City governments are leveraging digital platforms to increase engagement from the community and make services more accessible to their constituents. These platforms allow citizens …
Live blog of the Conference on Sociotechnical Cybersecurity and Privacy (SCP2026) which is a new conference this year created by merging EuroUSEC and STAST. The conference is being …
Liveblog of Day 2 of SOUPS, featuring sessions on: Usable Security Mechanisms & Emerging Threats; Scams, Fraud & Misinformation; GenAI Privacy & Risks; and ecurity Advice & …
Liveblog of Day 2 of SOUPS, featuring sessions on: Privacy Notices, Permissions & Labels; Security Operatoins & Practitioners; Phishing & Social Engineering; and At-Risk & …
Liveblog of Day 1 of SOUPS, featuring sessions on: Authentication * Credentials as well as Families & Shared Devices. The SOUPS community is made up of researchers that care about …
Workshop of a range of experts on non-consentual intimate imagry. As always, the below is my interpretation of what people said, and should not be interpreted as a directly quote …
I am live blogging Symposium on Access Control Models and Technologies (SACMAT'26) which is being hosted by the University of Waterloo this year. The below summaries are my …
We address composition of access control schemes which include both a model to encode authorizations, and an administrative model to encode the manner in which such authorizations …
In this study, we explore the integration of artificial intelligence (AI) into phishing (scam) mitigation, not as a replacement for human expertise but as a complement to it. We …
A set of recommendations around GenAI usage based on the citation review done for SOUPS 2026. Recommendations are aimed at labs that are trying to implement policies around GenAI …
Live blog of the different SHB speakers on Day 1. SHB is an invite-only conference but the issues discussed are interesting and important to people world-wide. This live blog is …
Live blog of the different SHB speakers on Day 1. SHB is an invite-only conference but the issues discussed are interesting and important to people world-wide. This live blog is …
Government services are increasingly moving online which can lead to more efficiency and greater accessability. But online services also come with privacy and security risks. This …
The TULiPS lab is conducting a research study on the work practices of Online Child Safety Engineers, particularly people who work on mitigating Child Sexual Abuse Material through …
Users act as valuable ``citizen sensors'' by reporting issues in public spaces enabling cities to address infrastructure problems in a timely manner. Municipal web sites are one …
Live blog of the different SHB speakers on Day 2. SHB is an invite-only conference but the issues discussed are interesting and important to people world-wide. This live blog is …
Live blog of the different SHB speakers on Day 1. SHB is an invite-only conference but the issues discussed are interesting and important to people world-wide. This live blog is …
Clustering phishing and spam attackes into groups often called campaigns has been an ongoing research direction, but the work on it uses a supprisingly wide range of definitions of …
Users need accurate and relevant guidance about phishing to take the right action on specific cases. This study investigates the effectiveness of guidance based on features …
Nice Wall Street Journal write up about Brian Krebs the cyber security investigative reporter. It has a couple of details about the Snowflake hack. But what I find most intersting …
I authored a “year ahead” piece for Maclean’s magazine about what outages are likely to look like in 2025: More Frequent - and Disruptive - Tech Outages Are on the Way. Spoiler: I …
Talk at the University of Waterloo Cybersecurity Privacy Institute 6th Annual Conference. The talk covers issues around how develoeprs are learning about what privacy entails and …
Password guidance has historically ignored human factors issues and required people to do things like changes passwords frequently which seems secure, but actually reduces security …
A novel framework designed to designed to extract contextual information from phishing emails. Our focus is on human-centric features, which are often overlooked in traditional …
Developers are users too and they are impacted by many of the same usability issues that plague users. In this project we look at how developers engage with privacy and think about …
Website that explains different common privacy enhancing tools (PETs) and addresses common barriers and misconceptions people have when trying to use them.
There is a significant knowledge gap about the qualitative traits embedded in phishing emails, which could be useful in a range of phishing mitigation tasks. In this paper, we …
Crowdstrike issued a problematic update that impacted about 8.5 million Windows computers sending them into a Blue Screen Of Death and taking down millions of vital systems …
The FTC has a list of Research Questions for academics that they are particularly interested in. At the top of the list is “AI-enabled Fraud and Scams”.
List of different sources of statistics that I use for research papers and presentations regarding security, privacy, and phishing.
Personal list of survey scales useful in Usable Security research. The list is not comprehensive and instead represents scales I have been exposed to or seen presented. General …
Network simlator that is intended for teaching purposes. I'm experimenting with using in in a classroom context.
