SOUPS 2023
2023-08-06..2023-08-08
Anaheim, United States
SOUPS ·
[SOUPS 2019, SOUPS 2020, SOUPS 2021, SOUPS 2022, SOUPS 2023, SOUPS 2024, SOUPS 2025]
as the organisers put it
The Nineteenth Symposium on Usable Privacy and Security (SOUPS 2023), August 6–8, 2023, Anaheim, CA, USA.
who it's for
usable security researchers, privacy researchers, security engineers, product managers, company developers, security managers, accessibility researchers
topics
social virtual reality safety; hacktivist misinformation tactics; cybercrime reporting behaviors; email phishing indicators; sender origin indicators; threat analysis for SOCs; operational technology security culture; password expiry practices; password manager nudges; account recovery testing; tangible two-factor authentication; accessible crypto wallet design
| title | author | length |
|---|---|---|
| An Investigation of Teenager Experiences in Social Virtual Reality from Teenagers'... | Elmira Deldari, Diana Freed, Julio Poveda, Yaxing Yao | 12m |
24 interviews (8 teenagers, 7 parents, 9 bystanders) identify concrete safety threats: private rooms used to lure teens and host unmoderated adult content… | ||
| Fight Fire with Fire: Hacktivists' Take on Social Media Misinformation | Filipo Sharevski, Benjamin Kessell | 14m |
Researchers interview 22 prominent hacktivists and report concrete practices and preferences: none welcome the weaponization of trolling and memes, many… | ||
| "Stalking is immoral but not illegal": Understanding Security, Cyber Crimes... | Afaq Ashraf, Nida ul Habib Bajwa, Cornelius J. König, Mobin Javed, Maryam Mustafa | 14m |
Qualitative study with 34 semistructured interviews and a repertory-grid analysis with 18 participants maps how Pakistani young adults label cybercrimes… | ||
| Checking, nudging or scoring? Evaluating e-mail user security tools | Sarah Y. Zheng, Ingolf Becker | 16m |
Three tools are built and tested in a simulated Outlook web inbox: a Check button that verifies sender history, a collegial phishing report nudge, and a… | ||
| Understanding the Viability of Gmail's Origin Indicator for Identifying the Sender | Enze Liu, Lu Sun, Alex Bellon, Grant Ho, Geoffrey M. Voelker, Stefan Savage, Imani N. S. Munyaka | 12m |
Study uses an interactive survey with n=180 Gmail users to evaluate Gmail’s via indicator. The paper measures comprehension and behavior, finds 89% noticed the… | ||
| 'Give Me Structure': Synthesis and Evaluation of a (Network) Threat Analysis Process... | Leon Kersten, Tom Mulders, Emmanuele Zambon, Chris Snijders, Luca Allodi | 16m |
A four-stage, evidence-focused procedure maps ten detailed information points into four categories—relevance indicators, additional alerts, contextual… | ||
| Exploring the Security Culture of Operational Technology (OT) Organisations... | Stefanos Evripidou, Uchenna D Ani, Stephen Hailes, Jeremy D McK. Watson | 11m |
Thirty-three interviews across 25 UK OT organisations identify three concrete barriers to security culture: unclear governance and split IT/OT… | ||
| Lacking the Tools and Support to Fix Friction: Results from an Interview Study... | Jonas Hielscher, Markus Schöps, Uta Menges, Marco Gutfleisch, Mirko Helbling, M Angela Sasse | 13m |
Fourteen semi-structured interviews with CISOs and security consultants (about 20 years’ experience) find managers acknowledge security causes productivity… | ||
| What can central bank digital currency designers learn from asking potential users? | Svetlana Abramova, Rainer Böhme, Helmut Elsinger, Helmut Stix, Martin Summer | 13m |
A representative survey of 2006 Austrian residents using computer‑assisted telephone and web interviews measures preferences for a retail CBDC and finds only… | ||
| "Would You Give the Same Priority to the Bank and a Game? I Do Not!" | Sabrina Klivan, Sandra Höltervennhoff, Nicolas Huaman, Yasemin Acar, Sascha Fahl | 12m |
Mixed-method study reviews 14 popular managers and surveys 279 users surveyed, finding users mostly add credentials on access and treat managers as convenience… | ||
| Evolution of Password Expiry in Companies: Measuring the Adoption of Recommendations... | Eva Gerlitz, Maximilian Häring, Matthew Smith, Christian Tiefenau | 11m |
BSI removes password expiry from guidelines in 2020 and three follow‑up surveys (n = 52, 63, 80) measure company practice and show a clear shift: minimum… | ||
| Dissecting Nudges in Password Managers: Simple Defaults are Powerful | Samira Zibaei, Amirali Salehi-Abari, Julie Thorpe | 10m |
Large online study (n=853) simulates Safari’s UI on Chrome via a user‑agent header and six conditions on Mechanical Turk to measure randomly generated password… | ||
