SOUPS 2024
2024-08-11..2024-08-13
Philadelphia, United States
SOUPS ·
[SOUPS 2019, SOUPS 2020, SOUPS 2021, SOUPS 2022, SOUPS 2023, SOUPS 2024, SOUPS 2025]
as the organisers put it
The Twentieth Symposium on Usable Privacy and Security (SOUPS 2024), August 11–13, 2024, Philadelphia, PA, USA.
who it's for
privacy and security researchers, software developers, data practitioners, security analysts, product managers, ux designers, community moderators
topics
Python differential privacy tools; autonomy levels for augmented intelligence; malware evasion techniques; secure development study methods; password sharing practices; app privacy label usability; access review choice defaults; smart home device privacy; non-consensual image disclosure regulation; deepfake and disinformation trends; authentication for smart glasses; developer privacy practices
| title | author | length |
|---|---|---|
| A Survey of Cybersecurity Professionals’ Perceptions and Experiences of Safety and | Samantha Katcher, Liana Wang, Caroline Yang, Chloe Messdaghi, Michelle L. Mazurek, Marshini Chetty, Kelsey R. Fulton, Daniel Votipka | 12m |
An online survey of 342 respondents with a mean of 7.5 years in security finds overall low psychological safety (mean 65.5 psychological safety score, bottom… | ||
| Evaluating the Usability of Differential Privacy Tools with Data Practitioners | Ivoline C. Ngong, Brad Stenger, Joseph P. Near, Yuanyuan Feng | 13m |
Usability study tests four Python DP tools (DiffPrivLib, Tumult Analytics, PipelineDP, OpenDP) with 24 US data practitioners (12 novices, 12 experts) on count… | ||
| Navigating Autonomy: Unveiling Security Experts' Perspectives on Augmented Intelligence | Neele Roch, Hannah Sievers, Lorin Schöni, Verena Zimmermann | 11m |
Grounded theory analysis of 27 in-depth interviews reveals a concrete decision framework: experts assign planning, strategy and uncertain decision‑making to… | ||
| Comparing Malware Evasion Theory with Practice: Results from Interviews with Expert | Miuyin Yong Wong, Matthew Landen, Frank Li, Fabian Monrose, Mustaque Ahamad | 13m |
Interviews with 24 expert analysts across 15 companies show obfuscation is the hardest evasion, followed by anti-disassembly and anti-debugger, while… | ||
| Write, Read, or Fix? Exploring Alternative Methods for Secure Development Studies | Kelsey R. Fulton, Joseph Lewis, Nathan Malkin, Michelle L. Mazurek | 13m |
Remote study with 112 Python programmers compares three methods—write, read, fix—on two short encryption tasks using assigned libraries and a browser-based… | ||
| Evaluating Privacy Perceptions, Experience, and Behavior of Software Development Teams | Maxwell Prybylo, Sara Haghighi, Sai Teja Peddinti, Sepideh Ghanavati | 10m |
Mixed-method survey with 362 participants across 23 countries measures concrete gaps: 15 annotated definitions of privacy, information security staff report… | ||
| Privacy Communication Patterns for Domestic Robots | Maximiliane Windl, Jan Leusmann, Albrecht Schmidt, Sebastian S. Feger, Sven Mayer | 13m |
Survey experiments show privacy concerns rise with greater locomotion and interaction capabilities (online survey N = 90), then three focus groups generate 86… | ||
| Privacy Requirements and Realities of Digital Public Goods | Geetika Gopi, Aadyaa Maddi, Omkhar Arasaratnam, Giulia Fanti | 12m |
A systematic analysis of about 100 registered DPGs finds over 50% submit no supporting documentation and only ~16% submit security or privacy documents, using… | ||
| Well-intended but half-hearted: Hosts’ consideration of guests’ privacy using smart | Sunyup Park, Weijia He, Elmira Deldari, Pardis Emami-Naeini, Danny Yuxing Huang, Jessica Vitak, Yaxing Yao, Michael Zimmer | 12m |
Interviews with 15 hosts reveal concrete practices: smart cameras and speakers appear in living rooms, hallways, yards; many hosts use shared accounts with… | ||
| Batman Hacked My Password: A Subtitle-Based Analysis of Password Depiction in Movies | Maike M. Raphael, Aikaterini Kanta, Rico Seebonn, Markus Dürmuth, Camille Cobb | 12m |
Subtitle scan of 97,709 movies and manual review of scenes from 2,851 films finds 5,982 occurrences of “password”; password managers appear in one film and MFA… | ||
| Understanding How People Share Passwords | Phoebe Moh, Andrew Yang, Nathan Malkin, Michelle L. Mazurek | 10m |
Survey of a US census‑representative sample n = 300 finds streaming accounts dominate (over 90% streaming accounts), median participant shares three accounts… | ||
| Digital Nudges for Access Reviews: Guiding Deciders to Revoke Excessive Authorizations | Thomas Baumer, Tobias Reittinger, Sascha Kern, Günther Pernul | 12m |
Formalizes access reviews with confusion metrics, runs expert interviews (n=10) to pick candidate nudges, and implements a Choice Defaults Nudge in a… | ||
