"Should I Worry?" A Cross-Cultural Examination of Account Security Incident Response

Redmiles, Elissa M.

doi:10.1109/sp.2019.00059

Cited by 22 publications

(11 citation statements)

References 55 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although other works [14,19,26] have been equally critical of these aforementioned mitigations, research also shows that privacy and security solutions must be targeted [15,21,33,36,42]. As such, this exercise raised several questions that can help guide future work on technology abuse in IPV scenarios:…”

Section: Discussion and Research Questionsmentioning

confidence: 97%

“…As such, this exercise is then used to present several relevant research questions that may help guide future works on online privacy protection of IPV victims in a targeted fashion, considering culture and the reality in which they are immersed. Our goal is to join the chorus of researchers [21,33,36] positing that one-size-fits-all solutions might not be effective and need to consider the reality of specific vulnerable populations.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Brazilian Favela Women: How Your Standard Solutions for Technology Abuse Might Actually Harm Them

Silva¹,

Oliveira²

2021

Preprint

View full text Add to dashboard Cite

Brazil is home to over 200M people, the majority of which have access to the Internet. Over 11M Brazilians live in favelas, or informal settlements with no outside government regulation, often ruled by narcos or militias. Victims of intimate partner violence (IPV) in these communities are made extra vulnerable not only by lack of access to resources, but by the added layer of violence caused by criminal activity and police confrontations. In this paper, we use an unintended harms framework [15] to analyze the unique online privacy needs of favela women and present research questions that we urge tech abuse researchers to consider.

show abstract

Section: Discussion and Research Questionsmentioning

confidence: 97%

Section: Introductionmentioning

confidence: 99%

Brazilian Favela Women: How Your Standard Solutions for Technology Abuse Might Actually Harm Them

Silva¹,

Oliveira²

2021

Preprint

View full text Add to dashboard Cite

show abstract

“…When advised or required to change their passwords by the notification, less than a third of respondents reported any intention to change their passwords [35]. Other recent work has shown that when a security incident occurs that involves accounts on a major social network, people exhibit a variety of responses, from doing nothing to actively seeking out information [69].…”

Section: Awareness and Perceptions Of Security Incidentsmentioning

confidence: 99%

What breach? Measuring online awareness of security incidents by studying real-world browsing behavior

Bhagavatula¹,

Bauer²,

Kapadia³

2020

Preprint

View full text Add to dashboard Cite

Awareness about security and privacy risks is important for developing good security habits. Learning about real-world security incidents and data breaches can alert people to the ways in which their information is vulnerable online, thus playing a significant role in encouraging safe security behavior. This paper examines 1) how often people read about security incidents online, 2) of those people, whether and to what extent they follow up with an action, e.g., by trying to read more about the incident, and 3) what influences the likelihood that they will read about an incident and take some action. We study this by quantitatively examining real-world internet-browsing data from 303 participants.Our findings present a bleak view of awareness of security incidents. Only 16% of participants visited any web pages related to six widely publicized large-scale security incidents; few read about one even when an incident was likely to have affected them (e.g., the Equifax breach almost universally affected people with Equifax credit reports). We further found that more severe incidents as well as articles that constructively spoke about the incident inspired more action. We conclude with recommendations for specific future research and for enabling useful security incident information to reach more people.

show abstract

“…A study about breaches and consumers found that customers' spend-ing at a retailer fell significantly after the retailer suffered a breach [24], while another survey found that only a minority of respondents would stop doing business with a company after a breach [7]. Other work has found that people react to security incidents involving accounts on a major social network in a variety of ways, from doing nothing to actively seeking out information [37].…”

Section: Data Breaches and Security Incidentsmentioning

confidence: 99%

(How) Do people change their passwords after a breach?

Bhagavatula,

Bauer,

Kapadia

2020

Preprint

View full text Add to dashboard Cite

To protect against misuse of passwords compromised in a breach, consumers should promptly change affected passwords and any similar passwords on other accounts. Ideally, affected companies should strongly encourage this behavior and have mechanisms in place to mitigate harm. In order to make recommendations to companies about how to help their users perform these and other security-enhancing actions after breaches, we must first have some understanding of the current effectiveness of companies' post-breach practices. To study the effectiveness of password-related breach notifications and practices enforced after a breach, we examinebased on real-world password data from 249 participantswhether and how constructively participants changed their passwords after a breach announcement.Of the 249 participants, 63 had accounts on breached domains; only 33% of the 63 changed their passwords and only 13% (of 63) did so within three months of the announcement. New passwords were on average 1.3× stronger than old passwords (when comparing log 10 -transformed strength), though most were weaker or of equal strength. Concerningly, new passwords were overall more similar to participants' other passwords, and participants rarely changed passwords on other sites even when these were the same or similar to their password on the breached domain. Our results highlight the need for more rigorous password-changing requirements following a breach and more effective breach notifications that deliver comprehensive advice.

show abstract

"Should I Worry?" A Cross-Cultural Examination of Account Security Incident Response

Cited by 22 publications

References 55 publications

Brazilian Favela Women: How Your Standard Solutions for Technology Abuse Might Actually Harm Them

Brazilian Favela Women: How Your Standard Solutions for Technology Abuse Might Actually Harm Them

What breach? Measuring online awareness of security incidents by studying real-world browsing behavior

(How) Do people change their passwords after a breach?

Contact Info

Product

Resources

About