CONFERENCE PAPERS

As advertised? Understanding the impact of influencer VPN ads. Omer Akgul, Richard Roberts, Emma Shroyer, Dave Levin, and Michelle L. Mazurek. In the 2025 USENIX Security Symposium, August 2025. To appear.

Toxicity detection is NOT all you need: Measuring the gaps to supporting volunteer content moderators through a user-centric method. Yang Trista Cao, Lovely-Frances Domingo, Sarah Gilbert, Michelle L. Mazurek, Katherine Shilton, and Hal Daumé III. In EMNLP 2024: Conference on Empirical Methods in Natural Language Processing. November 2024. To appear.

A qualitative analysis of practical de-identification guides. Wentao Guo, Aditya Kishore, Adam Aviv, and Michelle L. Mazurek. In CCS 2024: ACM Conference on Computer and Communications Security. October 2024. To appear.

A decade of Android app reviews about privacy: Large-scale trends. Omer Akgul, Sai Teja Peddinti, Nina Taft, Michelle L. Mazurek, Hamza Harkous, Animesh Srivastava, and Benoit Seguin. In the 2024 USENIX Security Symposium, August 2024. arXiv.

Data subjects' reactions to exercising their right of access. Arthur Borem, Elleen Pan, Olufunmilola Obielodan, Aurelie Roubinowitz, Luca Dovichi, Michelle L. Mazurek, and Blase Ur. In the 2024 USENIX Security Symposium, August 2024. HTML.

How entertainment journalists manage online hate and harassment. Noel Warford, Nicholas Farber, and Michelle L. Mazurek. In SOUPS 2024: USENIX Symposium on Usable Privacy and Security. August 2024. HTML.

"I can say I'm John Travolta...but I'm not John Travolta": Investigating the impact of changes to social media verification policies on user perceptions of verified accounts. Carson Powers, Nickolas Gravel, Christopher Pellegrini, Micah Sherr, Michelle L. Mazurek, and Daniel Votipka. In SOUPS 2024: USENIX Symposium on Usable Privacy and Security. August 2024. HTML.

A survey of cybersecurity professionals' perceptions and experiences of safety and belonging in the community. Samantha Katcher, Liana Wang, Caroline Yang, Chloé Messdaghi, Michelle L. Mazurek, Marshini Chetty, Kelsey R. Fulton, and Daniel Votipka. In SOUPS 2024: USENIX Symposium on Usable Privacy and Security. August 2024. HTML.

Understanding how people share passwords. Phoebe Moh, Andrew Yang, Nathan Malkin, and Michelle L. Mazurek. In SOUPS 2024: USENIX Symposium on Usable Privacy and Security. August 2024. HTML.

Write, read, or fix? Exploring alternative methods for secure development studies. Kelsey R. Fulton, Joseph Lewis, Nathan Malkin, and Michelle L. Mazurek. In SOUPS 2024: USENIX Symposium on Usable Privacy and Security. August 2024. HTML.

SoK: Safer digital-safety research involving at-risk users. Rosanna Bellini, Emily Tseng, Noel Warford, Alaa Daffalla, Tara Matthews, Sunny Consolvo, Jill Woelfer, Patrick Gage Kelley, Michelle L. Mazurek, Dana Cuomo, Nicola Dell, and Thomas Ristenpart. In the 2024 IEEE Symposium on Security and Privacy. May 2024. arXiv.

Designing a data-driven survey system: Leveraging participants' online data to personalize surveys. Lev Velykoivanenko, Kavous Salehzadeh Niksirat, Stefan Teofanovic, Bertil Chapuis, Michelle L. Mazurek, and Kévin Huguenin. In CHI 2024: ACM Conference on Human Factors in Computing Systems. May 2024. Honorable mention. HTML.

How library IT staff navigate privacy and security challenges and responsibilities. Alan F. Luo, Noel Warford, Samuel Dooley, Rachel Greenstadt, Michelle L. Mazurek, and Nora McDonald. In the 2023 USENIX Security Symposium, August 2023. HTML.

