SOUPS 2025
2025-08-10..2025-08-12
Seattle, United States
SOUPS ·
[SOUPS 2019, SOUPS 2020, SOUPS 2021, SOUPS 2022, SOUPS 2023, SOUPS 2024, SOUPS 2025]
as the organisers put it
The Twenty-First Symposium on Usable Privacy and Security (SOUPS 2025), August 10–12, 2025, Seattle, WA, USA.
who it's for
usable privacy researchers, hci researchers, security researchers, security engineers, product managers for privacy and security, policymakers and regulators
topics
Pasifika phishing susceptibility; LLMs for incident response; seccomp sandboxing usability; LLM-based SMS phishing detection; scam discourse on Reddit; cultural privacy in smart spaces; differential privacy deployment experiences; app privacy label comprehension; authentication standards in higher education; generative AI risks for youth; privacy-preserving mobile agent protocols; AI adoption in industrial control systems
| title | author | length |
|---|---|---|
| Language as Lure: A Naturalistic Study on Pasifika Phishing Susceptibility | Eric Spero, Isa Seow, Lucas Betts, Eddie Fuatimau, Robert Biddle, Danielle M. Lottridge, Giovanni Russello | 12m |
A four‑month simulated phishing campaign sends monthly emails to 2,000 participants in a Melanesian government; open rates average about 7–10% and 14.5%… | ||
| Integrating Large Language Models into Security Incident Response | Diana Kramer, Lambert Rosique, Ajay Narotam, Elie Bursztein, Patrick Gage Kelley, Kurt Thomas, Allison Woodruff | 13m |
Study evaluates LLMs on 50 real incidents with 18 security analysts and finds LLMs omit critical details in 35% of cases and inject factual errors in 42%, so… | ||
| Playing in the Sandbox: A Study on the Usability of Seccomp | Maysara Alhindi, Joseph Hallett | 11m |
Study recruits 7 experienced Seccomp developers after six months of hunting and asks them to sandbox a small app; 6 of 7 produce working sandboxes using… | ||
| Can You Walk Me Through It? Explainable SMS Phishing Detection using LLM-based Agents | Yizhu Wang, Haoyu Zhai, Chenkai Wang, Qingying Hao, Nick A. Cohen, Roopa Foulger, Jonathan A. Handler, Gang Wang | 12m |
SmishX claims 98.8% accuracy on 1,200 real SMS messages and reports an SUS of 82.6, using LLM agents that augment chain-of-thought with URL redirect chains… | ||
| Victims, Vigilantes, and Advice Givers: An Analysis of Scam-Related Discourse on Reddit | Rajvardhan Oak, Zubair Shafiq | 11m |
Qualitative analysis of Reddit scam threads uses pushshift data and open coding on n=2435 posts to map concrete scam types—pig butchering, SIM swapping… | ||
| "We are not Future-ready": Understanding AI Privacy Risks and Existing Mitigation... | Alexandra Klymenko, Stephen Meisenbacher, Patrick Gage Kelley, Sai Teja Peddinti, Kurt Thomas, Florian Matthes | 13m |
25 interviews across 11 European countries show AI developers recognize risk amplification from bigger models but disagree strongly on priorities—23 unique… | ||
| I never reuse passwords! Development and Validation of a Security and Privacy Social... | Laura Marie Abels, Matthew Smith, Anna-Marie Ortloff | 11m |
Develops a 13-item SP-SDS for non‑CS end users, validated on N=1,167 with PCA (polychoric r) and CFA, five factors (data protection, passwords, illegal… | ||
| Replication: “No one can hack my mind” - 10 years later: An update and outlook on... | Anna-Marie Ortloff, Jenny Tang, Arthi Arumugam, Daniel Huschina, Lisa Geierhaas, Florin Martius, Luisa Jansen, Kolja von der Twer, Lilly Jungbluth, Matthew Smith | 13m |
Replication compares 2014, 2019, and 2024 survey and interview data and reports concrete shifts: N=990 non-experts, N=75 experts, N=35 interviews. Surveys add… | ||
| Unpacking the Social and Emotional Dimensions of Security and Privacy User Engagement | Nina Gerber, Verena Zimmermann, Alexandra von Preuschen, Karen Renaud | 13m |
Representative survey of 496 U.S. participants using mixed qualitative and quantitative methods with sentence‑completion tasks finds S&P seen as important but… | ||
| Smart Spaces, Private Lives: A Culturally Grounded Examination of Privacy Tensions... | Yara Alsiyat, Yuanhaur Chang, Ning Zhang, Ivan Flechais | 10m |
Iterative Grounded Theory interviews with 20 US and 20 Saudi participants and follow-up Saudi interviews use NVivo 14 and Excel coding to show privacy is… | ||
| Keynote Presentation: Minding the (Privacy Research/Practice) Gap | Greg Chappell | 29m |
A keynote arguing that differential privacy repeatedly fails or succeeds on concrete engineering and business terms: HIPAA eligibility for Alexa ships in 2019… | ||
| Minoritised Ethnic People’s Security and Privacy Concerns and Responses towards... | Aunam Quyoum, Mark Wong, Sebati Ghosh, Siamak F. Shahandashti | 12m |
Study analyzes 44 semi-structured interviews with UK minoritised ethnic people about essential services in health, social housing, energy. Main findings… | ||
| User Understandings of Technical Terms in App Privacy Labels | Ishika Keswani, Kerick Walker, Adrian Clement, Eusila Kitur, Nannapas Wonghirundacha, Ryan Aubrey, Vivien Song, Eleanor Birrell | 11m |
Two linked studies test comprehension: a qualitative study n=46 qualitative with free responses and a coded correctness/thematic analysis, and a large survey… | ||
