I am an Associate Professor at the University of Waterloo’s Department of Electrical and Computer Engineering (ECE) where I head the Technology Usability Lab in Privacy and Security (TULiPS). The goal of my research is to make security and privacy technologies more accessible for a wide range of users including end users, developers, and system administrators. I believe that technology should support people in their activities. My recent projects include topics like patch management, developer-centered privacy, phishing, online anonymity, smart speaker privacy, and privacy on social media.
Interests
- Cyber Security and Privacy
- Human Computer Interaction
- Phishing
- Smart speaker privacy
- System administration
Education
-
PhD in Computer Science, 2012
Carnegie Mellon University
-
BSc in Computer Science, 2005
Oregon State University
Latest
- Privacy, security, and consent (Talk)
- NIST Password Guidance Draft seems sane
- PhishCoder: Efficient Extraction of Contextual Information from Phishing Emails
- PEDRO (PEt Decision suppoRt tOol)
- Phishing Codebook: A Structured Framework for the Characterization of Phishing Emails
- Crowdstrike Outage - thoughts about updates
- FTC Research Questions
- Techreports with Security and Privacy Statistics
- USEC Survey scales
- CS4G Netsim as a teaching tool
- Security and Human Behavior (SHB) 2024 - Day 2
- Security and Human Behavior (SHB) 2024 - Day 1
- Not as easy as just update: Survey of System Administrators and Patching Behaviours
- Using Clustering Algorithms to Automatically Identify Phishing Campaigns
- DarkDialogs: Automated detection of 10 dark patterns on cookie dialogs
- Twitter has a Binary Privacy Setting, are Users Aware of How It Works?
- Multi-User Smart Speakers - A Narrative Review of Concerns and Problematic Interactions
- "I didn't click": What users say when reporting phishing
- Data-Enhanced Design: Engaging Designers in Exploratory Sensemaking with Multimodal Data
- Embedding Privacy Into Design Through Software Developers: Challenges and Solutions
- To Patch, or not To Patch? That is the Question: A Case Study of System Administrators' Online Collaborative Behaviour
- Context-based Clustering to Mitigate Phishing Attacks
- PhishED: Automated contextual feedback for reporting phishing
- From an Authentication Question to a Public Social Event: Characterizing Birthday Sharing on Twitter
- Lessons Learned From Recruiting Participants With Programming Skills for Empirical Privacy and Security Studies
- Recruiting Participants with Programming Skills: A Comparison of Four Crowdsourcing Platforms and a CS Student Mailing List
- Understanding Privacy Switching Behaviour on Twitter
- Can I Borrow Your ATM? Using Virtual Reality for (Simulated) In Situ Authentication Research
- Stay Home! Conducting Remote Usability Evaluations of Novel Real-World Authentication Systems Using Virtual Reality
- Understanding Privacy-Related Advice on Stack Overflow
- Virtual Reality Observations: Using Virtual Reality to Augment Lab-Based Shoulder Surfing Research
- Deciding on Personalized Ads: Nudging Developers About User Privacy
- Code-Level Dark Patterns: Exploring Ad~Networks' Misleading Code Samples with Negative Consequences for Users
- I Don't Need an Expert! Making URL Phishing Features Human Comprehensible
- Privacy Champions in Software Teams: Understanding Their Motivations, Strategies, and Challenges
- RepliCueAuth: Validating the Use of a lab-based Virtual Reality Setup for Evaluating Authentication Systems
- Security Notifications in Static Analysis Tools: Developers' Attitudes, Comprehension, and Ability to Act on Them
- Phishing
- Twitter Privacy
- Virtual Reality Lab Studies
- "Developers are Responsible": What Ad Networks Tell Developers About Privacy
- Owning and Sharing: Privacy Perceptions of Smart Speaker Users
- A Case Study of Phishing Incident Response in an Educational Organization
- Fast and Secure Authentication in Virtual Reality using Coordinated 3D Manipulation and Pointing
- Observing Virtual Avatars: The Impact of Avatars’ Fidelity on Identifying Interactions
- Prototyping Usable Privacy and Security Systems: Insights from Experts
- "Anyone Else Seeing this Error?": Community, System Administrators, and Patch Information
- What is this URL's Destination? Empirical Evaluation of Users' URL Reading
- RubikAuth: Fast and Secure Authentication in Virtual Reality
- Understanding Privacy-Related Questions on Stack Overflow
- Analysing Privacy Leakage of Life Events on Twitter
- Analysis of publicly available anti-phishing webpages: contradicting information, lack of concrete advice and very narrow attack vector
- "I Don't Know Too Much About It": On the Security Mindsets of Computer Science Students
- A Survey on Developer-Centred Security
- Saudis' Conceptualisation of Disturbing Content on Social Media
- Chatty Factories
- A Review of Human-and Computer-Facing URL Phishing Features
- Automatic phishing detection versus user training, Is there a middle ground using XAI?
- Faheem: Explaining URLs to people using a Slack bot
- Permission Impossible: Teaching Firewall Configuration in a Game Environment
- Capturing the Connections: Unboxing Internet of Things Devices
- Viewing the Viewers: Publishers' Desires and Viewers' Privacy Concerns in Social Networks
- Was my message read? Privacy and signaling on Facebook messenger
- Debunking security-usability tradeoff myths
- Tales of Software Updates: The process of updating software
- Understanding Saudis' privacy concerns when using WhatsApp
- Poster: A User Study of WhatsApp Privacy Settings Among Arab Users
- Computer security information in stories, news articles, and education documents
- Betrayed By Updates: How Negative Experiences Affect Future Security
- Out of the loop: How automated software updates cause unintended security consequences
- Out of sight, out of mind: Effects of displaying access-control information near the item it controls
- More than skin deep: Measuring effects of the underlying model on access-control system usability
- Access Control for Home Data Sharing: Attitudes, Needs and Practices
- Access Control for Home Data Sharing: Attitudes, Needs and Practices
- Effects of access-control policy conflict-resolution methods on policy-authoring usability
- Effects of access-control policy conflict-resolution methods on policy-authoring usability
- Real life challenges in access-control management
- A user study of policy creation in a flexible access-control system
- A user study of policy creation in a flexible access-control system
- Access Control Policy Analysis and Visualization Tools for Security Professionals
- Evaluating Assistance of Natural Language Policy Authoring
- Lessons learned from the deployment of a smartphone-based access-control system
- User-controllable security and privacy for pervasive computing
- Comparing Access-Control Technologies: A Study of Keys and Smartphones
- Lessons learned from the deployment of a smartphone-based access-control system