SOUPS 2021
2021-08-08..2021-08-10
-- online --
SOUPS ·
[SOUPS 2019, SOUPS 2020, SOUPS 2021, SOUPS 2022, SOUPS 2023, SOUPS 2024, SOUPS 2025]
as the organisers put it
The Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021), August 8–10, 2021, Virtual Event.
| title | author | length |
|---|---|---|
| Towards Usable and Secure Location-based Smartphone Authentication | Geumhwan Cho, Sungsu Kwag, Jun Ho Huh, Bedeuro Kim, Choong-Hoon Lee, Hyoungshick Kim | 06m |
A fully functioning Android app runs in a three week field study with 29 participants and cuts manual unlock attempts by 36% reduction on average while 28… | ||
| Please do not use !?_ or your License Plate Number: Analyzing Password Policies in | Eva Gerlitz, Maximilian Häring, Matthew Smith | 05m |
Survey of 83 German companies collects employee-facing authentication methods and extracts 64 password composition policies; distribution via the BSI… | ||
| Using a Blocklist to Improve the Security of User Selection of Android Patterns | Collins W. Munyendo, Miles Grant, Philipp Markert, Timothy J. Forman, Adam J. Aviv | 05m |
SOUPS 2021 - Using a Blocklist to Improve the Security of User Selection of Android Patterns
Collins W. Munyendo and Miles Grant, The George Washington… | ||
| User Perceptions of the Usability and Security of Smartphones as FIDO2 Roaming | Kentrell Owens, Olabode Anise, Amanda Krauss, Blase Ur | 05m |
A 97-participant between-subjects study tests a smartphone-based FIDO2 roaming prototype called Neo prototype against traditional passwords for a fictitious… | ||
| Never Ever or No Matter What: Investigating Adoption Intentions and Misconceptions | Maximilian Häring, Eva Gerlitz, Christian Tiefenau, Matthew Smith, Dominik Wermke, Sascha Fahl, Yasemin Acar | 05m |
A quota sample of n=744 German residents reports how well people understand the Corona‑Warn‑App and what drives adoption: many respondents do not know the app… | ||
| Understanding Users' Knowledge about the Privacy and Security of Browser Extensions | Ankit Kariryaa, Gian-Luca Savino, Carolin Stellmacher, Johannes Schöning | 05m |
Online survey with 353 participants measures attitudes, knowledge and preferences about browser-extension permissions and finds concrete gaps: users express… | ||
| Replication: Effects of Media on the Mental Models of Technical Users | Khadija Baig, Elisa Kazan, Kalpana Hundlani, Sana Maqsood, Sonia Chiasson | 05m |
Study of 23 technical participants uses interviews, a questionnaire, and six video clips analyzed via inductive thematic analysis to test how media shapes… | ||
| Comparing Security and Privacy Attitudes Among U.S. Users of Different Smartphone and | Desiree Abrokwa, Shruti Das, Omer Akgul, Michelle L. Mazurek | 05m |
Survey of U.S. smartphone and smart‑speaker users (n=493 via Prolific on Qualtrics) compares validated scales IUIPC-8 and SA-6 plus Pew knowledge and… | ||
| Keynote Address: Mitigating Technology Abuse in Intimate Partner Violence | Thomas Ristenpart | 58m |
Research group combines interviews (50 professionals, large survivor focus groups) with online measurements and tool analysis to show most abuse uses shared… | ||
| "How I Know For Sure": People's Perspectives on Solely Automated Decision-Making (SADM) | Smirity Kaushik, Yaxing Yao, Pierre Dewitte, Yang Wang | 05m |
Online survey with 392 participants (192 US, 200 UK) finds widespread misunderstandings of GDPR SADM rights, including beliefs they can opt out or choose a… | ||
| A Fait Accompli? An Empirical Study into the Absence of Consent to Third-Party Tracking | Konrad Kollnig, Reuben Binns, Pierre Dewitte, Max Van Kleek, Ge Wang, Daniel Omeiza, Helena Webb, Nigel Shadbolt | 05m |
A representative sample from Google Play is analysed with network traffic monitoring to measure real behaviour rather than policies: 1,300 apps are opened and… | ||
| "Whether it's moral is a whole other story": Consumer perspectives on privacy | Leah Zhang-Kennedy, Sonia Chiasson | 04m |
Online study uses 300 survey respondents and 32 follow-up interviews plus 10 real-case scenarios from the Office of the Privacy Commissioner of Canada… | ||
| Pursuing Usable and Useful Data Downloads Under GDPR/CCPA Access Rights via Co-Design | Sophie Veys, Daniel Serrano, Madison Stamos, Margot Herman, Nathan Reitinger, Michelle L. Mazurek, Blase Ur | 05m |
Data downloads from six companies arrive as sprawling JSON/CSV/HTML archives—one example is an 11-file Spotify folder and some are many gigabytes—and current… | ||
