SOUPS 2022
2022-08-07..2022-08-09
Boston, United States
SOUPS ·
[SOUPS 2019, SOUPS 2020, SOUPS 2021, SOUPS 2022, SOUPS 2023, SOUPS 2024, SOUPS 2025]
as the organisers put it
The Eighteenth Symposium on Usable Privacy and Security (SOUPS 2022), August 7–9, 2022, Boston, MA, USA.
who it's for
usable privacy and security researchers, security practitioners, product designers, software developers, system administrators, iot researchers
topics
differential privacy metaphors; compromised credential notifications; anti-stalkerware detection limits; decentralized identity wallets (DIDs); password composition policy design; password manager nudging; Windows Hello authentication; trusted platform module library APIs; adversarial machine learning practices; online misinformation interventions; CAPTCHA-style human verification tasks; replication and external validity studies
| title | author | length |
|---|---|---|
| Replication: Stories as Informal Lessons about Security | Katharina Pfeffer, Alexandra Mai, Edgar Weippl, Emilee Rader, Katharina Krombholz | 09m |
Replication surveys n=299 confirm Rader et al. 2012 (n=301): story characteristics that drive learning are concrete action, autobiographical, and serious… | ||
| DualCheck: Exploiting Human Verification Tasks for Opportunistic Online Safety... | Ryo Yoshikawa, Hideya Ochiai, Koji Yatani | 10m |
DualCheck embeds 10 multiple-choice online-safety questions into a CAPTCHA-like flow and collects cursor behavior to run verification similarly to reCAPTCHA v2… | ||
| Understanding Non-Experts’ Security- and Privacy-Related Questions on a Q&A Site | Ayako A. Hasegawa, Naomi Yamashita, Tatsuya Mori, Daisuke Inoue, Mitsuaki Akiyama | 09m |
A thematic analysis of 445 question posts from Yahoo! Chiebukuro identifies seven themes, with cyberattacks the single largest topic and strong demand for help… | ||
| The Nerd Factor: The Potential of S&P Adepts to Serve as a Social Resource... | Nina Gerber, Karola Marky | 10m |
Thirteen semi‑structured interviews and three co‑design workshops with S&P adepts identify concrete limits and fixes: 13 interviews show almost everyone is… | ||
| "I don’t know why I check this...'' Investigating Expert Users' Strategies to Detect... | Peter Mayer, Damian Poddebniak, Konstantin Fischer, Marcus Brinkmann, Juraj Somorovsky, Angela Sasse, Sebastian Schinzel, Melanie Volkamer | 12m |
25 expert users inspect eight Thunderbird emails (four spoofed, four legitimate) using Enigmail/OpenPGP. Participants perform 23 different checks (mean 9.8… | ||
| Industrial practitioners' mental models of adversarial machine learning | Lukas Bieringer, Kathrin Grosse, Michael Backes, Battista Biggio, Katharina Krombholz | 14m |
Qualitative study of 15 interviews with European startup practitioners in 2020 uses semi-structured interviews plus a whiteboard drawing task and thematic… | ||
| Replication: The Effect of Differential Privacy Communication on German Users'... | Patrick Kühtreiber, Viktoriya Pak, Delphine Reinhardt | 09m |
Replication of Xiong et al. 2020 runs two online experiments with n ≈ 728 Germans and tests 11 wording variants of differential privacy; participants do not… | ||
| Comparing User Perceptions of Anti-Stalkerware Apps with the Technical Reality | Matthias Fassl, Simon Anell, Sabine Houy, Martina Lindorfer, Katharina Krombholz | 08m |
Study compares what users think anti‑stalkerware apps do with what two real apps actually do: review analysis, cognitive walkthroughs, and static + dynamic… | ||
| Users' Perceptions of Chrome Compromised Credential Notification | Yue Huang, Borke Obada-Obieh, Konstantin Beznosov | 10m |
Chrome alerts whenever a saved username/password pair matches a known breach and millions of users have received those notifications. Researchers analyze… | ||
| Exploring User-Suitable Metaphors for Differentially Private Data Analyses | Farzaneh Karegar, Ala Sarah Alaqra, Simone Fischer-Hübner | 11m |
Researchers generate metaphors for local and central differential privacy, evaluate them analytically and via 30 online interviews (10 per scenario), and find… | ||
| An Empirical Study of a Decentralized Identity Wallet... | Maina Korir, Simon Parkin, Paul Dunphy | 09m |
A lab-style user study uses a prototype wallet app with 30 online participants on Android (v10+) and combines contextual inquiry, semi-structured interviews, a… | ||
| Understanding and Reducing Online Misinformation Across 16 Countries... | David Rand | 41m |
A global experiment (16 countries, N = 33,480) shows people who score higher on analytic thinking and who care about accuracy or democracy reliably distinguish… | ||
| Informed Consent: Are your participants aware of what they share | Noreen Whysel | 05m |