The role of professional product reviewers in evaluating security and privacy. Wentao Guo, Jason Walter, and Michelle L. Mazurek. In the 2023 USENIX Security Symposium, August 2023. HTML.

Bug hunters' perspectives on the challenges and benefits of the bug bounty ecosystem. Omer Akgul, Taha Eghtesad, Amit Elazari, Omprakash Gnawali, Jens Grossklags, Michelle L. Mazurek, Daniel Votipka, and Aron Laszka. In the 2023 USENIX Security Symposium, August 2023. Distinguished paper award. HTML.

Optimistic access control for the smart home. Nathan Malkin, Alan F. Luo, Julio Poveda, and Michelle L. Mazurek. In the 2023 IEEE Symposium on Security and Privacy. May 2023. HTML

Characterizing everyday misuse of smart home devices. Phoebe Moh, Pubali Datta, Noel Warford, Adam Bates, Nathan Malkin, and Michelle L. Mazurek. In the 2023 IEEE Symposium on Security and Privacy. May 2023. HTML

Is cryptographic deniability sufficient? Non-expert perceptions of deniability in secure messaging. Nathan Reitinger, Nathan Malkin, Omer Akgul, Michelle L. Mazurek, and Ian Miers. In the 2023 IEEE Symposium on Security and Privacy. May 2023. HTML.

Vulnerability discovery for all: Experiences of marginalization in vulnerability discovery. Kelsey R. Fulton, Samantha Katcher, Kevin Song, Daniel Votipka, Marshini Chetty, Michelle L. Mazurek, and Chloé Messdaghi. In the 2023 IEEE Symposium on Security and Privacy. May 2023. HTML.

Understanding the how and the why: Exploring secure development practices through a course competition. Kelsey R. Fulton, Daniel Votipka, Desiree Abrokwa, Michelle L. Mazurek, Michael Hicks, and James Parker. In CCS 2022: ACM Conference on Computer and Communications Security. November 2022. HTML.

Why users (don't) use password managers at a large educational institution. Peter Mayer, Collins W. Munyendo, Michelle L. Mazurek, and Adam J. Aviv. In the 2022 USENIX Security Symposium. August 2022. HTML.

SoK: A framework for unifying at-risk user research. Noel Warford, Tara Matthews, Kaitlyn Yang, Omer Akgul, Sunny Consolvo, Patrick Gage Kelley, Nathan Malkin, Michelle L. Mazurek, Manya Sleeper, and Kurt Thomas. In the 2022 IEEE Symposium on Security and Privacy. May 2022. HTML.

Investigating influencer VPN ads on YouTube. Omer Akgul, Richard Roberts, Moses Namara, Dave Levin, and Michelle L. Mazurek. In the 2022 IEEE Symposium on Security and Privacy. May 2022. HTML.

How ready is your ready? Assessing the usability of incident response playbook frameworks. Rock Stevens, Daniel Votipka, Josiah Dykstra, Fernando Tomlinson, Erin Quartararo, Colin Ahern, and Michelle L. Mazurek. In CHI 2022: ACM Conference on Human Factors in Computing Systems. May 2022. Honorable mention. HTML.

Garbage collection makes Rust easier to use: A randomized controlled trial of the Bronze garbage collector. Michael Coblenz, Michelle L. Mazurek, and Michael Hicks. In ICSE 2022: The IEEE/ACM International Conference on Software Engineering. May 2022. arXiv.

Above and beyond: Organizational efforts to complement U.S. digital security compliance mandates. Rock Stevens, Faris Bugra Kokulu, Adam Doupé, and Michelle L. Mazurek. In NDSS 2022: Network and Distributed Systems Symposium. February 2022. HTML.

