Learning and Adopting Security Behaviors

Exploring where and how people learn security behavior and decide which to adopt, and investigating how to improve security advice and communications.

Selected Publications

The role of professional product reviewers in evaluating security and privacy. Wentao Guo, Jason Walter, and Michelle L. Mazurek. USENIX Security 2023.

Investigating influencer VPN ads on YouTube. Omer Akgul, Richard Roberts, Moses Namara, Dave Levin, and Michelle L. Mazurek. IEEE S&P 2022.

A comprehensive quality evaluation of security and privacy advice on the web. Elissa M. Redmiles, Noel Warford, Amritha Jayanti, Aravind Koneru, Sean Kross, Miraida Morales, Rock Stevens, and Michelle L. Mazurek. USENIX Security 2020.

The effect of entertainment media on people’s mental models of computer security. Kelsey R. Fulton, Rebecca Gelles, Alexandra McKay, Richard Roberts, Yasmin Abdi, and Michelle L. Mazurek. SOUPS 2019.

Dancing pigs or externalities? Measuring the rationality of security decisions. Elissa M. Redmiles, Michelle L. Mazurek, and J.P. Dickerson. EC 2018.

I think they’re trying to tell me something: Advice sources and selection for digital security. Elissa M. Redmiles, Amelia R. Malone, and Michelle L. Mazurek. S&P 2016.

Back

Human Aspects of Secure Software Development

Understanding how and why developers introduce security problems.

Selected Publications

Understanding the how and the why: Exploring secure development practices through a course competition. Kelsey R. Fulton, Daniel Votipka, Desiree Abrokwa, Michelle L. Mazurek, Michael Hicks, and James Parker. CCS 2022.

Benefits and drawbacks of adopting a secure programming language: Rust as a case study. Kelsey R. Fulton, Anna Chan, Daniel Votipka, Michael Hicks, and Michelle L. Mazurek. SOUPS 2021.

Understanding security mistakes developers make: Qualitative analysis from Build It, Break It, Fix It. Daniel Votipka, Kelsey R. Fulton, James Parker, Matthew Hou, Michelle L. Mazurek, and Michael Hicks. USENIX Security 2020.

A qualitative investigation of insecure code propagation from online forums. Wei Bai, Omer Akgul, and Michelle L. Mazurek. SecDev 2019.

Comparing the usability of cryptographic APIs. Yasemin Acar, Michael Backes, Sascha Fahl, Simson Garfinkel, Doowon Kim, Michelle L. Mazurek, and Christian Stransky. S&P 2017.

You are not your developer, either: A research agenda for usable security and privacy research beyond end users. Yasemin Acar, Sascha Fahl, and Michelle L. Mazurek. In SecDev 2016: IEEE Cybersecurity Development Conference. November 2016. PDF.

You get where you’re looking for: The impact of information sources on code security. Yasemin Acar, Michael Backes, Sascha Fahl, Doowon Kim, Michelle L. Mazurek, and Christian Stransky. S&P 2016.

For More Information

Or to join our participant panel, visit the Security Professionals page.

Back

Security and Privacy for At-Risk Users

Exploring the security and privacy needs of at-risk, vulnerable, and marginalized users.

Selected Publications

SoK: Safer digital-safety research involving at-risk users. Rosanna Bellini, Emily Tseng, Noel Warford, Alaa Daffalla, Tara Matthews, Sunny Consolvo, Jill Woelfer, Patrick Gage Kelley, Michelle L. Mazurek, Dana Cuomo, Nicola Dell, and Thomas Ristenpart. IEEE S&P 2024.

How library IT staff navigate privacy and security challenges and responsibilities. Alan F. Luo, Noel Warford, Samuel Dooley, Rachel Greenstadt, Michelle L. Mazurek, and Nora McDonald. USENIX Security 2023.

Vulnerability discovery for all: Experiences of marginalization in vulnerability discovery. Kelsey R. Fulton, Samantha Katcher, Kevin Song, Daniel Votipka, Marshini Chetty, Michelle L. Mazurek, and Chloé Messdaghi. IEEE S&P 2023.