A quick mini audit of common usability tools finds many test platforms share data with Google Facebook Amazon and Microsoft, plus dozens of downstream assets… | ||
| E-Commerce Payment Security Evaluation and Literature Review | Urvashi Kishnani | 05m |
A two-phase study combines a 90-paper review with a hands-on audit of 91 websites analyzed using the Privacy Check browser extension and CookieServe. Findings… | ||
| Moving Usable Security and Privacy Research Out of the Lab... | Florian Mathis | 07m |
Argues that virtual reality can move hardware-dependent usable security studies out of the lab by building replicated ATM environments where participants… | ||
| Usability and Security of Trusted Platform Module (TPM) Library APIs | Siddharth Prakash Rao, Gabriela Limonta, Janne Lindqvist | 15m |
A qualitative study (n=9 interviewed, 13 completed) analyzes developers using tpm2-tools and finds 18 thematic usability and security pitfalls: unhelpful error… | ||
| Increasing security without decreasing usability: A comparison of various verifiable... | Melanie Volkamer, Oksana Kulyk, Jonas Ludwig, Niklas Fuhrberg | 12m |
Extends a deployed verifiable voting system with QR-coded voting cards so voters scan voting codes instead of typing them, implements a mock-up and runs an… | ||
| Presenting Suspicious Details in User-Facing E-mail Headers Does Not Improve... | Sarah Y. Zheng, Ingolf Becker | 09m |
Between-subjects experiment shows a representative Prolific sample sees 32 legitimate and 8 phishing emails under three display conditions (full message… | ||
| Evaluating the Usability of Privacy Choice Mechanisms | Hana Habib, Lorrie Faith Cranor | 11m |
A practical framework defines seven aspects of privacy-choice usability and maps concrete evaluation methods — surveys, task-based user studies, and expert… | ||
| Detecting iPhone Security Compromise in Simulated Stalking Scenarios: Strategies and... | Andrea Gallardo, Hanseul Kim, Tianying Li, Lujo Bauer, Lorrie Faith Cranor | 10m |
Study runs 18 remote semi-structured interviews using four simulated iPhone compromise scenarios (location sharing, suspected spyware, iCloud compromise… | ||
| If You Can’t Get Them to the Lab: Evaluating a Virtual Study Environment with... | Nicolas Huaman, Alexander Krause, Dominik Wermke, Jan H. Klemmer, Christian Stransky, Yasemin Acar, Sascha Fahl | 10m |
OLab provides a browser-based virtual container with a full desktop and IDE, records source code plus events like copy/paste and mouse clicks, and uses… | ||
| Is it a concern or a preference? An investigation into the ability of privacy scales... | Jessica Colnago, Lorrie Faith Cranor, Alessandro Acquisti, Kate Hazel Stanton | 13m |
400 Prolific US participants each rate statements (each statement seen by ≥40 people) drawn from common privacy scales and 39 newly written items, and results… | ||
| On recruiting and retaining users for security-sensitive longitudinal measurement... | Akira Yamada, Kyle Crichton, Yukiko Sawaya, Jin-Dong Dong, Sarah Pearman, Ayumu Kubota, Nicolas Christin | 10m |
Three case studies compare recruitment and retention for instrumented panels: one uses monetary payments ($30 + $10/month), one uses a cartoon home‑screen… | ||
| Replication: How Well Do My Results Generalize Now? The External Validity of Online... | Jenny Tang, Eleanor Birrell, Ada Lerner | 11m |
Replication compares MTurk (n=800) and two Prolific samples (gender-balanced n=800, representative n=800) to Pew (n=4272) and finds MTurk raw quality has… | ||
| IoT Inspector: a platform for real-world smart home research | Danny Yuxing Huang | 05m |
IoT Inspector deploys from the cloud and turns smart devices into graphs and visualizations without installs or extra hardware, logging network endpoints… | ||
| Skilled or Gullible? Gender Stereotypes Related to Computer Security... | Miranda Wei | 05m |
A mixed-methods study uses a pre-study, affinity diagramming, and a main survey of crowd workers to map gendered security stereotypes: women are associated… | ||
| Aunties, Strangers, and the FBI: Online Privacy Concerns and Experiences of Muslim... | Tanisha Afnan, Yixin Zou, Maryam Mustafa, Mustafa Naseem, Florian Schaub | 12m |
21 semi-structured interviews with mostly young professionals (mean age ~28) find three concrete risk contexts: government surveillance, online Islamophobia… | ||
| An open door may tempt a saint: Examining situational and individual determinants... | Markus Langer, Rudolf Siegel, Michael Schilling, Tim Hunsicker, Cornelius J. König | 11m |
Three-phase experiment (N=95, 81 completed) uses a lab interview, covert at-home logging of clicks/entry time on emailed files, and a debrief to compare… | ||
