Publications

Indrani Ray, Maria K. Wolters, Kami Vaniea (2026). There’s a (pot)hole in your privacy policy: Privacy Concerns in Canadian Problem-Reporting Websites. Conference on Sociotechnical Cybersecurity and Privacy.

Indrani Ray, Mahesh Tripunitara, Kami Vaniea (2026). Composition of Access Control Schemes via Co-Existence: Three Case-Studies. Proceedings of the 31st ACM Symposium on Access Control Models and Technologies.

Tarini Saka, Kami Vaniea, Nadin Kokciyan (2026). AI-Enhanced Email Security: A Novel Pipeline for Phishing Campaign Detection and Profiling. ACM Transactions on Internet Technology (TOIT) Special Issue on Human-AI Collaboration in Security Operations Centres.

Indrani Ray, Maria K. Wolters, Kami Vaniea (2025). Why do They Need to Know I Spotted a Pothole? Privacy Issues in Canadian Municipal Problem Reporting Websites. Mensch und Computer 2025 - Workshopband.

Tarini Saka, Nadin Kokciyan, Kami Vaniea (2025). SoK: Grouping Spam and Phishing Email Threats for Smarter Security. In IEEE Access.

Tarini Saka, Kalliopi Vakali, Adam Jenkins, Nadin Kokciyan, Kami Vaniea (2025). Judging Phishing Under Uncertainty: How Do Users Handle Inaccurate Automated Advice?. 🏆 In Proceedings of the ACM Conference on Human Factors in Computing Systems (CHI'25).

Tarini Saka, Kami Vaniea, Nadin Kökciyan (2024). PhishCoder: Efficient Extraction of Contextual Information from Phishing Emails. In Proceedings of the Workshop on Security and Artificial Intelligence (SECAI 2024).

Tarini Saka, Rachiyta Jain, Kami Vaniea, Nadin Kökciyan (2024). Phishing Codebook: A Structured Framework for the Characterization of Phishing Emails. arXiv preprint arXiv:2408.08967.

Adam Jenkins

Kings College London

, Linsen Liu

University of Edinburgh

, Maria K. Wolters

Society Division, OFFIS

, Kami Vaniea

University of Waterloo

(2024). Not as easy as just update: Survey of System Administrators and Patching Behaviours. In CHI'24.

Kholoud Althobaiti, Maria K. Wolters, Nawal Alsufyani, Kami Vaniea (2023). Using Clustering Algorithms to Automatically Identify Phishing Campaigns. In IEEE Access.

Daniel Kirkman, Kami Vaniea, Daniel W. Woods (2023). DarkDialogs: Automated detection of 10 dark patterns on cookie dialogs. In Proceedings of the 8th IEEE European Symposium on Security and Privacy (EuroSP'23).

Dilara Keküllüoglu, Kami Vaniea, Maria K. Wolters, Walid Magdy (2023). Twitter has a Binary Privacy Setting, are Users Aware of How It Works?. In Proceedings of the 2023 ACM SIGCHI Conference on Computer-Supported Cooperative Work and Social Computing (CSCW23).

Nicole Meng-Schneider, Rabia Yasa Kostas, Kami Vaniea, Maria K Wolters (2023). Multi-User Smart Speakers - A Narrative Review of Concerns and Problematic Interactions. In Extended Abstracts of the 2023 CHI Conference on Human Factors in Computing Systems.

Nikolas Pilavakis, Adam Jenkins, Nadin Kokciyan, Kami Vaniea (2023). "I didn't click": What users say when reporting phishing. In Proceedings of the Symposium on Usable Privacy and Security (USEC'23).

Adam Jenkins, Maria K. Wolters, Kami Vaniea (2023). To Patch, or not To Patch? That is the Question: A Case Study of System Administrators' Online Collaborative Behaviour. arXiv.

Mohammad Tahaei, Kami Vaniea, Awais Rashid (2023). Embedding Privacy Into Design Through Software Developers: Challenges and Solutions. In IEEE Security & Privacy.

Katerina Gorkovenko, Adam Jenkins, Kami Vaniea, Dave Murray-Rust (2023). Data-Enhanced Design: Engaging Designers in Exploratory Sensemaking with Multimodal Data. In International Journal of Design.

Tarini Saka, Kami Vaniea, Nadin Kökciyan (2022). Context-based Clustering to Mitigate Phishing Attacks. In Proceedings of the 15th ACM Workshop on Artificial Intelligence and Security (AISec 2022).

Adam Jenkins, Nadin Kökciyan, Kami Vaniea (2022). PhishED: Automated contextual feedback for reporting phishing. In Proceedings of the Symposium on Usable Privacy and Security Poster Track.