| Facial Recognition: Understanding Privacy Concerns and Attitudes Across Increasingly | Shikun Zhang, Yuanyuan Feng, Norman Sadeh | 06m |
Study uses an Android app to run a 10-day experience sampling with 123 participants, sending location-triggered prompts plus evening surveys, yielding ~3,800… | ||
| "I'm Literally Just Hoping This Will Work:'' Obstacles Blocking the Online Security | Daniela Napoli, Khadija Baig, Sana Maqsood, Sonia Chiasson | 05m |
Study observes users with visual disabilities as they navigate Gmail, Amazon, CNIB phishing site, and conducts semi‑structured interviews to probe real‑world… | ||
| WebAlly: Making Visual Task-based CAPTCHAs Transferable for People with Visual | Zhuohao Zhang, Zhilin Zhang, Haolin Yuan, Natã M. Barbosa, Sauvik Das, Yang Wang | 05m |
WebAlly is a prototype that lets people with visual impairments transfer task-based visual CAPTCHAs to a remote helper via an interactive screenshot limited… | ||
| Designing Toxic Content Classification for a Diversity of Perspectives | Deepak Kumar, Patrick Gage Kelley, Sunny Consolvo, Joshua Mason, Elie Bursztein, Zakir Durumeric, Kurt Thomas, Michael Bailey | 05m |
A survey of 17,280 participants produces about 108,000 labels showing people who are LGBTQ+, young, or previously targeted mark more comments as toxic while… | ||
| Why They Ignore English Emails: The Challenges of Non-Native Speakers in Identifying | Ayako A. Hasegawa, Naomi Yamashita, Mitsuaki Akiyama, Tatsuya Mori | 05m |
An online survey with 862 participants (284 Germans, 276 South Koreans, 302 Japanese) compares responses to native‑language and English emails and finds… | ||
| SoK: Still Plenty of Phish in the Sea — A Taxonomy of User-Oriented Phishing | Anjuli Franz, Verena Zimmermann, Gregor Albrecht, Katrin Hartwig, Christian Reuter, Alexander Benlian, Joachim Vogt | 06m |
Systematic review of 64 papers (from >2,000 hits) produces a taxonomy of four intervention types and ten subcategories — education, hands‑on training (includes… | ||
| Investigating Web Service Account Remediation Advice | Lorenzo Neil, Elijah Bouma-Sims, Evan Lafontaine, Yasemin Acar, Bradley Reaves | 06m |
Defines a five-phase model (compromise discovery, account recovery, limiting access, service restoration, prevention) and builds a codebook to manually code… | ||
| Knowledge and Capabilities that Non-Expert Users Bring to Phishing Detection | Rick Wash, Norbert Nthala, Emilee Rader | 05m |
Survey of a demographically matched U.S. sample of 297 non-expert email users measures how many perform each of six expert-derived phishing checks and finds… | ||
| Code Reviewing as Methodology for Online Security Studies with Developers - A Case | Anastasia Danilova, Alena Naiakshina, Anna Rasgauski, Matthew Smith | 05m |
Online study asks freelancers to review Java password-storage snippets instead of writing code, with 44 freelancers from Fiverr split into prompted vs… | ||
| "I have no idea what they're trying to accomplish:" Enthusiastic and Casual Signal | Daniel V. Bailey, Philipp Markert, Adam J. Aviv | 06m |
Online study with n = 235 Signal users finds 56% enthusiasts who correctly say the PIN derives an encryption key for cloud backups and is hashed as an extra… | ||
| On the Limited Impact of Visualizing Encryption: Perceptions of E2E Messaging Security | Christian Stransky, Dominik Wermke, Johanna Schrader, Nicolas Huaman, Yasemin Acar, Anna Lena Fehlhaber, Miranda Wei, Blase Ur, Sascha Fahl | 05m |
Five online studies with 683 participants (MTurk then Prolific) test WhatsApp-style screencasts and a renamed app "Erebus" to see if making E2E visible changes… | ||
| Concerned but Ineffective: User Perceptions, Methods, and Challenges when Sanitizing | Jason Ceci, Hassan Khan, Urs Hengartner, Daniel Vogel | 05m |
Survey of n=131 and follow-up n=35 interviews shows 73% of people keep at least one old device and among devices actually disposed 25% use insecure erasure… | ||
| Exploring Authentication for Security-Sensitive Tasks on Smart Home Voice Assistants | Alexander Ponticello, Matthias Fassl, Katharina Krombholz | 05m |
Conducts semi-structured interviews with N=16 interviews of Alexa users and probes four high-risk scenarios, analyzed with a synoptic thematic approach; finds… | ||
| "The Thing Doesn't Have a Name": Learning from Emergent Real-World Interventions in | Brennen Bouwmeester, Elsa Rebeca Turcios Rodríguez, Carlos H. Gañán, Michel van Eeten, Simon Parkin | 06m |