| Investigating How University Students in the United States Encounter and Deal With... | K. J. Kevin Feng, Kevin Song, Kejing Li, Oishee Chakrabarti, Marshini Chetty | 14m |
Study reports 16 semi-structured interviews with U.S. university students and finds participants encounter misinformation multiple times a week in private… | ||
| Anti-Privacy and Anti-Security Advice on TikTok: Case Studies of Technology-Enabled... | Miranda Wei, Eric Zeng, Tadayoshi Kohno, Franziska Roesner | 12m |
Dataset of 98 TikToks (66 intimate-partner, 27 parent-child, 5 both) documents 24 techniques for partners and 7 for parents, totaling over 16 million likes… | ||
| “Fast, Easy, Convenient.” Studying Adoption and Perception of Digital Covid Certificates | Franziska Herbert, Marvin Kowalewski, Theodor Schnitzler, Leona Lassak, Markus Dürmuth | 10m |
Census-representative survey (n=800, Dec 2021, Germany) plus 30 street interviews and 80 verification observations report that 77% use app-based certificates… | ||
| "As soon as it's a risk, I want to require MFA": How Administrators Configure... | Philipp Markert, Theodor Schnitzler, Maximilian Golla, Markus Dürmuth | 13m |
Study has n=28 administrators who configure an Amazon Cognito–style RBA mockup and often pick conservative defaults: for low risk 9 allow and 19 choose some… | ||
| Let’s Hash: Helping Developers with Password Security | Lisa Geierhaas, Anna-Marie Ortloff, Matthew Smith, Alena Naiakshina | 09m |
Researchers build a small website that supplies ready-to-use authentication code and a guided wizard UI and run a between-subjects study with 179 freelance… | ||
| Exploring User Authentication with Windows Hello in a Small Business Environment | Florian M. Farke, Leona Lassak, Jannis Pinter, Markus Dürmuth | 13m |
A five-week deployment in a ~40-person small business studies 13 participants, measures authentication timings and UX scores, and finds Windows Hello is faster… | ||
| Improving Password Generation Through the Design of a Password Composition Policy... | Anuj Gautam, Shan Lalani, Scott Ruoti | 10m |
Designs a JSON-based password composition policy language that encodes 270 unique real-world PCPs (scraped from an initial 626 sites), adding features until… | ||
| Password policies of most top websites fail to follow best practices | Kevin Lee, Sten Sjöberg, Arvind Narayanan | 10m |
Analysis of 120 popular sites finds only 13% follow all relevant best practices and only 22 sites block most leaked passwords; 71 sites accept all 40 tested… | ||
| Do Password Managers Nudge Secure (Random) Passwords? | Samira Zibaei, Dinah Rinoa Malapaya, Benjamin Mercier, Amirali Salehi-Abari, Julie Thorpe | 10m |
Study of n = 558 web users compares Chrome, Firefox, and Safari browser nudges and finds Safari significantly more likely to produce an accepted random… | ||
| Let The Right One In: Attestation as a Usable CAPTCHA Alternative | Tara Whalen, Thibault Meunier, Mrudula Kodali, Alex Davidson, Marwan Fayed, Armando Faz-Hernández, Watson Ladd, Deepak Maram, Nick Sullivan, Benedikt Christoph Wolters, Maxime Guerreiro, Andrew Galloni | 11m |
The project implements a Cryptographic Attestation of Personhood built on the WebAuthn standard using commercial secure keys and phone biometrics to produce… | ||
| Being Hacked: Understanding Victims' Experiences of IoT Hacking | Asreen Rostami, Minna Vigren, Shahid Raza, Barry Brown | 11m |
Analysis of 210 self-reports from Reddit, device support forums and Amazon reviews catalogues specific incidents with light bulbs, smart locks, cameras… | ||
| Runtime Permissions for Privacy in Proactive Intelligent Assistants | Nathan Malkin, David Wagner, Serge Egelman | 11m |
A simulated proactive assistant implemented via Wizard of Oz listens continuously and requests runtime permissions every time it would use heard content; 23… | ||
| Normative and Non-Social Beliefs about Sensor Data: Implications for Collective... | Emilee Rader | 12m |
Qualitative interviews with 30 activity tracker users and 35 voice assistant users present six hypothetical scenarios and find mixed norms: strong privacy… | ||
| Sharing without Scaring: Enabling Smartphones to Become Aware of Temporary Sharing | Jiayi Chen, Urs Hengartner, Hassan Khan | 10m |
A prototype Android service called DSA detects handover gestures from motion sensors and uses behavioral-biometric in-place authentication to verify the owner… | ||
| Balancing Power Dynamics in Smart Homes: Nannies' Perspectives on How Cameras... | Julia Bernd, Ruba Abu-Salma, Junghyun Choy, Alisa Frik | 11m |
Twenty-five semi-structured interviews with nannies reveal which specifics matter: whether cameras are used for supervision versus incidental monitoring… | ||
| nothing matches | ||