Usable Security and Privacy | Kami Vaniea

Symposium on Usable Privacy and Security (SOUPS 2026) - Day 2

Tue, 25 Aug 2026 03:08:19 -0400

Welcome to the Symposium on Usable Security and Privacy happening in Hannover, Germany and being hosted by CISPA.

Blog posts:

Session 1: Privacy Notices, Permissions & Labels

How Effective are Privacy Labels at Informing Users About App Data Handling Practices?

Presenter: Sophia Walsh, University of Bristol

Do the short data notices on app stores properly inform users?

The study looks at users ability to understand the labels in app store notices. They used a card matching approach where they gave users popular apps on one set of cards and a print-out of the short privacy notice icons on another. They then asked the participants to try and match the two sets while doing a think aloud.

Unsupprisingly, they find that users do not know how to map the permissions information to the features that exist in apps. They also find that the information can be overwhelming and causes users to give up.

I don’t know what I’ve all granted. Does it really matter? – Understanding Users’ Awareness of Different Permission Types on Android

Presenter: Verena Winterhalter, LMU Munich

More than 372 apps installed on a given phone.

Each of these apps has permissions that control how it can collect and use user data. Users’ awareness of these permissions is poor to start with and can get worse with time since permissions can change over time.

Studied users understandings of what permissions that the user has installed and uses.

Recommends:

Focus on permissions where user has agency
Improve visabiliity & reviwability of installtime permissions
App usage recency as indicator for suggesting app deletion
Different intervention approach per type of misconception

Nudging Developers Toward Privacy: Evaluating the Impact of Personalized App Review Reports

Presenter: Nina Taft, Google

It can be challenging for developers who are building an app to get privacy right. They use libraries, but may not know what those libraries do. But users sometimes have allot to say about the topic in reviews.

This project attempts to give developers personalized reports about their app.

Study is multi-stage. Stage-1: survey of developers about their concerns, privacy perceptions, and odds of taking action. Stage-2: showed them a personalized privacy report. Stage-3: measured their understanding.

The report:

Top 3 privacy concerns from their users’ reviews
Focused on one of those concerns, showed them Volume and Trends
Peer benchmark - compared their app to their peers
Emotions - emotion words

Studied people who work in the privacy field, or at least someone who can make decisions involving the privacy design of the app.

Asked developers about the approaches they have for lookimg at their own reviews, particularly privacy-related. Some read the 1 star reviews. Some have software that reads and summarizes reviews, though not specifically for privacy.

76% of respondants found it useful. The remaining 24% had a “I already knew that” response. 69% say that they are likely to do something about the user concerns after seeing the report.

Session 2: Security Operations & Practitioners

Like a Hammer, It Can Build, It Can Break: Large Language Model Uses, Perceptions, and Adoption in Cybersecurity Operations on Reddit

Presenter: Souradip Nath

Looking at how security operations are using LLMs. The reasearch used Reddit to understand usagage. Used mix of Qualtiative and Quantitative.

The AI vender landscape is wide and growing. But awareness of them are fragmented.

Security focused LLMs integrated with Triage and Response while general purpose were more for code writing.

There was a large amount of range in autonomy granted to the agents.

Developers are finding LLMs to be very helpful in doing things like digging through logs and alerts. Agentic AI, in particular, was seen as valuable to find information and quickly answer questions like “does this log line happen every time a user logs in, or is this a new alert?” That said, they were concerned about the accuracy of the tools.

Lots of concerns about how much agency should be given to the tools. The costs of the tools also came up as a serious issue, equating the costs to things like a full time employee salary.

The Impact of Emerging AI Practices on the Cybersecurity Workforce

Presenter: Miuyin Yong Wong, University of Maryland

Are LLMs making people more efficient? Are they benefiting productivity of cybersecurity professionals? This field particuarly susceptible to burnout.

RQs (terse version):

What policies and guidance for LLMs are organizations providing
What challenges and risks when using LLMs
How do peer perceptions impact views

Conducted interviews 28 participants from 26 organizations spanning 16 job roles.

The current landscape

Quite a range of policies avaiable. Many did not have a policy or had a relaxed or generic policy. A few had very restricted policy, such as not allowing training on local company data. Participants mostly relied on exsisting data loss measures. Most of the burdon for being safe falls on the individual to not do the wrong thing.

Barriers to adoption and mitigations

Issues like data leakage, hallucinations, lack of confidence in promoting skills, and wasting time.

People were also afraid of other people using the AI. Concerns that less experienced people would use the AI poorly, or loose the ability to learn.