Mohammad Tahaei, Kami Vaniea (2022). Recruiting Participants with Programming Skills: A Comparison of Four Crowdsourcing Platforms and a CS Student Mailing List. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems.

Mohammad Tahaei, Kami Vaniea (2022). Lessons Learned From Recruiting Participants With Programming Skills for Empirical Privacy and Security Studies. In 1st International Workshop on Recruiting Participants for Empirical Software Engineering (RoPES'22).

Dilara Keküllüoglu, Walid Magdy, Kami Vaniea (2022). From an Authentication Question to a Public Social Event: Characterizing Birthday Sharing on Twitter. In Proceedings of The 16th International AAAI Conference on Weblogs and Social Media (ICWSM'22).

Dilara Keküllüoglu, Kami Vaniea, Walid Magdy (2022). Understanding Privacy Switching Behaviour on Twitter. In Proceedings of the CHI Conference on Human Factors in Computing Systems.

Florian Mathis, Kami Vaniea, Mohamed Khamis (2022). Can I Borrow Your ATM? Using Virtual Reality for (Simulated) In Situ Authentication Research. In Proceedings of IEEE Virtual Reality and 3D User Interfaces (VR).

Florian Mathis, Joseph O'Hagan, Mohamed Khamis, Kami Vaniea (2022). Virtual Reality Observations: Using Virtual Reality to Augment Lab-Based Shoulder Surfing Research. In Proceedings of IEEE Virtual Reality and 3D User Interfaces (VR).

Mohammad Tahaei, Tianshi Li, Kami Vaniea (2022). Understanding Privacy-Related Advice on Stack Overflow. In Proceedings on Privacy Enhancing Technologies.

Florian Mathis, Joseph O'Hagan, Kami Vaniea, Mohamed Khamis (2022). Stay Home! Conducting Remote Usability Evaluations of Novel Real-World Authentication Systems Using Virtual Reality. In Proceedings of the International Conference on Advanced Visual Interfaces (AVI 2022).

Mohammad Tahaei, Alisa Frik, Kami Vaniea (2021). Deciding on Personalized Ads: Nudging Developers About User Privacy. In Symposium On Usable Privacy and Security (SOUPS).

Mohammad Tahaei, Kami Vaniea, Konstantin Beznosov, Maria K. Wolters (2021). Security Notifications in Static Analysis Tools: Developers' Attitudes, Comprehension, and Ability to Act on Them. In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems.

Florian Mathis, Kami Vaniea, Mohamed Khamis (2021). RepliCueAuth: Validating the Use of a lab-based Virtual Reality Setup for Evaluating Authentication Systems. In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems.

Mohammad Tahaei, Alisa Frik, Kami Vaniea (2021). Privacy Champions in Software Teams: Understanding Their Motivations, Strategies, and Challenges. In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems.

Kholoud Althobaiti, Nicole Meng-Schneider, Kami Vaniea (2021). I Don't Need an Expert! Making URL Phishing Features Human Comprehensible. In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems.

Mohammad Tahaei, Kami Vaniea (2021). Code-Level Dark Patterns: Exploring Ad~Networks' Misleading Code Samples with Negative Consequences for Users. In ``What Can CHI Do About Dark Patterns?’’ Workshop at CHI Conference on Human Factors in Computing Systems (CHI ‘21).

Nicole Meng-Schneider, Dilara Keküllüoglu, Kami Vaniea (2021). Owning and Sharing: Privacy Perceptions of Smart Speaker Users. In Proceedings of the ACM Conference on Computer Supported Cooperative Work and Social Computing.

Mohammad Tahaei, Kami Vaniea (2021). "Developers are Responsible": What Ad Networks Tell Developers About Privacy. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems Late Breaking Work.

Florian Mathis, Kami Vaniea, Mohamed Khamis (2021). Prototyping Usable Privacy and Security Systems: Insights from Experts. In International Journal of Human–Computer Interaction.

Florian Mathis, Kami Vaniea, Mohamed Khamis (2021). Observing Virtual Avatars: The Impact of Avatars’ Fidelity on Identifying Interactions. In Proceedings of Mindtrek International Technology Conference.

Florian Mathis, John H. Williamson, Kami Vaniea, Mohamed Khamis (2021). Fast and Secure Authentication in Virtual Reality using Coordinated 3D Manipulation and Pointing. In ACM Transactions on Computer-Human Interaction (TOCHI).

Kholoud Althobaiti, Adam Jenkins, Kami Vaniea (2021). A Case Study of Phishing Incident Response in an Educational Organization. In Proceedings of the ACM Conference on Computer Supported Cooperative Work and Social Computing.