| Adventures in Recovery Land: Testing the Account Recovery of Popular Websites... | Eva Gerlitz, Maximilian Häring, Charlotte Theresa Mädler, Matthew Smith, Christian Tiefenau | 11m |
Study sets up 2FA on 78 services (SMS most common, Google Authenticator on 25, email/password about 10%) and then tries to log in after removing the second… | ||
| Tangible 2FA – An In-the-Wild Investigation of User-Defined Tangibles for Two-Factor... | Mark Turner, Martin Schmitz, Morgan Masichi Bierey, Mohamed Khamis, Karola Marky | 12m |
Researchers run a 226-participant online design survey to choose three prototypes — a wallet-fit credit-card shape, a keychain pendant and a small cube — then… | ||
| Prospects for Improving Password Selection | Joram Amador, Yiran Ma, Summer Hasama, Eshaan Lumba, Gloria Lee, Eleanor Birrell | 12m |
Using prospect theory to frame a weak initial password as a loss relative to a stronger choice and prompting users with a popup to return causes about 25–26%… | ||
| Look before you Link: Privacy Risk Inspection of Open Data through... | Kaustav Bhattacharjee | 04m |
A visual analytic workflow called pry clusters open datasets using weighted clustering, generates all pairwise joins (a small cluster of seven datasets yields… | ||
| Lessons Learned in Communicating Differential Privacy to Data Subjects | Mary Anne Smart | 06m |
Two empirical studies evaluate how explanations about differential privacy affect understanding and sharing decisions, comparing local vs central models (noise… | ||
| Decisions and Disruptions 2: Decide Harder | Joseph Hallett | 06m |
Two empirical studies test how people understand differential privacy, comparing local vs central noise models and probing explanations of the epsilon… | ||
| Getting the Message Out: Considering a Connected Products... | Michael Fagan, Ph.D. | 09m |
NIST proposes a connected‑products transparency framework that maps which audience needs what information and which mode fits best, from labels for consumers… | ||
| Weaponizing Technology: Examining the Importance of Privacy... | Sapna Khatri | 01h 02m |
Argues that Dobbs erased a constitutional floor and lets ordinary consumer traces—period apps, phone location, rental‑car and hotel bookings, Amazon orders… | ||
| Towards Usable Security Analysis Tools for Trigger-Action Programming | McKenna McCall, Eric Zeng, Faysal Hossain Shezan, Mitchell Yang, Lujo Bauer, Abhishek Bichhawat, Camille Cobb, Limin Jia, Yuan Tian | 14m |
Study evaluates usable security techniques for trigger-action programming by testing 447 Prolific users on writing declarative policies vs anti-patterns using… | ||
| Who Comes Up with this Stuff? Interviewing Authors to Understand How They Produce... | Lorenzo Neil, Harshini Sri Ramulu, Yasemin Acar, Bradley Reaves | 12m |
Semi-structured interviews with 21 authors reveal authors follow a gather-draft-review-publish loop, rely on 20 external sources but only four are common… | ||
| On the Recruitment of Company Developers for Security Studies... | Raphael Serafini, Marco Gutfleisch, Stefan Albert Horstmann, Alena Naiakshina | 12m |
Researchers conduct 30 semi-structured interviews with professional developers from German companies, each interview lasting 60 minutes and participants… | ||
| SoK: I Have the (Developer) Power! Sample Size Estimation for... | Anna-Marie Ortloff, Christian Tiefenau, Matthew Smith | 11m |
Meta-analysis of 54 papers (64 studies) extracts 467 tests, 413 variables and shows many developer-centered usable-security studies are underpowered: even the… | ||
| Towards a more effective system for training tier 1 SOC analysts | Leon Kersten | 05m |
Claims a concrete process that improves tier‑1 analysis and ships a prototype training tool built on Security Onion that auto‑fetches some fields, leaves… | ||
| TAM is not SAM: Acceptance of Security Technology | Ann-Marie Horcher | 04m |
TAM fails for security because perceived usefulness measures owner benefit, not whether people actually use or can use a control; replace it with actual ease… | ||
| Optimizing Shoulder-Surfing Resistance in Augmented and Virtual Reality | Naheem Noah | 06m |
A US replication studies a graphical recognition password called the T scheme that enrolls users with five random images and authenticates via five 16-image… | ||
| De-identification in practice: professionals as end users | Wentao Guo | 05m |
Deidentification often fails in practice: small sets of nonunique attributes can reidentify people, k-anonymity fails on realistic assumptions, and the US… | ||