“What will others think of me if I use AI?” The cybersecurity community is an open community that shares knowledge, but AI may be changing that. People are worried about what others will think about their AI use which is causing a lack of communication about it.

From Preventive to Reactive: How AI Coding Assistants Transform Developers’ Security Awareness

Presenter: Faisal Haque Bappy, University of Maryland Baltimore County

Did a coding session using thinking aloud. Divided participants based on the date they were trained, before AI, during the AI boom, or were native to AI use. They also did an interview and a post-task reflection.

the good news is that AI ouptputs are treated as reference rather than a final code state. People talked about the AI like a junior collegue, but they also didn’t explicitly make security requirements to the AI.

I See DNS People: DNS Resolver Security, Through Operator Perspectives and Practices

Presenter: Katharina Barlage, LMU Munich

DNS converts human-friendly URLs like “vaniea.com” to an IP address (205.196.221.231) which is where the computer establishes a connection. A successful DNS attack can route traffic to somewhere else. Or it could stop users from visiting the site. Having security on DNS servers is vital, but not universally deployed.

DNS “just works” so no one cares untill there is a problem. So upper management does not give resources. Security is often assumed but not assessed. Uptime is a seroius concern and can outrank security.

Some DNS opperators are buying software to run, and assuming that security is there because it should be. They do not assess. Because everything looks fine there is no percieved need to go adjust things. The danger is also abstract and not seem real because there have not been any DNS incidents that they know of. But if they adjust DNS wrong, everything will break, so the short term risk seems more risky. Turning on security is similar, turning on security seems risky and not worth that risk.

“I didn’t know I would be this excited not to be scammed.” Exploring Emotional and Behavioral Responses During Phishing Attacks

Presenter: Raphael Weidhaas, Aalto University

People are still clicking on phising despite lots of training. There is limited research on how phishing impacts the emotion state of the person who gets the phishing.

Lab study where users were put in an office setting. They were given a set of tasks. After about 45 minutes they were sent a simulated phishing email. It was mildly associated with a task, but had some clear indicators like three ‘o’ on zooom. Followed by an interview.

22 participants identified the phishing, 7 clicked, 8 avoided but didn’t realize it was a phishing. 4 fell for the phishing and entered data. The clickers tended to think they had made an error and were trying to correct it, but did realize that it was a problem. Phished people felt that they had solved the problem and felt positive afterwards.

People who fell for phishing had the most positive emotions. Detectors were the most annoyed.

Presenter: Martin Dechant, University College London

How does having Social Anxiety impact how people process and think about phishing.

People with social anxiety are worried about situations were they are around large groups of others where they might stand out or be criticised by those peers. 4.7% of children, and 8.3% of adolescents have social anxiety globally.

Asked a group of people about a recent social engineering attack that they had experienced. Scammers exploit trust and desires by creating a sense of familiarity, then manipulating with the promises of materialistic or financial gains. Perpetrators weaponized any shared material. Perpetrators fabricate a crisese or urgent situation.

Studied three scams where participants experienced a scenario as a role play.

Job Scam (Trust and Desires)
Extortion (Compromising material)
Romance Scam (Empathy and Urgency)

Participants did not want to reach out for help due to structural barriers. Social Anxiety people didn’t want to talk about it, they were worried about judgement, assumed that others would laugh.

Scammers used language to give affirmation that the social anxious person craved like “you are great” and “you are amazing”.

Quantifying Risk Perception and Scam Response Among International and Domestic US University Students

Presenter: Elijah Bouma-Sims, Carnegie Mellon University;

International students may be more vulnerable to scams for reasons like: unfamiliarity with US legal, lingustic, and cultural norms, pressures for post-graduation employment.

Surveyed about 1000 international and domestic students from 5 universities. Each person saw a scenario describing a scam from a set of sources like phone call, sms, email. They were also asked about prior scam experience.

Experiences with Digital Scams Post-Incarceration in the U.S.

Presenter: Yael Eiger, University of Washington

Incarcerated people are more commmen than you might realize. It is in the millions. 7.6 millions times a year people are sent to jail because they cannot make bail and must stay there till their case is resolved. More people are Incarcerated than are convited of any crime.

Research looks at how previously Incarcerated people experience scams. The research is interesting in pointing out what it is like to experience all of technology all at once, including setting up accounts. This population is also at great risk from things like parking tickets, which makes scams more scary.

This group also have to register their existance, so they are in public databases which scammers then use.