Adam Jenkins, Pieris Kalligeros, Kami Vaniea, Maria K. Wolters (2020). "Anyone Else Seeing this Error?": Community, System Administrators, and Patch Information. In Proceedings of the European Symposium on Security and Privacy (EuroSP).

Sara S. Albakry, Kami Vaniea, Maria K. Wolters (2020). What is this URL's Destination? Empirical Evaluation of Users' URL Reading. In Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems.

Mohammad Tahaei, Kami Vaniea, Naomi Saphra (2020). Understanding Privacy-Related Questions on Stack Overflow. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems.

Florian Mathis, John H. Williamson, Kami Vaniea, Mohamed Khamis (2020). RubikAuth: Fast and Secure Authentication in Virtual Reality. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems.

Florian Mathis, Hassan Ismail Fawaz, Mohamed Khamis (2020). Knowledge-driven Biometric Authentication in Virtual Reality. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems.

Mattia Mossano, Kami Vaniea, Lukas Aldag, Reyhan Düzgün, Peter Mayer, Melanie Volkamer (2020). Analysis of publicly available anti-phishing webpages: contradicting information, lack of concrete advice and very narrow attack vector. In Proceedings of the 5th IEEE European Workshop on Usable Security (EuroUSEC).

Dilara Keküllüoglu, Walid Magdy, Kami Vaniea (2020). Analysing Privacy Leakage of Life Events on Twitter. In Proceedings of the 12th ACM Conference on Web Science.

Mohammad Tahaei, Adam Jenkins, Kami Vaniea, Maria K. Wolters (2019). "I Don't Know Too Much About It": On the Security Mindsets of Computer Science Students. In Workshop on Socio-Technical Aspects in SecuriTy (STAST).

Mohammad Tahaei, Kami Vaniea (2019). A Survey on Developer-Centred Security. In European Workshop on Usable Security (EuroUSEC) co-located with The IEEE European Symposium on Security and Privacy (EuroS&PW).

Sara S. Albakry, Aljawharah Alabdullaif, Kami Vaniea, Maria K. Wolters (2019). Saudis' Conceptualisation of Disturbing Content on Social Media. In Workshop on HCI Research and Practice in the Arab World (ArabCHI).

Kholoud Althobaiti, Ghaidaa Rummani, Kami Vaniea (2019). A Review of Human-and Computer-Facing URL Phishing Features. In IEEE European Symposium on Security and Privacy Workshops (EuroSPW).

Sara S. Albakry, Kami Vaniea (2018). Automatic phishing detection versus user training, Is there a middle ground using XAI?. In Proceedings of the SICSA Workshop on Reasoning, Learning and Explainability.

Sibylle Sehl, Kami Vaniea (2018). Permission Impossible: Teaching Firewall Configuration in a Game Environment. In Proceedings of the European Workshop on Usable Security (EuroUSEC'18).

Kholoud Althobaiti, Kami Vaniea, Serena Zheng (2018). Faheem: Explaining URLs to people using a Slack bot. In Symposium on Digital Behaviour Intervention for Cyber Security.

Roberto Hoyle, Srijita Das, Apu Kapadia, Adam J. Lee, Kami Vaniea (2017). Was my message read? Privacy and signaling on Facebook messenger. In Proceedings of the Conference on Human Factors in Computing Systems (CHI).

Roberto Hoyle, Srijita Das, Apu Kapadia, Adam J. Lee, Kami Vaniea (2017). Viewing the Viewers: Publishers' Desires and Viewers' Privacy Concerns in Social Networks. In Proceedings of the Conference on Computer Supported Cooperative Work and Social Computing (CSCW).

Kami Vaniea, Ella Tallyn, Chris Speed (2017). Capturing the Connections: Unboxing Internet of Things Devices. In arXiv.

Yasmeen Rashidi, Kami Vaniea, L. Jean Camp (2016). Understanding Saudis' privacy concerns when using WhatsApp. In Proceedings of the Workshop on Usable Security (USEC).

Kami Vaniea, Yasmeen Rashidi (2016). Tales of Software Updates: The process of updating software. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems.

M Angela Sasse, Matthew Smith, Cormac Herley, Heather Lipford, Kami Vaniea (2016). Debunking security-usability tradeoff myths. In IEEE Security and Privacy.

Yasmeen Rashidi, Kami Vaniea (2015). Poster: A User Study of WhatsApp Privacy Settings Among Arab Users. In Proceedings of the Symposium on Security and Privacy Poster Track.

Katie Hoban, Emilee Rader, Rick Wash, Kami Vaniea (2014). Computer security information in stories, news articles, and education documents. In Symposium on Usable Privacy and Security.