An investigation of online reverse engineering community discussions in the context of Ghidra. Daniel Votipka, Mary Nicole Punzalan, Seth M. Rabin, Yla Tausczik, and Michelle L. Mazurek. In EuroS&P 2021: IEEE European Symposium on Security and Privacy. September 2021. HTML.

Evaluating in-workflow messages for improving mental models of end-to-end encryption. Omer Akgul, Wei Bai, Shruti Das, and Michelle L. Mazurek. In the 2021 USENIX Security Symposium, August 2021. HTML.

"It's stressful having all these phones": Investigating sex workers' safety goals, risks, and practices online. Allison McDonald, Catherine Barwulor, Michelle L. Mazurek, Florian Schaub, and Elissa M. Redmiles. In the 2021 USENIX Security Symposium, August 2021. Distinguished paper award. HTML.

Strategies and perceived risks of sending sensitive documents. Noel Warford, Collins Munyendo, Ashna Mediratta, Adam J. Aviv, and Michelle L. Mazurek. In the 2021 USENIX Security Symposium, August 2021. HTML.

Pursuing usable and useful data downloads under GDPR/CCPA access rights via co-design. Sophie Veys, Daniel Serrano, Madison Stamos, Margot Herman, Nathan Reitinger, Michelle L. Mazurek, and Blase Ur. In SOUPS 2021: USENIX Symposium on Usable Privacy and Security. August 2021. HTML.

Benefits and drawbacks of adopting a secure programming language: Rust as a case study. Kelsey R. Fulton, Anna Chan, Daniel Votipka, Michael Hicks, and Michelle L. Mazurek. In SOUPS 2021: USENIX Symposium on Usable Privacy and Security. August 2021. HTML.

Comparing security and privacy attitudes between iOS and Android users in the U.S. Desiree Abrokwa, Shruti Das, Omer Akgul, and Michelle L. Mazurek. In SOUPS 2021: USENIX Symposium on Usable Privacy and Security. August 2021. HTML.

HackEd: A pedagogical analysis of online vulnerability discovery exercises. Daniel Votipka, Eric Zhang, and Michelle L. Mazurek. In the 2021 IEEE Symposium on Security and Privacy. May 2021. PDF.

User attitudes on direct-to-consumer genetic testing. Debjani Saha, Anna Chan, Brook Stacy, Kiran Javkar, Sushant Patkar, and Michelle L. Mazurek. In EuroS&P 2020: IEEE European Symposium on Security and Privacy. September 2020. HTML.

What Twitter knows: Characterizing ad targeting practices, user perceptions, and ad explanations through users' own Twitter data. Miranda Wei, Madison Stamos, Sophie Veys, Nathan Reitinger, Justin Goodman, Margot Herman, Dorota Filipczuk, Ben Weinshel, Michelle L. Mazurek, and Blase Ur. In the 2020 USENIX Security Symposium, August 2020. HTML.

A comprehensive quality evaluation of security and privacy advice on the web. Elissa M. Redmiles, Noel Warford, Amritha Jayanti, Aravind Koneru, Sean Kross, Miraida Morales, Rock Stevens, and Michelle L. Mazurek. In the 2020 USENIX Security Symposium, August 2020. Distinguished paper award. HTML.

An observational investigation of reverse engineers' processes. Daniel Votipka, Seth Rabin, Kristopher Micinski, Jeffrey S. Foster, and Michelle L. Mazurek. In the 2020 USENIX Security Symposium. August 2020. HTML.

Understanding security mistakes developers make: Qualitative analysis from Build It, Break It, Fix It. Daniel Votipka, Kelsey R. Fulton, James Parker, Matthew Hou, Michelle L. Mazurek, and Michael Hicks. In the 2020 USENIX Security Symposium. August 2020. Distinguished paper award. HTML.

Measuring non-expert comprehension of machine learning fairness metrics. Debjani Saha, Candice Schumann, Duncan C. McElfresh, John P. Dickerson, Michelle L. Mazurek, and Michael Carl Tschantz. In ICML 2020: International Conference on Machine Learning. July 2020. PDF.