| Can Johnny be a whistleblower? A qualitative user study of a social authentication | Maximilian Häring, Julia Angelika Grohs, Eva Tiefenau, Matthew Smith, Christian Tiefenau | 12m |
Implements a SOAP social authentication wizard inside a modified Signal extension and runs a one‑hour lab study where participants play whistleblowers… | ||
| Evolving Landscape of Disinformation - Lessons Learned So Far! | Saqib Hakak | 05m |
Existing fake‑news detectors perform well on English but fail on low‑resource languages like Urdu, Hindi and Arabic; a prototype Arabic and English prototype… | ||
| From Laughter to Concern: Exploring Conversations about Deepfakes on Reddit - Trends | Harshitha B. Nagaraj, Rahul G. K. Kiran | 06m |
Reddit posts collected via the Pro API reveal that average people detect deepfakes with only 62% accuracy, scams using deepfakes account for 90% of mobile… | ||
| Media Portrayals of Student Privacy in Higher Education: A 2013-2023 Review | Min Cheong Kim | 05m |
Content analysis of 151 ProQuest and top-circulation newspaper articles from 2013–2023 shows that new tools—learning analytics, e‑text monitoring, proctoring… | ||
| Authentication UX Design Opportunities for Future Smart Glasses | Jocelyn Rosenberg | 05m |
Design work focuses on authenticating smart glasses using only built‑in inputs: a side touchpad on frames and gesture signals via a paired watch, avoiding… | ||
| Cybersecurity Analysts' Perception of AI Security Tools and Practical Implications | Siddharth Hirwani, John Robertson | 07m |
Researchers conduct nine qualitative interviews with early to midcareer SOC analysts and report that ChatGPT experimentation shifts willingness to use AI but… | ||
| 'Custodian of Online Communities': How Moderator Mutual Support in Communities Help | Madiha Tabassum, Alana Mackey, Ada Lerner | 13m |
Qualitative analysis samples 115 threads from 3,321 hate-and-harassment posts on r/ModSupport and r/modhelp and links platform scale (uploader reports 1672… | ||
| Designing the Informing Process with Streamers and Bystanders in Live Streaming | Yanlai Wu, Xinning Gui, Yuhan Luo, Yao Li | 12m |
Design ideation with 21 participants uncovers a bilateral informing loop: streamers must signal live status and bystanders must convey privacy preferences. Key… | ||
| "I can say I'm John Travolta...but I'm not John Travolta": Investigating the Impact of | Carson Powers, Nickolas Gravel, Christopher Pellegrini, Micah Sherr, Michelle L. Mazurek, Daniel Votipka | 12m |
A U.S. Census-representative survey tests how changes to verification affect credibility, using randomized Twitter- and Facebook-style posts and eight mock… | ||
| "Violation of my body:" Perceptions of AI-generated non-consensual (intimate) imagery | Natalie Grace Brigham, Miranda Wei, Tadayoshi Kohno, Elissa M. Redmiles | 11m |
Survey of 315 U.S. respondents conducted on Prolific (Dec 2023) tests acceptability of AI-generated non-consensual intimate imagery across scenarios that vary… | ||
| Human-in-the-Loop for Secure Digital Wallets Transactions | Raja Hasnain Anwar | 06m |
Study of tokenization shows wallets like Google Pay and Apple Pay control authentication and banks accept that delegation, enabling attackers to add stolen… | ||
| Best Practices for Engaging Industry Researchers | Eun-Jeong Shin, Janice Tsai | 06m |
External researchers in 2021 report a privacy flaw in a COVID exposure notification app that lets preinstalled apps read sensitive logs, and a 2023 USENIX… | ||
| Beyond the West: Exploring the Impact and Regulation of Non-Consensual Image-Disclosure | Amna Batool | 06m |
Study of NCIDA in Pakistan uses interviews with law enforcement and an NGO plus 240 hours of participatory observation across 70 cases and finds a much lower… | ||
| The Golden xCOMPASS: The Compass You Need to Navigate through the App-Privacy Universe! | Rahmadi Trimananda | 05m |
A web-hosted tool named xCOMPASS provides an immediate, questionnaire-driven assessment that maps developer answers to specific privacy requirements and legal… | ||
| SecureCheck: Access Contracts, Negotiations, and Recommendations for Data-Sharing | Jacob Hopkins | 05m |
System mediates ID checks by turning verifier demands and user preferences into access mediation contracts that list exact fields and permitted uses, compares… | ||
| What Drives SMiShing Susceptibility? A U.S. Interview Study of How and Why Mobile Phone | Sarah Tabassum, Cori Faklaris, Heather Richter Lipford | 13m |
29 interviews in Charlotte reveal that people judge SMS by content, format, links, and personalization not by short codes or numbers; participants see links… | ||
| "I would not install an app with this label": Privacy Label Impact on Risk Perception | David G. Balash, Mir Masood Ali, Chris Kanich, Adam J. Aviv | 15m |
Replicating prior methods on Prolific in January 2023 with n=1,505 participants, the study measures how iOS privacy labels change perceived risk and install… | ||