| GuardLens: Supporting Safer Online Browsing for People with Visual Impairments | Smirity Kaushik, Natã M. Barbosa, Yaman Yu, Tanusree Sharma, Zachary Kilhoffer, JooYoung Seo, Sauvik Das, Yang Wang | 12m |
A browser extension called GuardLens extracts and lists privacy/security cues for people with visual impairments, built through an iterative user-centered… | ||
| Iterative Design of An Accessible Crypto Wallet for Blind Users | Zhixuan Zhou, Tanusree Sharma, Luke Emano, Sauvik Das, Yang Wang | 13m |
Study analyzes MetaMask accessibility then prototypes an inclusive wallet and tests it with 44 novices (23 blind, 20 sighted, 1 low vision). Finds unlabeled… | ||
| Youth understandings of online privacy and security: A dyadic study of children... | Olivia Williams, Yee-Yin Choong, Kerrianne Buchanan | 15m |
Forty parent–child dyads (children in 3rd–12th grade) complete questionnaires and semi‑structured Zoom interviews; analysis uses iterative coding. Youth across… | ||
| ImageAlly: A Human-AI Hybrid Approach to Support Blind People in Detecting... | Zhuohao (Jerry) Zhang, Smirity Kaushik, JooYoung Seo, Haolin Yuan, Sauvik Das, Leah Findlater, Danna Gurari, Abigale Stangl, Yang Wang | 09m |
ImageAlly is a tablet/phone app that uses a human-AI hybrid pipeline: an automated computer-vision screener flags potential private content, then users… | ||
| Evaluating the Impact of Community Oversight for Managing Mobile Privacy and Security | Mamtaj Akter, Madiha Tabassum, Nazmus Sakib Miazi, Leena Alghamdi, Jess Kropczynski, Pamela J. Wisniewski, Heather Richter Lipford | 12m |
Built a mobile tool called CO-oPS app and deploys it in a four-week field study with 101 participants across 22 communities to test community-based oversight… | ||
| Data Privacy and Pluralistic Ignorance | Emilee Rader | 14m |
An online survey experiment with 746 participants uses short vignettes (alarm, cookbook, location) and experimentally manipulates empirical and normative… | ||
| Distrust of big tech and a desire for privacy: Understanding the motivations... | Warda Usman, Jackie Hu, McKynlee Wilson, Daniel Zappala | 11m |
Semi-structured interviews with 20+ voluntary secure-email users reveal distrust of big tech and five distinct privacy models, yet only 5% of contacts… | ||
| "Is Reporting Worth the Sacrifice of Revealing What I've Sent?" | Leijie Wang, Ruotong Wang, Sterling Williams-Ceci, Sanketh Menda, Amy X. Zhang | 11m |
Interviews with 16 users of E2EE platforms reveal concrete tradeoffs: many know Signal won’t share message content while WhatsApp and Facebook Messenger… | ||
| Evaluating User Behavior in Smartphone Security: A Psychometric Perspective | Hsiao-Ying Huang, Soteris Demetriou, Muhammad Hassan, Güliz Seray Tuncay, Carl A. Gunter, Masooda Bashir | 10m |
Develops a 14-item SSBS from an initial 45-item pool via exploratory and confirmatory factor analysis, claims two independent components technical vs social… | ||
| Privacy Mental Models of Electronic Health Records: A German Case Study | Rebecca Panskus, Max Ninow, Sascha Fahl, Karola Marky | 10m |
Semi-structured 21 interviews with sketching reveal that Germany’s centralized EHR (introduced 2021) stores patient-controlled files on encrypted servers and… | ||
| "Nobody's Happy": Design Insights from Privacy-Conscious Smart Home Power Users... | Sunyup Park, Anna Lenhart, Michael Zimmer, Jessica Vitak | 13m |
32 privacy-conscious power users report constant tradeoffs: choosing HomeKit vs Amazon for privacy or capability, and using Pi-hole and Home… | ||
| Exploring the Usability, Security, and Privacy of Smart Locks from the Perspective... | Hussein Hazazi, Mohamed Shehab | 14m |
29 semi-structured interviews with users who had smart locks for at least two months find that two-thirds adopt for convenience while only five cite security… | ||
| "There will be less privacy, of course" How and why people in 10 countries expect AI... | Patrick Gage Kelley, Celestina Cornejo, Lisa Hayes, Ellie Shuo Jin, Aaron Sedley, Kurt Thomas, Yongwei Yang, Allison Woodruff | 15m |
Survey of 10,011 respondents across ten countries (data collected summer 2021, pre‑ChatGPT) finds about 49% less privacy, 22% more and 75% of open responses… | ||
| Investigating Security Indicators for Hyperlinking Within the Metaverse | Maximiliane Windl, Anna Scheidle, Ceenu George, Sven Mayer | 10m |
Eight expert interviews generate a design space and five prototype indicators (N=25 lab study) tested in a VR maze with four secure and four insecure portals… | ||
| nothing matches | ||