Building and validating a scale for secure software development self-efficacy. Daniel Votipka, Desiree Abrokwa, and Michelle L. Mazurek. In CHI 2020: ACM Conference on Human Factors in Computing Systems. May 2020. HTML.

Compliance cautions: Investigating security issues associated with U.S. digital-security standards. Rock Stevens, Josiah Dykstra, James Chapman, Wendy Knox Everette, Garrett Bladow, Alexander Farmer, Kevin Halliday, and Michelle L. Mazurek. In NDSS 2020: Network and Distributed Systems Symposium. February 2020. HTML.

Oh, the places you've been! User reactions to longitudinal transparency about third-party web tracking and inferencing. Ben Weinshel, Miranda Wei, Mainack Mondal, Eurim Choi, Sixiong Shan, Claire Dolin, Michelle L. Mazurek, and Blase Ur. In CCS 2019: ACM Conference on Computer and Communications Security. November 2019. PDF.

Comparing and developing tools to measure the readability of domain-specific texts. Elissa M. Redmiles, Lisa Maszkiewicz, Emily Hwang, Dhruv Kuchhal, Everest Liu, Miraida Morales, Denis Peskov, Sudha Rao, Rock Stevens, Kristina Gligorić, Sean Kross, Michelle L. Mazurek and Hal Daumé III. In EMNLP 2019: Conference on Empirical Methods in Natural Language Processing. November 2019. PDF.

A qualitative investigation of insecure code propagation from online forums. Wei Bai, Omer Akgul, and Michelle L. Mazurek. In SecDev 2019: The IEEE Secure Development Conference. September 2019. PDF.

The effect of entertainment media on people's mental models of computer security. Kelsey R. Fulton, Rebecca Gelles, Alexandra McKay, Richard Roberts, Yasmin Abdi, and Michelle L. Mazurek. In SOUPS 2019: USENIX Symposium on Usable Privacy and Security. August 2019. PDF.

How well do my results generalize? Comparing security and privacy survey results from MTurk, web, and telephone samples. Elissa M. Redmiles, Sean Kross, and Michelle L. Mazurek. In the 2019 IEEE Symposium on Security and Privacy. May 2019. PDF.

Auditing offline data brokers via Facebook's advertising platform. Giridhari Venkatadri, Piotr Sapiezynski, Elissa M. Redmiles, Alan Mislove, Oana Goga, Michelle L. Mazurek and Krishna P. Gummadi. In the Web Conference. May 2019. PDF.

Does being verified make you more credible? Account verification's effect on tweet credibility. Tavish Vaidya, Daniel Votipka, Michelle L. Mazurek, and Micah Sherr. In CHI 2019: ACM Conference on Human Factors in Computing Systems. May 2019. HTML.

Asking for a friend: Evaluating response biases in security user studies. Elissa M. Redmiles, Ziyun Zhu, Sean Kross, Dhruv Kuchhal, Tudor Dumitras, and Michelle L. Mazurek. In CCS 2018: ACM Conference on Computer and Communications Security. October 2018. HTML.

The battle for New York: A case study of applied digital threat modeling at the enterprise level. Rock Stevens, Daniel Votipka, Elissa M. Redmiles, Colin Ahern, Patrick Sweeney, and Michelle L. Mazurek. In the 2018 USENIX Security Symposium. August 2018. Distinguished paper award. PDF.

User comfort with Android background resource accesses in different contexts. Daniel Votipka, Kristopher Micinski, Seth M. Rabin, Thomas Gilray, Michelle L. Mazurek, and Jeffrey S. Foster. In SOUPS 2018: USENIX Symposium on Usable Privacy and Security. August 2018. PDF.

Dancing pigs or externalities? Measuring the rationality of security decisions. Elissa M. Redmiles, Michelle L. Mazurek, and J.P. Dickerson. In EC 2018: ACM Conference on Economics and Computation. June 2018. PDF.