Session: At risk and vulnerable users

Usability Determines Safety for At-Risk Users: Evaluating Hidden Device Detectors for Intimate Partner Surveillance

Presenter: Akhil Polamarasetty, University College London (UCL)

Trackers are now cheap to obtain, and easy to buy. There are also lots of detectors. Physical dtectors use things like RF Signal Detection, Magnetometer, Lens Detection. There are also mobile apps that do things like scanning wifi and bluetooth.

The researchers did several rounds of testing of various devices, such as testing in an anechoic chapber and dark room to see what the detectors could do in opitmal conditions. Then had users try them in a fake living room.

Users searched the room in two ways:

Intuitive: looked for sply-looking objects like clocks
Systematic: Divide a room into a grid and looked at most objects. This tactic was more common for people with law enforcement background

Having a physical detector tended to make people feel more vulnerable, even though they were in a safe lab space.

Goals, Risks, and Safety Practices in Online Labor Abuse Disclosures

Presenter: Tarini Saka

Recovery from serious security issues is challenges. Many people turn to online support. But the online communities themselves have minimal security.

This work looks at the context of labor abuse. For this group Human Resource departments, which are the reporting destination, may not help and re-traumitize instead. Instead people try to find groups to communicate with safely about what they can do.

Labor abuse survivers form networks across platforms where they are forming an audience. Compare them to activists who have nation-state abilities. Labor abuse victim face locally powerful adversaries that have financial and direct ability to impact the victim, but they have less ability to impact the technology world.

This is an interview and thematic analysis study.

Many people reached out to understand if their situation was indeedproblematic or if they were just “crazy”. The researchres group into four types of communication groups: feed-based groups, publicly visible threads, Messaging groups, ???

Presenter: Sohana Akter, University of Texas at San Antonio

Instant messsaging is used for a large parts of personal and professional life. The same is true for the Blind and Partially Sighted users.

Blind and low vision people may have further issues like tryingn to understand an image, others might hear a screen reader, and then there are privacy controls….

Just moving a mouse into some spaces can activate things, but a blind user has no way to know that will or has happened. Tags like “last seen” are intended to be seen at a glance, but that is more challenging for partially sighted.

Some information entry is irreversible, which is more challenging when using a screen reader which may not properly explain what information is entered or why.

[]“Don’t Let Them Get To You”: Understanding the Role of TikTok as a Source of Support for Cyberbullying Victims](https://www.usenix.org/conference/soups2026/presentation/iqbal)

Presenter: Daniel Zappala, Brigham Young University, on behalf of Saba Iqbal

Cyberbulling is increasing as a problem in the US.

Prior work shows that sorting through security and privacy advice is challenging and users strugggle to prioritize it.

This work looks at the cyberbulling advice that exists on TicTok and how accurate that advice is.

Looked through lots of TicTok videos and found, that there were roughly 5 categories of advice:

Coping strategies
- Things like: don’t respond, block and report, take a break, comfort the bully
Emotional Support
- Reassuring that bulling is not acceptable, not true, projection of bully insecurities, empower yourself.
Mental Health Advice
- Set boundaries, don’t take it personal, exercise, journaling, get sleep,
Spiritual Support
- Support based on faith things like: Turn the other cheek, god is watching over you,
Seeking support
- Guidance on where to turn to. Like get evidence, contact law enforcement

Survey was then run where asked about experiences, and asked them the rate the content of the videos (text transcription). Rated baed on: comprhensibility, efficacy, actionability.

Most advice was rated as comprehensible. Most advice was considered effective. The spiritual category was rated lower for being helpful. About 1/3 of advice was considered actionable. Confrunting the bully, for example, were not seen as actionable.

Reproductive Security & Privacy Advice on TikTok after the Overturn of Roe

Presenters: Harshini Sri Ramulu and Rachel Gonzalez Rodriguez, Paderborn University

The overturning of Roe vs Wade in the US lead to many women suddenly loosing reproductive care and requests for information about how to protect themselves.

Study looked at TikToc videos that gave advice on protect yourself as a woman in the US. The covered issues like how to not track mentration (delete period tracking apps). There were lots of contradictory advice, such as using apps in Europe or not using apps because they were in Europe. Some advice also suggested creating a fake data.

Symposium on Usable Privacy and Security (SOUPS 2026) - Day 1

Mon, 24 Aug 2026 07:02:13 -0400

Welcome to the Symposium on Usable Security and Privacy happening in Hannover, Germany and being hosted by CISPA. The SOUPS community is made up of researchers that care about understanding and improving peoples’ interactions with security and privacy technologies. Research in this area represents a very wide range of cybersecurity and privacy topics with a focus on people.