Interdisciplinary invite-only conference discussing how people interact with security technology. The conference is designed to share ideas, questions, and promote interesting …
Interdisciplinary invite-only conference discussing how people interact with security technology. The conference is designed to share ideas, questions, and promote interesting …
While installing patches (updates) quickly is important for security, many system administrators do not have access to key resources like dedicated testing environments to ensure …
Attackers attempt to create successful phishing campaigns by sending out trustworthy-looking emails with a range of variations, such as adding the recipient name in the subject …
Consent dialogs are in theory there to provide users with choices. In this study we look at the impact choosing different options has on the cookies set. We also analyze the number …
Twitter accounts are public by default, but Twitter gives the option to create protected accounts, where only approved followers can see their tweets. The publicly visible …
Smart speakers in multi-user spaces, such as Amazon Echos, introduce risks to both owners and anyone sharing the space. They store voice recordings of user requests, and anyone in …
When people report phishing emails they sometimes say something along with the report, such as asking a question, highlighting an aspect of the phishing, or asking for guidance. In …
Case study of a Critical Windows patch which had problems. The case explores how admins learn about patches, how issues are identified by online admin communities, communication …
Research in the wild can reveal human behaviors, contexts, and needs around products that are difficult to observe in the lab. Telemetry data from the use of physical products can …
Reliably recruiting participants with programming skills is an ongoing challenge for empirical studies involving software development technologies, often leading to the use of …
Changing a Twitter account's privacy setting between public and protected changes the visibility of past tweets. By inspecting the privacy setting of more than 100K Twitter users …
Smart speakers interact with anyone that is near them connecting that person to the accounts associated with the speaker's owner. Such access can cause privacy and expectation …
We look at the types of privacy-related advice developers give each other on StackOverflow and how that advice maps to Hoepman’s privacy design strategies. We qualitatively …
Evaluating interactive systems often requires researchers to invite user study participants to the lab. However, corresponding evaluations often lack realism and participants are …
Choice framing impacts app developers’ decisions about the settings of mobile advertisements which in turn impacts their users’ privacy. We anticipate that framing and nudging have …
Software development teams are responsible for making and implementing software design decisions that directly impact end-user privacy, a challenging task to do well. Privacy …
Judging the safety of a URL is something that even security experts struggle to do accurately without additional information. In this work, we aim to make experts’ tools accessible …
Security studies, particularly those that use new or novel hardware, are challenging to study the usability of. This project looks at the feisability of studying such technologies …
Twitter has a relatively simplistic privacy setting of an account being either public or protected, yet many people are still confused about how the settings work. The project …
Smart speakers, such as Amazon Alexa, are increasingly present in multi-user households leading to questions about privacy and consent espeically for those who do not directly own …
Avertising networks enable developers to create revenue, but using them potentially impacts user privacy and requires developers to make legal decisions. To understand what privacy …
Common anti-phishing advice tells users to mouse over links, look at the URL, and compare to the expected destination, implicitly assuming that they are able to read the URL. To …
We analyse Stack Overflow to understand challenges and confusions developers face while dealing with privacy-related topics. Identified topics include privacy policies, privacy …
Organizations often provide anti-phishing guidance to their customers and the Internet community at large. We analyzed 94 anti-phishing webpages from eight different countries and …
People share a wide variety of information on Twitter, including the events in their lives, without understanding the size of their audience. While some of these events can be …
Software developers are key players in the security ecosystem as they produce code that runs on millions of devices. Yet we continue to see insecure code being developed and …
Design project aimed at exploring the "fourth industrial revolution" by bringing data, artificial intelligence and robotic fabrication systems to the forefront of the manufacturing …
Topics in Computer Security, such as firewalls, can seem inaccessible or very difficult to beginners. That perceived inaccessibility is a serious problem at a time when countries …
Online safety regularly depends on users’ ability to know either where a URL is likely to lead or identify when they are on a site other than they expect. Unfortunately, the …
Analysis of the update experiences of 307 survey participants to better understand the barriers and incentives people experience when updating software. Using content analysis we …
As digital content becomes more prevalent in the home, nontechnical users are increasingly interested in sharing that content with others and accessing it from multiple devices. …
The goal of the research study reported here was to investigate policy authors' ability to take descriptions of changes to policy situations and author high-quality, complete …
Managing large sets of access-control rules is a complex task for security administrators. Each addition, deletion or modification of a rule causes many potential and unknown side …