SoK: A framework for unifying at-risk user research. Noel Warford, Tara Matthews, Kaitlyn Yang, Omer Akgul, Sunny Consolvo, Patrick Gage Kelley, Nathan Malkin, Michelle L. Mazurek, Manya Sleeper, and Kurt Thomas. IEEE S&P 2022.

“It’s stressful having all these phones”: Investigating sex workers’ safety goals, risks, and practices online. Allison McDonald, Catherine Barwulor, Michelle L. Mazurek, Florian Schaub, and Elissa M. Redmiles. USENIX Security 2021.

Back

Security Professionals

Exploring how security professionals do their work, measuring best practices, and developing better tools and processes.

Selected Publications

Bug hunters’ perspectives on the challenges and benefits of the bug bounty ecosystem. Omer Akgul, Taha Eghtesad, Amit Elazari, Omprakash Gnawali, Jens Grossklags, Michelle L. Mazurek, Daniel Votipka, and Aron Laszka. USENIX Security 2023.

Vulnerability discovery for all: Experiences of marginalization in vulnerability discovery. Kelsey R. Fulton, Samantha Katcher, Kevin Song, Daniel Votipka, Marshini Chetty, Michelle L. Mazurek, and Chloé Messdaghi. IEEE S&P 2023.

How ready is your ready? Assessing the usability of incident response playbook frameworks. Rock Stevens, Daniel Votipka, Josiah Dykstra, Fernando Tomlinson, Erin Quartararo, Colin Ahern, and Michelle L. Mazurek. CHI 2022.

HackEd: A pedagogical analysis of online vulnerability discovery exercises. Daniel Votipka, Eric Zhang, and Michelle L. Mazurek. IEEE S&P 2021.

An observational investigation of reverse engineers’ processes. Daniel Votipka, Seth Rabin, Kristopher Micinski, Jeffrey S. Foster, and Michelle L. Mazurek. USENIX Security 2020.

Compliance cautions: Investigating security issues associated with U.S. digital-security standards. Rock Stevens, Josiah Dykstra, James Chapman, Wendy Knox Everette, Garrett Bladow, Alexander Farmer, Kevin Halliday, and Michelle L. Mazurek. NDSS 2020.

The battle for New York: A case study of applied digital threat modeling at the enterprise level. Rock Stevens, Daniel Votipka, Elissa M. Redmiles, Colin Ahern, Patrick Sweeney, and Michelle L. Mazurek. USENIX Security 2018.

Hackers vs. testers: A comparison of software vulnerability discovery processes. Daniel Votipka, Rock Stevens, Elissa M. Redmiles, Jeremy Hu, and Michelle L. Mazurek. S&P 2018.

For More Information

Or to join our participant panel, visit the Security Professionals page.

Back

Adoption and Understanding of Secure Communications

Exploring mental models of secure communication and developing strategies to promote their adoption and effective use.

Selected Publications

Is cryptographic deniability sufficient? Non-expert perceptions of deniability in secure messaging. Nathan Reitinger, Nathan Malkin, Omer Akgul, Michelle L. Mazurek, and Ian Miers. IEEE S&P 2023.

Evaluating in-workflow messages for improving mental models of end-to-end encryption. Omer Akgul, Wei Bai, Shruti Das, and Michelle L. Mazurek. USENIX Security 2021.

Improving non-experts’ understanding of end-to-end encryption: An exploratory study. Wei Bai, Michael Pearson, Patrick Gage Kelley, and Michelle L. Mazurek. EuroUSEC 2020.

An inconvenient trust: User attitudes toward security and usability tradeoffs for key-directory encryption systems. Wei Bai, Doowon Kim, Moses Namara, Yichen Qian, Patrick Gage Kelley, and Michelle L. Mazurek. SOUPS 2016.

Back

Transparency in Online Tracking and Inferencing

Making tracking and inferencing more visible; exploring user reactions and preferences.

Selected Publications

Data subjects’ reactions to exercising their right of access. Arthur Borem, Elleen Pan, Olufunmilola Obielodan, Aurelie Roubinowitz, Luca Dovichi, Michelle L. Mazurek, and Blase Ur. USENIX Security 2024.

What does it mean to be creepy? Responses to visualizations of personal browsing activity, online tracking, and targeted ads. Nathan Reitinger, Bruce Wen, Michelle L. Mazurek, and Blase Ur. PoPETS 2024(3).

