December 14, 2021 (Inaugural Meeting)

The CATCUS/P Colloquium is a new regional event for the Capital Area (and broader friends) to gather and discuss recent results in Usable Security and Privacy. The Colloquium will consist of both research talks and networking events, and will be hosted twice a year.

Register for the inaugural event, which will be held 12/14/2021 at the University of Maryland, College Park, here

Draft Schedule

(All times EST)

• 9:30AM-9:45AM : Welcome and Intros

• 9:45AM-11:00AM : Research Talks (15 minute presentations, 10 minute Q/A)
  • Noel Warford – University of Maryland, College Park
    • A Framework for Unifying and Applying At-Risk User Research
    • Abstract
    • At-risk users experience elevated digital security, privacy, and safety threats because of who they are, what they do, where they live, or who they are with. In this systematization work, we present a framework for reasoning about at-risk users based on a wide-ranging meta-analysis of 85 papers. Across the diverse populations that we examined (e.g. children, activists, women in developing regions), we identified 10 unifying contextual risk factors -- such as oppression or stigmatization or access to a sensitive resource -- which augment or amplify digital-safety threats and their resulting harms.We also identified technical and non-technical practices that at-risk users adopt to attempt to protect themselves from digital-safety threats. We use this framework to discuss barriers that limit at-risk users' ability or willingness to take protective actions. We believe that the security, privacy, and human-computer interaction research and practitioner communities can use our framework to identify and shape research investments to benefit at-risk users, and to guide technology design to better support at-risk users.
    • Publication Info
    • Work in progress submission
  • Collins Munyendo – The George Washington University
    • “The Same PIN, Just Longer”: On the (In)Security of Upgrading PINs from 4 to 6 Digits
    • Abstract
    • With the goal of improving security, companies like Apple have moved from requiring 4-digit PINs to requiring 6-digit PINs in contexts like smartphone unlocking. Users with an existing 4-digit PIN thus must “upgrade” to a 6-digit PIN for the same device or account. In an online user study (n=1,017), we explore the security of such upgrades. Participants used their own smartphone to first select a 4-digit PIN. They were then directed to select a 6-digit PIN with one of five randomly assigned justifications. In an online attack that guesses a small number of common PINs (10–30), we observe only small differences between the security of 4-digit and 6-digit PINs, confirming prior results. However, we are the first to also model targeted attacks for PIN upgrades. We find that attackers who know a user’s previous 4-digit PIN perform significantly better at guessing their 6-digit PIN in only a few guesses using basic heuristics (e.g., appending digits to the 4-digit PIN). Participants who selected a 6-digit PIN when given a “device upgrade” justification selected 6-digit PINs that were the easiest to guess in a targeted attack, with the attacker successfully guessing over 25% of the PINs in just 10 attempts and more than 30% in 30 attempts. There does not appear to be much security benefit to 6-digit PINs over 4- digit PINs against either targeted or untargeted online attacks. These results suggest that forced “upgrades” from 4-digit to 6-digit PINs may be unnecessary and potentially harmful, similar to the disadvantages of password expiration policies.
    • Publication Info
    • In submission with Collins W. Munyendo, Philipp Markert, Alexandra Nisenoff, Miles Grant, Elena Korkes, Blase Ur, Adam J. Aviv
  • Jaron Mink – University of Illinois at Urbana-Champaign
    • Users Can Deduce Sensitive Locations Protected by Privacy Zones on Fitness Tracking Apps
    • Abstract
    • Fitness-tracking applications allow athletes to share their exercises online, but sharing mobility data creates privacy risks. We present an online user study (n=603) that investigates privacy concerns of fitness-tracking users and evaluates the efficacy of "Privacy Zones" -- a feature that conceals portions of exercise routes that fall within a specified radius of user-designated sensitive locations. Participants were asked about their fitness-tracking privacy behaviors, completed an interactive task in which they attempted to deduce hidden locations protected by a privacy zone, and then answered further questions about fitness privacy. We found that participants successfully inferred protected locations; for the most common privacy zone size, 68% of guesses falling within 50 meters when participants were shown just 3 activities. Further, we found that participants that viewed 3 activities were more confident about their success. Combined, these results indicate that users' privacy-sensitive locations are at risk even when using a privacy zone.
    • Publication Info
    • To appear at CHI 2022 with Amand Rose Yuile, Uma Pal, Adam J. Aviv and Adam Bates

