Usable privacy and security researchers have developed a variety of approaches to
represent risk to research participants. To understand how these approaches are used and …

The privacy of individuals does not only depend on their own actions and data but may also
be affected by the privacy decisions and by the data shared by other individuals. This …

End users learn defensive security behaviors from a variety of channels, including a plethora
of security advice given in online articles. A great deal of effort is devoted to getting users to …

We investigate how a population of end-users with especially salient security and privacy
risks---sex workers---conceptualizes and manages their digital safety. The commercial sex …

Two-factor authentication (2FA) is one of the primary mechanisms for defending end-user
accounts against phishing and password reuse attacks. Unfortunately, getting users to adopt …

We examined the authentication procedures used by five prepaid wireless carriers when a
customer attempted to change their SIM card. These procedures are an important line of …

The security field relies on user studies, often including survey questions, to query end
users' general security behavior and experiences, or hypothetical responses to new …

Two-Factor Authentication (2FA) hardens an organization against user account compromise,
but adds an extra step to organizations' mission-critical tasks. We investigate to what extent …

How can we encourage end-user acceptance of expert recommended cybersecurity and
privacy (S&P) behaviors? We review prior art in human-centered S&P and identified three …

With the expansion of the Internet of Things (IoT), the number of security incidents due to
insecure and misconfigured IoT devices is increasing. Especially on the consumer market …