Conducting Usable Privacy and Security Studies: It's Complicated

CS547 Human-Computer Interaction Seminars  (Seminar on People, Computers, and Design)

Fridays 12:30-2:20 pm, Open to the public

Gates Building, Rm B01

Lorrie Carnor, Carnegie Mellon University

November 20, 2015
 

Have you ever wondered... Is there anything we can do to get people to pay attention to web browser certificate warnings?

Are people willing to pay for privacy? Why do people keep posting photos on Facebook that get themselves into trouble? Are passphrases really easier for people to remember than passwords?

User studies are critical to answering these and other questions related to how users perceive and interact with security and privacy software and features. However, conducting usable privacy and security studies is complicated. In some studies, researchers recruit participants to perform tasks not directly related to security so that they can observe how participants respond to security-related prompts or cues that occur while users are focused on primary tasks.

Researchers also try to put users in situations where they believe their security or privacy is at risk, while at the same time making sure that participants will not actually suffer harm. When conducting usable security studies there are a lot of methodological details to get right, and studies don't always go quite as planned.

In this talk I will offer a behind-the-scenes look at usable privacy and security study design and present lessons learned from over a decade of user studies at the CyLab Usable Privacy and Security Lab at Carnegie Mellon University. And in the process I'll try to provide some answers to the questions above.

Speaker Bio:

Lorrie Faith Cranor is a Professor of Computer Science and of Engineering and Public Policy at Carnegie Mellon University where she is director of the CyLab Usable Privacy and Security Laboratory (CUPS) and co-director of the MSIT-Privacy Engineering masters program. She is also a co-founder of Wombat Security Technologies, Inc. She has authored over 150 research papers on online privacy, usable security, and other topics. She has played a key role in building the usable privacy and security research community, having co-edited the seminal book Security and Usability (O'Reilly 2005) and founded the Symposium On Usable Privacy and Security (SOUPS).. Read more

Last modified Tue, 3 Nov, 2015 at 9:20