Pursuing usable and useful data downloads under GDPR/CCPA access rights via co-design. Sophie Veys, Daniel Serrano, Madison Stamos, Margot Herman, Nathan Reitinger, Michelle L. Mazurek, and Blase Ur. SOUPS 2021.

What Twitter knows: Characterizing ad targeting practices, user perceptions, and ad explanations through users’ own Twitter data. Miranda Wei, Madison Stamos, Sophie Veys, Nathan Reitinger, Justin Goodman, Margot Herman, Dorota Filipczuk, Ben Weinshel, Michelle L. Mazurek, and Blase Ur. USENIX Security 2020.

Oh, the places you’ve been! User reactions to longitudinal transparency about third-party web tracking and inferencing. Ben Weinshel, Miranda Wei, Mainack Mondal, Eurim Choi, Sixiong Shan, Claire Dolin, Michelle L. Mazurek, and Blase Ur. CCS 2019.

Unpacking perceptions of data-driven inferences underlying online targeting and personalization. Claire Dolin, Ben Weinshel, Shawn Shan, Chang Min Hahn, Euirim Choi, Michelle L. Mazurek, and Blase Ur. CHI 2018.

Exploring user perceptions of discrimination in online targeted advertising. Angelisa C. Plane, Elissa M. Redmiles, Michelle L. Mazurek, Michael C. Tschantz. USENIX Security 2017.

Back

Research Methods in Human-Centered Security

Comparing and characterizing methods for sampling and data collection, documenting best practices, and building research tools.

Selected Publications

SoK: Safer digital-safety research involving at-risk users. Rosanna Bellini, Emily Tseng, Noel Warford, Alaa Daffalla, Tara Matthews, Sunny Consolvo, Jill Woelfer, Patrick Gage Kelley, Michelle L. Mazurek, Dana Cuomo, Nicola Dell, and Thomas Ristenpart. IEEE S&P 2024.

Designing a data-driven survey system: Leveraging participants’ online data to personalize surveys. Lev Velykoivanenko, Kavous Salehzadeh Niksirat, Stefan Teofanovic, Bertil Chapuis, Michelle L. Mazurek, and Kévin Huguenin. CHI 2024.

Comparing security and privacy attitudes between iOS and Android users in the U.S. Desiree Abrokwa, Shruti Das, Omer Akgul, and Michelle L. Mazurek. SOUPS 2021.

Building and validating a scale for secure software development self-efficacy. Daniel Votipka, Desiree Abrokwa, and Michelle L. Mazurek. CHI 2020.

How well do my results generalize? Comparing security and privacy survey results from MTurk, web, and telephone samples. Elissa M. Redmiles, Sean Kross, and Michelle L. Mazurek. S&P 2019.

Asking for a friend: Evaluating response biases in security user studies. Elissa M. Redmiles, Ziyun Zhu, Sean Kross, Dhruv Kuchhal, Tudor Dumitras, and Michelle L. Mazurek. CCS 2018.

Security developer studies with GitHub users: Exploring a convenience sample. Yasemin Acar, Christian Stransky, Dominik Wermke, Michelle L. Mazurek, and Sascha Fahl. SOUPS 2017.

Back

Other fun projects

Assorted whatchamacallits and thingamajigs.

Selected Publications

User attitudes on direct-to-consumer genetic testing. Debjani Saha, Anna Chan, Brook Stacy, Kiran Javkar, Sushant Patkar, and Michelle L. Mazurek. EuroS&P 2020.

Measuring non-expert comprehension of machine learning fairness metrics. Debjani Saha, Candice Schumann, Duncan C. McElfresh, John P. Dickerson, Michelle L. Mazurek, and Michael Carl Tschantz. ICML 2020.

The effect of entertainment media on people’s mental models of computer security. Kelsey R. Fulton, Rebecca Gelles, Alexandra McKay, Richard Roberts, Yasmin Abdi, and Michelle L. Mazurek. SOUPS 2019.

Does being verified make you more credible? Account verification’s effect on tweet credibility. Tavish Vaidya, Daniel Votipka, Michelle L. Mazurek, and Micah Sherr. CHI 2019.

Back