Coordinating with an ISP and using network data to match a Mirai scan signature, researchers run remote think-aloud observations with 17 customers asked to… | ||
| Evaluating and Redefining Smartphone Permissions with Contextualized Justifications for | David Harborth, Alisa Frik | 06m |
Two online between-subject surveys with 581 participants use a hypothetical furniture MAR app and three permission labels (bare label, generic purpose text… | ||
| PowerCut and Obfuscator: An Exploration of the Design Space for Privacy-Preserving | Varun Chandrasekaran, Suman Banerjee, Bilge Mutlu, Kassem Fawaz | 05m |
Prototypes test two concrete defenses: PowerCut (remote-controlled outlet that severs power) and Obfuscator (ultrasound emitter that drowns voice commands at… | ||
| A Qualitative Usability Evaluation of the Clang Static Analyzer and libFuzzer with CS | Stephan Plöger, Mischa Meier, Matthew Smith | 05m |
A mixed factorial qualitative study evaluates Clang Static Analyzer and libFuzzer with 32 CS master students and 6 competitive CTF players, using hands‑on… | ||
| Deciding on Personalized Ads: Nudging Developers About User Privacy | Mohammad Tahaei, Alisa Frik, Kami Vaniea | 05m |
An online between-subjects survey experiment with 400 developers tests six dashboard framings (Control, CCPA-like, GDPR-like, user-facing description… | ||
| Benefits and Drawbacks of Adopting a Secure Programming Language: Rust as a Case Study | Kelsey R. Fulton, Anna Chan, Daniel Votipka, Michael Hicks, Michelle L. Mazurek | 05m |
Study interviews 16 professional developers and surveys 178 Rust community members n = 16 n = 178 and reports concrete tradeoffs: Rust delivers good compiler… | ||
| An Analysis of the Role of Situated Learning in Starting a Security Culture in a | Anwesh Tuladhar, Daniel Lende, Jay Ligatti, Xinming Ou | 05m |
Ethnographic participant observation over eight months inside a five‑engineer agile team shows management mandate plus a co‑located security expert turn… | ||
| Examining the Examiners: Students' Privacy and Security Perceptions of Online | (no speakers) | 05m |
Paper analyzes extension reviews and privacy policies then surveys n=102 students about concrete proctoring tools, finding 64% report monitoring as stressful… | ||
| Virtual Classrooms and Real Harms: Remote Learning at U.S. Universities | Shaanan Cohney, Ross Teixeira, Anne Kohlbrenner, Arvind Narayanan, Mihir Kshirsagar, Yan Shvartzshnaider, Madelyn Sanfilippo | 05m |
Surveyed 49 educators and 14 administrators, develops a concrete threat model of students, instructors, administrators, platforms and third parties, and offers… | ||
| Challenges and Threats of Mass Telecommuting: A Qualitative Study of Workers | Borke Obada-Obieh, Yue Huang, Konstantin Beznosov | 05m |
Study reports results from 24 semi-structured interviews with workers and finds concrete security and privacy problems during mass telecommuting: four… | ||
| Understanding Privacy Attitudes and Concerns Towards Remote Communications During the | Pardis Emami-Naeini, Tiona Francisco, Tadayoshi Kohno, Franziska Roesner | 05m |
Online survey of 220 Prolific participants in May 2020 explores attitudes toward conferencing tools, remote modes (microphone/webcam) and meeting locations… | ||
| Proposing the ‘Signature’ Auth Scheme: More Usable AND Secure Than Status Quo | Ben Towne | 02m |
Proposes replacing password hashing with request-level digital signatures so the browser extension signs each HTTP request using 256-bit private keys and the… | ||
| Decision-Making Errors in Mobile Phishing | Rasha Ibrahim | 03m |
Decision-Making Errors in Mobile Phishing
Rasha Ibrahim, Newcastle University
View the full SOUPS 2021 program at… | ||
| Solitude: A privacy analysis tool | Dan Hastings | 03m |
An open source privacy analysis tool called solitude inspects mobile and web apps by matching configured and built‑in search strings to outgoing traffic. A… | ||
| Trust by design: a new old requirement | Ana Ferreira | 02m |
Current security measures are insufficient and the pandemic exacerbated existing attacks rather than creating new ones, revealing persistent vulnerabilities… | ||
| Gallery of Latin American Malware | Sofia Celi | 02m |
A web application recreates real targeted malware incidents against Latin American women’s-rights activists as a visual and audio gallery, using actual attack… | ||
| nothing matches | ||