More Like this

1. “Did You Just Purchase a Butt Head on Amazon?” – A Diary Study of Couples’ Everyday Account Sharing

   https://doi.org/10.1145/3406865.3418340  

   Lin, Junchao; Yu, Irene; Hong, Jason; Dabbish, Laura (October 2020, CSCW '20 Companion: Conference Companion Publication of the 2020 on Computer Supported Cooperative Work and Social Computing)

   null (Ed.)

   Many couples report sharing digital accounts for convenience even though this puts their privacy and security at risk. In order to design for couples' secured information sharing needs, we need to look at their day-to-day account sharing behaviors in context. We conducted a 30-day diary study of daily account sharing behaviors with 14 participants currently in a romantic relationship. We analyzed 382 diary entries and 529 sharing stories to understand couples' everyday sharing behaviors. Our study also coincided with the COVID-19 pandemic, allowing us to discover new sharing behaviors and account uses in quarantine. 

   more » « less
2. Understanding How People Share Passwords

   Moh, Phoebe; Yang, Andrew; Malkin, Nathan; Mazurek, Michelle L (August 2024, USENIX)

   Many systems are built around the assumption that one ac- count corresponds to one user. Likewise, password creation and management is often studied in the context of single-user accounts. However, account and credential sharing is com- monplace, and password generation has not been thoroughly investigated in accounts shared among multiple users. We examine account sharing behaviors, as well as strategies and motivations for creating shared passwords, through a census- representative survey of U.S. users (n = 300). We found that password creation for shared accounts tends to be an individ- ual, rather than collaborative, process. While users tend to have broadly similar password creation strategies and goals for both their personal and shared accounts, they sometimes make security concessions in order to improve password us- ability and account accessibility in shared accounts. Password reuse is common among accounts collectively shared within a group, and almost a third of our participants either directly reuse or reuse a variant of a personal account password on a shared account. Based on our findings, we make recommen- dations for developers to facilitate safe sharing practices. 

   more » « less
3. A Typology of Perceived Triggers for End-User Security and Privacy Behaviors

   Das, Sauvik; Dabbish, Laura A; Hong, Jason I. (January 2019, USENIX Symposium on Usable Privacy and Security (SOUPS))

   What triggers end-user security and privacy (S&P) behaviors? How do those triggers vary across individuals? When and how do people share their S&P behavior changes? Prior work, in usable security and persuasive design, suggests that answering these questions is critical if we are to design systems that encourage pro-S&P behaviors. Accordingly, we asked 852 online survey respondents about their most recent S&P behaviors (n = 1947), what led up to those behaviors, and if they shared those behaviors. We found that social “triggers”, where people interacted with or observed others, were most common, followed by proactive triggers, where people acted absent of an external stimulus, and lastly by forced triggers, where people were forced to act. People from different age groups, nationalities, and levels of security behavioral intention (SBI) all varied in which triggers were dominant. Most importantly, people with low-to-medium SBI most commonly reported social triggers. Furthermore, participants were four times more likely to share their behavior changes with others when they, themselves, reported a social trigger. 

   more » « less
4. Predicting smartphone location-sharing decisions through self-reflection on past privacy behavior

   https://doi.org/10.1093/cybsec/tyaa014  

   Wisniewski, Pamela; Safi, Muhammad Irtaza; Patil, Sameer; Page, Xinru (January 2020, Journal of Cybersecurity)

   null (Ed.)

   Abstract Smartphone location sharing is a particularly sensitive type of information disclosure that has implications for users’ digital privacy and security as well as their physical safety. To understand and predict location disclosure behavior, we developed an Android app that scraped metadata from users’ phones, asked them to grant the location-sharing permission to the app, and administered a survey. We compared the effectiveness of using self-report measures commonly used in the social sciences, behavioral data collected from users’ mobile phones, and a new type of measure that we developed, representing a hybrid of self-report and behavioral data to contextualize users’ attitudes toward their past location-sharing behaviors. This new type of measure is based on a reflective learning paradigm where individuals reflect on past behavior to inform future behavior. Based on data from 380 Android smartphone users, we found that the best predictors of whether participants granted the location-sharing permission to our app were: behavioral intention to share information with apps, the “FYI” communication style, and one of our new hybrid measures asking users whether they were comfortable sharing location with apps currently installed on their smartphones. Our novel, hybrid construct of self-reflection on past behavior significantly improves predictive power and shows the importance of combining social science and computational science approaches for improving the prediction of users’ privacy behaviors. Further, when assessing the construct validity of the Behavioral Intention construct drawn from previous location-sharing research, our data showed a clear distinction between two different types of Behavioral Intention: self-reported intention to use mobile apps versus the intention to share information with these apps. This finding suggests that users desire the ability to use mobile apps without being required to share sensitive information, such as their location. These results have important implications for cybersecurity research and system design to meet users’ location-sharing privacy needs. 

   more » « less
5. Calculating Connection vs. Risk: Understanding How Youth Negotiate Digital Privacy and Security with Peers Online

   https://doi.org/10.1145/3757564  

   Akter, Mamtaj; Park, Jinkyung Katie; Headrick, Campbell Robinson; Page, Xinru; Wisniewski, Pamela J (October 2025, Proceedings of the ACM on Human-Computer Interaction)

   Youth, while tech-savvy and highly active on social media, are still vulnerable to online privacy and security risks. Therefore, it is critical to understand how they negotiate and manage social connections versus protecting themselves in online contexts. In this work, we conducted a thematic analysis of 1,318 private conversations on Instagram from 149 youth aged 13-21 to understand the digital privacy and security topics they discussed, if and how they engaged in risky privacy behaviors, and how they balanced the benefits and risks (i.e., privacy calculus) of making these decisions. Overall, youth were forthcoming when broaching a wide range of topics on digital privacy and security, ranging from password management and account access challenges to shared experiences of being victims of privacy risks. However, they also openly engaged in risky behaviors, such as sharing personal account information with peers and even perpetrating privacy and security risks against others. Nonetheless, we found many of these behaviors could be explained by the unique ''privacy calculus'' of youth, where they often prioritized social benefits over potential risks; for instance, youth often shared account credentials with peers to foster social connection and affirmation. As such, we provide a nuanced understanding of youth decision-making regarding digital security and privacy, highlighting both positive behaviors, tensions, and points of concern. We encourage future research to continue to challenge the potentially untrue narratives regarding youth and their digital privacy and security to unpack the nuance of their privacy calculus that may differ from that of adults. 

   more » « less