• 11:00AM-11:15AM : Break

• 11:15AM-11:45AM : Work in Progress (WiP) Talks (3 minute presentations, 2 minute Q/A)
  • Julio Poveda – University of Maryland, College Park
    • When Safety is Worth a Thousand Words: Analyzing IPV Survivors’ Initiatives and Online Advice to Overcome Tech Abuse
  • Hunter Dyer – The George Washington University
    • Examining Android Application Mirror Sites
  • Phoebe Moh – University of Maryland, College Park
    • IoT Device Misuse and Snooping
  • David Balash – The George Washington University
    • Privacy nutrition labels on the Apple iOS app store
  • Omer Akgul – University of Maryland, College Park
    • Measuring the Impact of VPN Ads on YouTube
  • Haojian Jin – Human-Computer Interaction Institute, Carnegie Mellon University
    • Mitigating Data Overaccess by Apps through Modular Privacy Flows
  • Parth Thakkar, University of Maryland, Baltimore County
    • Understanding Users’ Perceptions of Online Child Abuse Detection Practices
• 11:45AM-12:00PM : Birds of a Feather Brainstorming
  • Come up with 3-to-4 topics we can break out and brainstorm about

• 12:00PM-1:00PM : Lunch

• 1:00PM-1:30 : Work in Progress (WiP) Talks (3 minute presentations, 2 minute Q/A)
  • Florian Farke – Ruhr University Bochum
    • What People Think Google Learns From Their Activities - Reporting from the Study Development
  • Sunyup Park – University of Maryland, College Park
    • Shared Mental Models in Smart Homes
  • Hasan Mahmud Prottoy – University of Maryland, Baltimore County (HCC)
    • Understanding account sharing practices for online resources
  • Nathan Reitinger – University of Maryland, College Park
    • Evaluating Deniability in Secure Messaging Applications
  • Kiran Prabhu – University of Maryland, Baltimore County
    • Are periodic consents necessary with regard to the use of Facial Recognition Technology systems for patient monitoring?
  • Wentao Guo – University of Maryland, College Park
    • The Role of Product Reviewers in Evaluating Security and Privacy