| "Say I'm in public...I don't want my nudes to pop up." User Threat Models for Using | Chris Geeng, Natalie Chen, Kieron Ivy Turk, Jevan Alexander Hutson, Damon McCoy | 12m |
Interviews with N=18 U.S. adult users show vault apps (iOS hidden album, Google Photos locked folder, Snapchat My Eyes Only and standalone disguised… | ||
| “I do (not) need that Feature!” – Understanding Users’ Awareness and Control of Privacy | Sarah Prange, Pascal Knierim, Gabriel Knoll, Felix Dietz, Alexander De Luca, Florian Alt | 14m |
A two‑week field study deploys a custom Android app to 132 participants to scan installed apps every two hours, push experience‑sampling prompts, and log 2,866… | ||
| Threat modeling state of practice in Dutch organizations | Stef Verreydt, Koen Yskout, Laurens Sion, Wouter Joosen | 11m |
Semi-structured study of 13 interviews across 7 large Dutch organizations finds threat modeling used both to uncover vulnerabilities and—more often—to raise… | ||
| What Motivates and Discourages Employees in Phishing Interventions: An Exploration of | Xiaowei Chen, Sophie Doublet, Anastasia Sergeeva, Gabriele Lenzini, Vincent Koenig, Verena Distler | 12m |
Study applies Expectancy-Value Theory to seven focus groups and finds concrete drivers and blockers: 7 focus groups with 34 employees at a European university… | ||
| Beyond the Office Walls: Understanding Security and Shadow Security Behaviours in a | Sarah Alromaih, Ivan Flechais, George Chalhoub | 11m |
Qualitative study interviews 20 remote workers using constructivist grounded theory and semi structured interviews and produces 27 codes organized into four… | ||
| Who is the IT Department Anyway: An Evaluative Case Study of Shadow IT Mindsets Among | Jan-Philip van Acken, Floris Jansen, Slinger Jansen, Katsiaryna Labunets | 12m |
Mixed-methods research uses 450 survey responses and 32 follow-up interviews to classify shadow IT as unapproved cloud accounts (eg private Dropbox), self-made… | ||
| Of Mothers and Managers – The Effect of Videos Depicting Gender Stereotypes on Women | Nina Gerber, Alina Stöver, Peter Mayer | 10m |
An online between‑subjects experiment with 933 participants recruited on Prolific shows little broad stereotype threat from commercial videos but two notable… | ||
| Towards Bridging the Research-Practice Gap: Understanding Researcher-Practitioner | Julie M. Haney, Clyburn Cunningham IV, Susanne M. Furman | 12m |
Survey of 133 HCC researchers finds >90% believe practitioners could use their work, yet engagement concentrates at the start and end of the research life… | ||
| Comparing Teacher and Creator Perspectives on the Design of Cybersecurity and Privacy | Joy McLeod, Leah Zhang-Kennedy, Elizabeth Stobert | 13m |
Qualitative interviews with 15 middle school teachers and 8 creators show a clear mismatch: teachers predominantly use free, low‑tech, modular and modifiable… | ||
| Negative Effects of Social Triggers on User Security and Privacy Behaviors | Lachlan Moore, Tatsuya Mori, Ayako A. Hasegawa | 13m |
Online survey (Qualtrics, 417 Prolific responses) asks about six risky behaviors: public Wi‑Fi with sensitive exchanges, password reuse, illegal downloading… | ||
| Beyond Fear and Frustration - Towards a Holistic Understanding of Emotions in | Alexandra von Preuschen, Monika C. Schuhmacher, Verena Zimmermann | 14m |
Qualitative survey (N = 112) plus semi-structured interviews (N = 26) map a wide palette of simultaneous, even conflicting cybersecurity emotions and classify… | ||
| Exploring Expandable-Grid Designs to Make iOS App Privacy Labels More Usable | Shikun Zhang, Lily Klucinec, Kyerra Norton, Norman Sadeh, Lorrie Faith Cranor | 14m |
A color‑coded, expandable grid replaces iOS privacy labels, implemented as interactive web pages with JavaScript logging and tested with 200 Prolific iPhone… | ||
| Reflecting on Twenty Years of Usable Privacy and Security | Patrick Gage Kelley, Lorrie Faith Cranor, Simson Garfinkel, Robert Biddle, Mary Ellen Zurko, Katharina Krombholz | 43m |
Community builds a usable-security discipline, compiles a 90-page literature review turned book, and extracts concrete lessons: browser security warnings… | ||
| How Entertainment Journalists Manage Online Hate and Harassment | Noel Warford, Nicholas Farber, Michelle L. Mazurek | 11m |
Nine interviews with entertainment journalists show harassment as an inevitable, escalating risk rooted in GamerGate-era patterns, ranging from insults and… | ||
| "It was honestly just gambling": Investigating the Experiences of Teenage | Elijah Bouma-Sims, Hiba Hassan, Alexandra Nisenoff, Lorrie Faith Cranor, Nicolas Christin | 11m |
Multi-stage inductive content analysis of 1,676 Reddit posts identifies 1,409 posts (84%) meaningfully about crypto, with discussions peaking in 2021–22 after… | ||
| nothing matches | ||