Segall, Martin Lopatka | 06m |
Replication uses telemetry from 52,000 Firefox users over two weeks and 35 million site visits across ~660,000 domains and finds 48,919 distinct browsing… | ||
| How Risky Are Real Users' IFTTT Applets? | Camille Cobb, Milijana Surbatovich, Anna Kawakami, Mahmood Sharif, Lujo Bauer, Anupam Das, Limin Jia | 14m |
Study collects and analyzes 732 applets from 28 participants using a browser extension and surveys to add context beyond public IFTTT listings. An automated… | ||
| nothing matches | ||