Kami Vaniea, Emilee Rader, Rick Wash (2014). Betrayed By Updates: How Negative Experiences Affect Future Security. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems.

Rick Wash, Emilee Rader, Kami Vaniea, Michelle Rizor (2014). Out of the loop: How automated software updates cause unintended security consequences. In Symposium On Usable Privacy and Security (SOUPS).

Kami Vaniea, Lujo Bauer, Lorrie Faith Cranor, Michael K. Reiter (2012). Out of sight, out of mind: Effects of displaying access-control information near the item it controls. In PST 2012: Conference on Privacy, Security, and Trust.

Robert W. Reeder, Lujo Bauer, Lorrie Faith Cranor, Michael K. Reiter, Kami Vaniea (2011). More than skin deep: Measuring effects of the underlying model on access-control system usability. In {CHI} 2011: Conference on Human Factors in Computing Systems.

Michelle L. Mazurek, J.P. Arsenault, Joanna Breese, Nitin Gupta, Iulia Ion, Christina Johns, Daniel Lee, Yuan Liang, Jenny Olsen, Brandon Salmon, Richard Shay, Kami Vaniea, Lujo Bauer, Lorrie Faith Cranor, Gregory R. Ganger, Michael K. Reiter (2010). Access Control for Home Data Sharing: Attitudes, Needs and Practices. In CHI'10.

Michelle L. Mazurek, J.P. Arsenault, Joanna Bresee, Nitin Gupta, Christina Johns {Iulia Ion}, Daniel Lee, Yuan Liang, Jenny Olsen, Brandon Salmon, Richard Shay, Kami Vaniea, Lujo Bauer, Lorrie Faith Cranor, Gregory R. Ganger, Michael K. Reiter (2009). Access Control for Home Data Sharing: Attitudes, Needs and Practices. CMU Technical Report CMU-CyLab-09-013.

Lujo Bauer, Lorrie F. Cranor, Robert W. Reeder, Michael K. Reiter, Kami Vaniea (2009). Effects of access-control policy conflict-resolution methods on policy-authoring usability.

Lujo Bauer, Lorrie F. Cranor, Robert W. Reeder, Michael K. Reiter, Kami Vaniea (2009). Effects of access-control policy conflict-resolution methods on policy-authoring usability.

Lujo Bauer, Lorrie F. Cranor, Robert .W. Reeder, Michael K. Reiter, Kami Vaniea (2009). Real life challenges in access-control management. In Proceedings of the 27th international conference on Human factors in computing systems.

Kami Vaniea, Clare-Marie Karat, Joshua B. Gross, John Karat, Carolyn Brodie (2008). Evaluating Assistance of Natural Language Policy Authoring. In the Symposium on Usable Security and Privacy.

Kami Vaniea, Qun Ni, Lorrie F. Cranor, Elisa Bertino (2008). Access Control Policy Analysis and Visualization Tools for Security Professionals. In Workshop on Usable IT Security Management (USM ‘08).

Lujo Bauer, Lorrie Faith Cranor, Robert W. Reeder, Michael K. Reiter, Kami Vaniea (2008). A user study of policy creation in a flexible access-control system. In CHI ‘08: Proceeding of the twenty-sixth annual SIGCHI conference on Human factors in computing systems.

Lujo Bauer, Lorrie Faith Cranor, Robert W. Reeder, Michael K. Reiter, Kami Vaniea (2008). A user study of policy creation in a flexible access-control system. CHI ‘08: Proceeding of the twenty-sixth annual SIGCHI conference on Human factors in computing systems.

Lujo Bauer, Lorrie Faith Cranor, Michael K. Reiter, Kami Vaniea (2007). Lessons learned from the deployment of a smartphone-based access-control system. In SOUPS ‘07: Proceedings of the 3rd Symposium on Usable Privacy and Security.

Jason Cornwell, Ian Fette, Gary Hsieh, Madhu Prabaker, Jinghai Rao, Karen Tang, Kami Vaniea, Lujo Bauer, Lorrie Cranor, Jason Hong, Bruce McLaren, Mike Reiter, Norman Sadeh (2007). User-controllable security and privacy for pervasive computing. In Eighth IEEE Workshop on Mobile Computing Systems and Applications (HotMobile).

Lujo Bauer, Lorrie Faith Cranor, Michael K. Reiter, Kami Vaniea (2007). Lessons learned from the deployment of a smartphone-based access-control system. In SOUPS ‘07: Proceedings of the 3rd symposium on Usable privacy and security.

Lujo Bauer, Lorrie Cranor, Robert W. Reeder, Michael K. Reiter, Kami Vaniea (2007). Comparing Access-Control Technologies: A Study of Keys and Smartphones.