45 citations · 117 across the 16 of their papers we have counts for
23 papers
Nudging Users to Change Breached Passwords Using the Protection Motivation Theory
Yixin Zou, Khue Le, Peter Mayer +3
We draw on the Protection Motivation Theory (PMT) to design nudges that encourage users to change breached passwords. Our online experiment (=) compared the effectiveness…
How Does Connecting Online Activities to Advertising Inferences Impact Privacy Perceptions?
Florian M. Farke, David G. Balash, Maximilian Golla +1
Data dashboards are designed to help users manage data collected about them. However, prior work showed that exposure to some dashboards, notably Google's My Activity dashboard, re…
Honesty is the Best Policy: On the Accuracy of Apple Privacy Labels Compared to Apps' Privacy Policies
Mir Masood Ali, David G. Balash, Monica Kodwani +2
Apple introduced privacy labels in Dec. 2020 as a way for developers to report the privacy behaviors of their apps. While Apple does not validate labels, they also require develope…
Educators' Perspectives of Using (or Not Using) Online Exam Proctoring
David G. Balash, Rahel A. Fainchtein, Elena Korkes +3
The onset of the COVID-19 pandemic changed the landscape of education and led to increased usage of remote proctoring tools that are designed to monitor students when they take ass…
Longitudinal Analysis of Privacy Labels in the Apple App Store
David G. Balash, Mir Masood Ali, Monica Kodwani +3
In December of 2020, Apple started to require app developers to self-report privacy label annotations on their apps indicating what data is collected and how it is used.To understa…
Security and Privacy Perceptions of Third-Party Application Access for Google Accounts (Extended Version)
David G. Balash, Xiaoyuan Wu, Miles Grant +2
Online services like Google provide a variety of application programming interfaces (APIs). These online APIs enable authenticated third-party services and applications (apps) to a…
"I have no idea what they're trying to accomplish:" Enthusiastic and Casual Signal Users' Understanding of Signal PINs
Daniel V. Bailey, Philipp Markert, Adam J. Aviv
We conducted an online study with Signal users on their understanding and usage of PINs in Signal. In our study, we observe a split in PIN management and composition stra…
Examining the Examiners: Students' Privacy and Security Perceptions of Online Proctoring Services
David G. Balash, Dongkun Kim, Darikia Shaibekova +3
In response to the Covid-19 pandemic, educational institutions quickly transitioned to remote learning. The problem of how to perform student assessment in an online environment ha…
Strategies and Perceived Risks of Sending Sensitive Documents
Noel Warford, Collins W. Munyendo, Ashna Mediratta +2
People are frequently required to send documents, forms, or other materials containing sensitive data (e.g., personal information, medical records, financial data) to remote partie…
Are Privacy Dashboards Good for End Users? Evaluating User Perceptions and Reactions to Google's My Activity (Extended Version)
Florian M. Farke, David G. Balash, Maximilian Golla +2
Privacy dashboards and transparency tools help users review and manage the data collected about them online. Since 2016, Google has offered such a tool, My Activity, which allows u…
Holes in the Geofence: Privacy Vulnerabilities in "Smart" DNS Services
Rahel A. Fainchtein, Adam J. Aviv, Micah Sherr +2
Smart DNS (SDNS) services advertise access to "geofenced" content (typically, video streaming sites such as Netflix or Hulu) that is normally inaccessible unless the client is with…
Why Older Adults (Don't) Use Password Managers
Hirak Ray, Flynn Wolf, Ravi Kuber +1
Password managers (PMs) are considered highly effective tools for increasing security, and a recent study by Pearman et al. (SOUPS'19) highlighted the motivations and barriers to a…
Widely Reused and Shared, Infrequently Updated, and Sometimes Inherited: A Holistic View of PIN Authentication in Digital Lives and Beyond
Hassan Khan, Jason Ceci, Jonah Stegman +3
Personal Identification Numbers (PINs) are widely used as an access control mechanism for digital assets (e.g., smartphones), financial assets (e.g., ATM cards), and physical asset…
Double Patterns: A Usable Solution to Increase the Security of Android Unlock Patterns
Timothy J. Forman, Adam J. Aviv
Android unlock patterns remain quite common. Our study, as well as others, finds that roughly 25\% of respondents use a pattern when unlocking their phone. Despite known security i…
Knock, Knock. Who's There? On the Security of LG's Knock Codes
Raina Samuel, Philipp Markert, Adam J. Aviv +1
Knock Codes are a knowledge-based unlock authentication scheme used on LG smartphones where a user enters a code by tapping or "knocking" a sequence on a 2x2 grid. While a lesser u…
A Survey of Collection Methods and Cross-Data Set Comparison of Android Unlock Patterns
Adam J. Aviv, Markus Duermuth
Android's graphical password unlock remains one of the most widely used schemes for phone unlock authentication, and it is has been studied extensively in the last decade since its…
Comparing Video Based Shoulder Surfing with Live Simulation
Adam J. Aviv, Flynn Wolf, Ravi Kuber
We analyze the claims that video recreations of shoulder surfing attacks offer a suitable alternative and a baseline, as compared to evaluation in a live setting. We recreated a su…
Classifying Eyes-Free Mobile Authentication Techniques
Flynn Wolf, Adam J. Aviv, Ravi Kuber
Mobile device users avoiding observational attacks and coping with situational impairments may employ techniques for eyes-free mobile unlock authentication, where a user enters his…
Towards Understanding Connections between Security/Privacy Attitudes and Unlock Authentication
Adam J. Aviv, Ravi Kuber
In this study, we examine the ways in which user attitudes towards privacy and security relating to mobile devices and the data stored thereon may impact the strength of unlock aut…
Towards Baselines for Shoulder Surfing on Mobile Authentication
Adam J. Aviv, John T. Davin, Flynn Wolf +1
Given the nature of mobile devices and unlock procedures, unlock authentication is a prime target for credential leaking via shoulder surfing, a form of an observation attack. Whil…
Deterministic, Stash-Free Write-Only ORAM
Daniel S. Roche, Adam J. Aviv, Seung Geol Choi +1
Write-Only Oblivious RAM (WoORAM) protocols provide privacy by encrypting the contents of data and also hiding the pattern of write operations over that data. WoORAMs provide bette…
ObliviSync: Practical Oblivious File Backup and Synchronization
Adam J. Aviv, Seung Geol Choi, Travis Mayberry +1
Oblivious RAM (ORAM) protocols are powerful techniques that hide a client's data as well as access patterns from untrusted service providers. We present an oblivious cloud storage…
A Practical Oblivious Map Data Structure with Secure Deletion and History Independence
Daniel S. Roche, Adam J. Aviv, Seung Geol Choi
We present a new oblivious RAM that supports variable-sized storage blocks (vORAM), which is the first ORAM to allow varying block sizes without trivial padding. We also present a…