| "Hello, is this Anna?": Unpacking the Lifecycle of Pig-Butchering Scams | Rajvardhan Oak, Zubair Shafiq | 12m |
Qualitative study with N=26 victims documents a reproducible, seven-step lifecycle where cold messages lead to staged trust (photos, video calls, curated… | ||
| "You go now! No trouble!" Understanding the Offboarding Process in Companies from an... | Christina Detsika, Timo Jagusch, Nora Weidner, Larissa Weir, Florin Martius, Christian Tiefenau | 11m |
Analysis of ISO, NIST and BSI guidance and 15 in-depth interviews (13 German, 2 English) finds no actionable standard and wide practice variance: teams… | ||
| Youth-Centered GAI Risks (YAIR): A Taxonomy of Generative AI Risks from Empirical Data | Yaman Yu, Yiren Liu, Jacky Zhang, Yun Huang, Yang Wang | 12m |
Built from 344 youth–GAI chat logs, 30,305 Reddit discussions, and 153 AI incident reports, the taxonomy enumerates 84 specific risks across six categories and… | ||
| Measuring NIST Authentication Standards Compliance by Higher Education Institutions | Noah Apthorpe, Boen Beavers, Yan Shvartzshnaider, Brett Frischmann | 14m |
Study audits public policies at 135 North American colleges drawn from US News lists, manually coding documents with two independent coders and reconciliation… | ||
| Design and Evaluation of Privacy-Preserving Protocols for Agent-Facilitated Mobile... | Karen Sowon, Collins W. Munyendo, Lily Klucinec, Eunice Maingi, Gerald Suleh, Lorrie Faith Cranor, Giulia Fanti, Conrad Tucker, Assane Gueye | 13m |
Design replaces agent-facing KYC with server-side verification that uses biometric and voice authentication for phones, issues short codes to agents, and… | ||
| Misuse, Misreporting, Misinterpretation of Statistical Methods in Usable Privacy and... | Jenny Tang, Lujo Bauer, Nicolas Christin | 12m |
Systematic review of 121 SOUPS papers over 20 years audits use of NHST and finds concrete failures: 23% use incorrect tests that ignore sample dependencies… | ||
| Safety Perceptions of Generative AI Conversational Agents: Uncovering Perceptual... | Jan Tolsdorf, Alan F. Luo, Monica Kodwani, Junho Eum, Mahmood Sharif, Michelle L. Mazurek, Adam J. Aviv | 12m |
Survey of n=123 participants uses exploratory factor analysis to create multi-dimensional measures: trust splits into benevolence, low personal risk… | ||
| Shiny Shells, Rusty Cores: A Crowdsourced Security Evaluation of Integrated Web... | Gertjan Franken, Pieter Claeys, Tom Van Goethem, Lieven Desmet | 12m |
A crowdsourced dynamic analysis using Check Engine plus an extended browser audit and a user‑agent fingerprint shows 76 enrollments across 53 products and 68… | ||
| Spy-oT: Understanding How Users Learn to Use Internet of Things Devices For Abusive... | Kieron Ivy Turk, Alice Hutchings | 10m |
An in-person exploratory "abusability" study gives 25 participants two two-hour sessions with a Ring doorbell, baby monitor, smart speakers, smart lights, a… | ||
| Between Court Orders and Platform Policies: Understanding Law Enforcement and Meta... | Amna Batool, Kentaro Toyama | 12m |
Analysis of 68 legal requests to Meta plus interviews with Pakistan's cyber crime wing and attorneys finds platforms usually answered within one or two days… | ||
| “TikTok, Do Your Thing”: User Reactions to Social Surveillance in the Public Sphere | Meira Gilbert, Miranda Wei, Lindah Kotut | 12m |
Qualitative analysis of 60 TikTok videos (collected Oct 2024–Jan 2025) and 1,901 top comments uses manual coding and reflexive thematic analysis to quantify… | ||
| The more accounts I use, the less I have to think': A Longitudinal Study on the... | Patricia Arias-Cabarcos, Peter Mayer | 12m |
Longitudinal study of n=37 novices uses a 3‑month commercial password manager with weekly surveys (weeks 1–4) and a week‑12 follow up, finding initial… | ||
| More than Usability: Differential Access to Digital Security and Privacy | Annalina Buckmann, Jan Magnus Nold, Yasemin Acar, Yixin Zou | 11m |
Study analyzes 47 in‑depth interviews and maps responses to the Security and Privacy Acceptance Framework (awareness, motivation, ability), identifying seven… | ||
| Trust-Enabled Privacy: Social Media Designs to Support Adolescent User Boundary... | JaeWon Kim, Robert Wolfe, Ramya Bhagirathi Subramanian, Mei-Hsuan Lee, Jessica Colnago, Alexis Hiniker | 13m |
A three-part study with 19 teens (ages 13–18) uses two interviews, a 7-day diary, and co-design sessions to show teens want casual, frequent self-disclosure… | ||
| How Predatory Monetization Designs Manifest in Child-Friendly Video Games | Qiurong Song, Zinan Zhang, Rie Helene (Lindy) Hernandez, Xinning Gui, Yubo Kou | 12m |
Roblox, with 56% of users under 16 (21% under 9, 21% aged 9–12), is analyzed via 20 developer interviews and a 30-game walkthrough. Findings show developers… | ||
| Adopting AI to Protect Industrial Control Systems: Assessing Challenges and... | Clement Fung, Eric Zeng, Lujo Bauer | 13m |
Paper reports 18 interviews with ICS practitioners (13 operators, 5 vendors) and cites a survey where 10% using AI and 19% experimenting. It documents highly… | ||
| nothing matches | ||