Blog posts:

Authentication & Credentials

An Analysis of the Security, Usability, and Automation Capabilities of Password Update Processes on Top-Ranked Websites

Presenter: Alexander Krause

Updating passwords is something many people do. But do websites always support password resets and how easy is it to reset passwords?

Users have many situations where they might want to change their password:

Maybe they just want to feel more secure
Maybe they lost their password
Maybe they want to make it more challenges

Goal of the work is to look at three questions:

How do websites implement password update processes?
How doe sit go wrong?
How can we do it better?

The researchers looked through the password reset processes on a large number of websites. There is also a W3P password reset link that they tested.

The path is long - finding and resetting passwords is not easy. 3-6 clicks. And the setting is hiding in many differently-named locations.

Only 1 of 111 check the new passwords against leaked ones
Only 2 have a generator built into the site
Only 9 can fil the form correctly with a password manager

There is not much feedback either. Some feedback only shows for 1-2 seconds. Some give no feedback at all. Leaving a user to ask “did it work”? 34 of 96 change flows and 46 of 109 reset flows sends no email.

Note that the lack of email is bad for abuse situations as it means that an attacker could change someone’s password without their immediate knowledge

Recommendations

End other user sessions when a password challenges
Always send an email which includes a “if you didn’t do this, how to fix” link
Make the W3C password URL work by default

Passkeys in the Wild:

Presenter: Michael Clark

Passkeys are a phishing-resistant authentication built off the FIDO2 (WebAuthn + CTAP) technology. It is built on top of public/private key technology. The general idea is that the client computer creates and protects a private key. It then gives the public key to websites during authentication setup. The client prooves its identity by signing a challenge using its private key. The workflow often also involves a user providing a biometiric to the local client device.

Passkey usability dpends on UX consistency - users spend most of their time on other webisstes, so they expect your site to work like all the other sites they already know. (Jakob’s law)

Evaluated 111 websites, looked at user paths through the websites. Looked at 28 different features and used it to measure similarity.

Discovery
- Promotion, priority, educatinal resources, naming of the feature
Setup
Usage
Deletion
- Super important for recovery after attack by in-home attackers or malware

Found that there was a lack of full support for the full lifecycle.

Only 3% use PassKeys during password recovery
Only 23% told the user to also delete a deleted passkey from their local passkey manager

Missmatch in that websites let you use passkeys, but non gave information on how to create one.

Mobile apps are not letting users use a passkey that was originally setup on the website.

How Users Enter Generated Passwords on Non-Desktop Devices

Presenter: John Sadik

Password managers are super useful, but it can be challenging for users to use them.

Kami got distracted….

Not All Is Lost: Partial Recovery & Memorability in Self-Sovereign Digital Identity

Presenter: Sushanth Ambati, Rowan University

Digital identity management can be challenging. Self-soverenty where users are fully in charge of their own identity management can be empowering and allow great things like flexibility and freedome from government decisions. But it also makes it harder for the user who now has to handle issues like backup, loss, storage, and all these issues.

Contributions:

Baseline Evaluation of 128-bit Keys
Partial Key Recovery
Cognitive-Driven Key Recovery

It would be wonderful if people could memorize 128-bit keys which are massively better than passwords. But well, human memory does not work like that. Humans are very good at memorizing other information though, like location of objects in spaces, sets of images, and lots of others.

Idea is to create a type of graphical approach to key recovery. An imporant realization is that memory is not normally completely wrong, it is normlly partially wrong and partially right.

Session 2: Families & Shared Devices

SoK: The Design Space of Usable Privacy Interventions for Parents: A Systematization of Knowledge

Presenter: Ann-Kristin Lieberknecht, Goethe University Frankfurt

Manging privacy and security is a challenge for parents and there is quite a bit of fragmented reserach on this topic.

How is knowlege about parental privacy actually translated into intervention design.

Reviewed 22 research papers that looked at active interventions by parents on the topic of security and privacy.

Found a very wide range of interventions ranging from parents to schools, to how the delivery happened or what content was in it. The research in this area is very fragmented and similarly the design of intervetions is quite fragmented.

Design space tensions

Supporting action without oversimplifying
Individual responsibility with distributed family expertise

Families with children grow over time whith knowledge and expertise changing across time.

Scalablility Constraints

Depth, adaptation and scalability hard to do all at the same time

The research field is better developed in problem articulation than in intervention validation.