• 1:30PM-1:45PM : Break

• 1:45PM-2:45PM : Birds of a Feather Breakouts
  • BoF 1
  • BoF 2
  • Bof 3

• 2:45PM-3:00PM : Break

• 3:00PM-4:15PM : Research Talks (15 minute presentations, 10 minute Q/A)
  • Yixin Zou – University of Michigan, School of Information
    • “Now I’m a bit angry:” Consumer Reactions to Data Breaches that Affected Them and Opportunities for Interventions
    • Abstract
    • Data breaches are putting millions of U.S. consumers at risk of identity theft, phishing attacks, and financial harm. We provide novel insights into individuals’ awareness and reactions to specific breaches affecting them through an online study (n=413), in which we showed each participant up to three data breaches that had exposed their email addresses and other personal information. Overall, 73% of participants were affected by at least one breach, 5.36 breaches on average. Nonetheless, participants were unaware of 74% of those breaches that affected them. While some reported intentions to take action following the breach, most believed the breach would not harm them. Based on our findings, we discuss opportunities to better support consumers in reacting to breaches through more effective notifications and protection tools, as well as stronger regulation to hold breached organizations accountable. In ongoing work, we are investigating to what extent participants follow through reported intention to take action and factors that impede action. We are also conducting an online experiment to evaluate the feasibility of using Protection Motivation Theory—i.e., explaining threats of a breach and coping process—to better motivate affected consumers to take action.
    • Publication Info
    • Peter Mayer, Yixin Zou, Florian Schaub, and Adam J. Aviv. "Now I'm a bit angry:" Individuals' Awareness, Perception, and Responses to Data Breaches that Affected Them. 30th USENIX Security Symposium (USENIX Security 21). USENIX Association. Aug 2021.
  • David Balash – The George Washington University
    • Security and Privacy Perceptions of Third-Party Application Access for Google Accounts
    • Abstract
    • Online services like Google provide a variety of application programming interfaces (APIs).These online APIs enable authenticated third-party services and applications (apps) to access a user's account data for tasks such as single sign-on (SSO), calendar integration, and sending email on behalf of the user, among others. Despite their prevalence, API access could pose significant privacy and security risks, where a third-party could have unexpected privileges to a user's account. To gauge users' perceptions and concerns regarding third-party apps that integrate with online APIs, we performed a multi-part online survey of Google users. First, we asked n=432 participants to recall if and when they allowed third-party access to their Google account: 89% recalled using at least one SSO and 52% remembered at least one third-party app. In the second survey, we re-recruited n=214 participants to ask about specific apps and SSOs they've authorized on their own Google accounts. We collected in-the-wild data about users' actual SSOs and authorized apps: 86% used Google SSO on at least one service, and 67% had at least one third-party app authorized. After examining their apps and SSOs, participants expressed the most concern about access to personal information like email addresses and other publicly shared info. However, participants were less concerned with broader---and perhaps more invasive---access to calendars, emails, or cloud storage (as needed by third-party apps). This discrepancy may be due in part to trust transference to apps that integrate with Google, forming an implied partnership. Our results suggest opportunities for design improvements to the current third-party management tools offered by Google; for example, tracking recent access, automatically revoking access due to app disuse, and providing permission controls.
    • Publication Info
    • David G. Balash, Xiaoyuan (Owen) Wu, Miles Grant, Irwin Reyes, and Adam J. Aviv. Security and Privacy Perceptions of Third-Party Application Access for Google Accounts. 31st USENIX Security Symposium (USENIX Security 22). Aug 2022.
  • Kelsey Fulton – University of Maryland, College Park
    • Vulnerability Discovery for All: Experiences of Marginalization in Vulnerability Discovery
    • Abstract
    • Vulnerability discovery is an essential aspect of software security. Currently, the demand for security experts significantly exceeds the available vulnerability discovery workforce. Further, the existing vulnerability discovery workforce is highly homogeneous, dominated by white and Asian men. As such, one promising avenue for increasing the capacity of the vulnerability discovery community is through recruitment and retention from a broader population. Although significant prior research has explored the challenges of equity and inclusion in computing broadly, the competitive and frequently self-taught nature of vulnerability discovery work may create new variations on these challenges. This paper reports on a semi-structured interview study (N = 16) investigating how people from marginalized populations come to participate in vulnerability discovery, whether they feel welcomed by the vulnerability discovery community, and what challenges they face when joining the vulnerability discovery community. We find that members of marginalized populations face some unique challenges, while other challenges common in vulnerability discovery are exacerbated by marginalization.
    • In Submission
    • with, Samantha Katcher, Kevin Song, Daniel Votipka, Marshini Chetty, Michelle Mazurek, and Chloé Messdaghi.

• 4:15PM-4:30PM : Closing

• 4:30PM + : After hours activities (TBD)

Location

University of Maryland, College Park

• Room: 1116 Iribe Center
• Duration: 9:30am-4:30pm (potential for dinner/drinks to follow)

Directions and other information

• All in-person attendees are required to be fully vaccinated against COVID-19. Masks are currently required on campus in all shared spaces.

• The Iribe Center uses European floor numbers, so we’re on the first floor but not the ground floor. There’s also a mezzanine area between the ground and first floors.

• If you are driving, I recommend you park in the lot/garage of “The Varsity” apartments (Baltimore Ave.), which should be both cheaper and a closer walk than using official campus visitor parking. It’s about $2 per hour. They will ticket you quickly if your time expires (campus would also). Watch the signs so you park in the visitor and not resident section.

• If you are using metro, it’s about a 1-mile walk from the station to our building, or you can use the UM shuttle that runs every 10-20 minutes (no ID required). Here’s the schedule. The closest stop is the Glenn L. Martin wind tunnel but the Math Slip isn’t much farther.

• We have eduroam, so if you have an eduroam account you are all set. If you don’t have an eduroam account, you can sign up for a 24-hour pass to the umd-guest wireless network.