Hackers vs. testers: A comparison of software vulnerability discovery processes. Daniel Votipka, Rock Stevens, Elissa M. Redmiles, Jeremy Hu, and Michelle L. Mazurek. In the 2018 IEEE Symposium on Security and Privacy. May 2018. PDF.

Unpacking perceptions of data-driven inferences underlying online targeting and personalization. Claire Dolin, Ben Weinshel, Shawn Shan, Chang Min Hahn, Euirim Choi, Michelle L. Mazurek, and Blase Ur. In CHI 2018: ACM Conference on Human Factors in Computing Systems. April 2018. HTML.

Understanding user tradeoffs for search in encrypted communication. Wei Bai, Ciara Lynton, Michelle L. Mazurek, and Charalampos (Babis) Papamanthou. EuroS&P 2018: IEEE European Symposium on Security and Privacy. April 2018. PDF.

Developers need support, too: A survey of security advice for software developers. Yasemin Acar, Christian Stransky, Dominik Wermke, Charles Weir, Michelle L. Mazurek, and Sascha Fahl. In SecDev 2017: IEEE Secure Development Conference. September 2017. PDF.

Exploring user perceptions of discrimination in online targeted advertising. Angelisa C. Plane, Elissa M. Redmiles, Michelle L. Mazurek, Michael C. Tschantz. In USENIX SEC 2017: USENIX Security Symposium. August 2017. HTML.

Security developer studies with GitHub users: Exploring a convenience sample. Yasemin Acar, Christian Stransky, Dominik Wermke, Michelle L. Mazurek, and Sascha Fahl. In SOUPS 2017: USENIX Symposium on Usable Privacy and Security. July 2017. PDF.

Diversify to survive: Making passwords stronger with adaptive policies. Sean Segreti, William Melicher, Saranga Komanduri, Darya Melicher, Richard Shay, Blase Ur, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Michelle L. Mazurek. In SOUPS 2017: USENIX Symposium on Usable Privacy and Security. July 2017. PDF.

Comparing the usability of cryptographic APIs. Yasemin Acar, Michael Backes, Sascha Fahl, Simson Garfinkel, Doowon Kim, Michelle L. Mazurek, and Christian Stransky. In the 2017 IEEE Symposium on Security and Privacy. May 2017. PDF.

User interactions and permission use on Android. Kristopher Micinski, Daniel Votipka, Rock Stevens, Nikolaos Kofinas, Michelle L. Mazurek, and Jeffrey S. Foster. In CHI 2017: ACM Conference on Human Factors in Computing Systems. May 2017. PDF.

Where is the digital divide? Examining the impact of socioeconomics on self-reported security and privacy experiences.Elissa M. Redmiles, Sean Kross, and Michelle L. Mazurek. In CHI 2017: ACM Conference on Human Factors in Computing Systems. May 2017. PDF.

You are not your developer, either: A research agenda for usable security and privacy research beyond end users. Yasemin Acar, Sascha Fahl, and Michelle L. Mazurek. In SecDev 2016: IEEE Cybersecurity Development Conference. November 2016. PDF.

Build It, Break It, Fix It: Contesting secure development. Andrew Ruef, Michael Hicks, James Parker, Dave Levin, Michelle L. Mazurek, and Piotr Mardziel. In CCS 2016: ACM Conference on Computer and Communications Security. October 2016. PDF.

How I learned to be secure: A census-representative survey of security advice sources and behavior. Elissa M. Redmiles, Sean Kross, and Michelle L. Mazurek. In CCS 2016: ACM Conference on Computer and Communications Security. October 2016. PDF.

An inconvenient trust: User attitudes toward security and usability tradeoffs for key-directory encryption systems. Wei Bai, Doowon Kim, Moses Namara, Yichen Qian, Patrick Gage Kelley, and Michelle L. Mazurek. In SOUPS 2016: USENIX Symposium on Usable Privacy and Security. June 2016. PDF.