“They are not my children to post”: Examining Non-Parental Sharenting Practices in In-home Childcare

Presenter: Franziska Roesner, University of Washington on behalf of Meghna Gupta

The practice of sharing photos, videos, or other information about their own parent’s own children via online platforms. They share to:

Document memorieis and milestones
Showcasing their parental identity
Seeking community support

There are also online harms and risks to sharing:

Offline harms: bullying, embarasment
Online harms: identity theft

Non-parents also create and share information about children like Grandparents, extende family, and professional caregivers (coaches, teachers, daycare workers)

Research focus is on in-home childcare workers. This group forms a deep bond with a family and is very involved.

Semi-structured interviews with 8 parents, 7 in-home childcare workers. Goal was to understand prevaleng norms, perceptions and negotiations that occur.

In-home childcare workers often take photos:

Children request that photos be taken
Parents ask for photos
- Documentation request
- Documentation as proof of work
Childcare workers want to record moments

Privacy norms are not normally explicitly stated. Sometimes contracts will state about sharing, but parents are downloading a template of employment contract and maybe not thinking about it. More experience childcare workers were more explicit about establishing boundaries. Most of the workers had to interpret what the parents wanted.

No consistent norm for what to do when a child care worker stopped employment. Deleting photos requests can be taken personally because the childcare worker is deeply involved in raising the child. Who owns these photos is also confusing and who gets to judge.

Presenter: S. Shanza, University of Waterloo

Immigrants are intersting to study. 1 in 4 Canadians is an immigrant, many from “collectivist” cultures where objects, including devices, are viewed a communally owned.

In collectivist households sharing of devices is normal as many things are owned by “the family” as opposed to by an individual. But many devices are designed to be owned by a single user. Or at least to have one user behind one each account.

Interviewed 18 families (at least one parent and one child) who had immigrated in the last 20 years. 41 participants in total.

Device sharing is used as a form of control over children behavior. Because the device is shared the parents can see. Devices are meant to be kept in a “clean” state. Even parent devices are kept like that.

Device sharing does cause stress. Children described being stressed about having fights about content with parents. And parents were stressed about things like having their own work disrupted because tools or internet access were removed so students would not have them. Also about how to keep children safe and give them good vlaues.

Shared devices also mean shared security practices. If anyone, even children, clicks on the wrong thing and gets malware, it impacts the whole family because all the access is happening via a shared devices, even banking.

While tools like profiles exist to support different users on one device, they were hidden behind lots of settings so they were not used.

From Thrift Stores to Digital Storefronts: Users’ Perspectives on Privacy and Security of Online Second-Hand Shopping in Germany

Presneter: Darya Zarkalam, Paderborn University

Offline second-hand shopping has existed for a long time. These platforms have moved online, for example eBay or Vinted. These markets are unique in that they provid features like messaging, ratings, payment and shippment. But ultipmately users decide how to complete the transactions.

Scammers are definitely use these platforms too.

Study looked at how people think about and use these platforms from a security and privacy perspective.

Users security and privacy concerns
Users perceptions
Users strategies for avoiding loss
How users build and establish trust

Participants were concerned about security and privacy. They worried about sharing data about themselves like their phone number.

Users tried to protect themselves. They tried to use payment methods they considered safe like cash, or paypal where there is documentation. Integrated payment features were seen as reducing odds of financial loss, platform can be involved if something goes wrong.

They avoid sharing sensitive details. They shared data progressively as it was needed.

Reputation signals were used. Such as not talking to people who had lower reputation scores.

Platforms provide little guidance

Keynote: Usable Security in Practice - How Tuta Makes Email Encryption Usable

Presenter: Carmela Troncoso

“Turn on privacy”

Tuta provides end-to-end encrypted email services using quantum-secure encryption. It enables automatic encryption between Tula users. For communications with non-Tula accounts a password is shared in advance and then can be used for all future communications.

Tuta aims to enable Digital Sovereignty or just alow people to have control over their own digital life.

Migrating to Hybrid Cryptography in Practice: The TutaCrypt Protocol and Its Security

Seamless encryption is more than just who possesses the private key. Issues like groups communicating (group keys).

Keeping up with tech is also non-trivial. If only a user has a key (or the password to unlock the key) then by definition the company does not have it. That makes it hard to do things like update encryption algorithums to the latest quantum-protected ones. Now it is only possible to update the algorithums when each user logs in when the keys become available.

Legal protections are also a serious concern. Tuta is hosted in Germany allowing them to benifit from German laws and the GDPR which gives users legal protection not just technical protection.