I think they're trying to tell me something: Advice sources and selection for digital security. Elissa M. Redmiles, Amelia R. Malone, and Michelle L. Mazurek. In the 2016 IEEE Symposium on Security and Privacy. May 2016. PDF.

You get where you're looking for: The impact of information sources on code security. Yasemin Acar, Michael Backes, Sascha Fahl, Doowon Kim, Michelle L. Mazurek, and Christian Stransky. In the 2016 IEEE Symposium on Security and Privacy. May 2016. PDF.

Usability and security of text passwords on mobile devices. William Melicher, Darya Kurilova, Sean Segreti, Pranshu Kalvani, Richard Shay, Blase Ur, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Michelle L. Mazurek. In CHI 2016: ACM Conference on Human Factors in Computing Systems. May 2016. PDF.

Sharing personal content online: exploring channel choice and multi-channel behaviors. Manya Sleeper, William Melicher, Hana Habib, Lujo Bauer, Lorrie Faith Cranor, and Michelle L. Mazurek. In CHI 2016: ACM Conference on Human Factors in Computing Systems. May 2016. Paper (PDF), video teaser.

Measuring real-world accuracies and biases in modeling password guessability. Blase Ur, Sean Segreti, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Saranga Komanduri, Darya Kurilova, Michelle L. Mazurek, William Melicher, and Richard Shay. In USENIX SEC 2015: USENIX Security Symposium. August 2015. Paper (PDF), video teaser.

A spoonful of sugar? The impact of guidance and feedback on password-creation behavior. Richard Shay, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Alain Forget, Saranga Komanduri, Michelle L. Mazurek, William Melicher, Sean Segreti, and Blase Ur. In CHI 2015: ACM Conference on Human Factors in Computing Systems. May 2015. PDF.

Can long passwords be secure and usable? Richard Shay, Saranga Komanduri, Adam L. Durity, Phillip (Seyoung) Huh, Michelle L. Mazurek, Sean M. Segreti, Blase Ur, L. Bauer, Nicolas Christin, and Lorrie Faith Cranor. In CHI 2014: ACM Conference on Human Factors in Computing Systems. May 2014. Paper (PDF), video teaser (flash).

Toward strong, usable access control for shared distributed data. Michelle L. Mazurek, Yuan Liang, William Melicher, Manya Sleeper, Lujo Bauer, Gregory R. Ganger, Nitin Gupta, and Michael K. Reiter. In FAST 2014: USENIX Conference on File and Storage Technologies. February 2014. PDF.

Measuring password guessability for an entire university. Michelle L. Mazurek, Saranga Komanduri, Timothy Vidas, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Patrick Gage Kelley, Richard Shay, and Blase Ur. In CCS 2013: ACM Conference on Computer and Communications Security. November 2013. PDF.

Visualizing request-flow comparison to aid performance diagnosis in distributed systems. Raja R. Sambasivan, Ilari Shafer, Michelle L. Mazurek, and Gregory R. Ganger. In InfoVis 2013: IEEE Information Visualization Conference. October 2013. Paper (PDF), video figure (mov).

How does your password measure up? The effect of strength meters on password creation. Blase Ur, Patrick Gage Kelley, Saranga Komanduri, Joel Lee, Michael Maass, Michelle L. Mazurek, Timothy Passaro, Richard Shay, Timothy Vidas, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. In the 2012 USENIX Security Symposium. August 2012. PDF.

Correct horse battery staple: Exploring the usability of system-assigned passphrases. Richard Shay, Patrick Gage Kelley, Saranga Komanduri, Michelle L. Mazurek, Blase Ur, Tim Vidas, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. In SOUPS 2012: Symposium on Usable Privacy and Security. July 2012. PDF.

Guess again (and again and again): Measuring password strength by simulating password-cracking algorithms. Patrick Gage Kelley, Saranga Komanduri, Michelle L. Mazurek, Rich Shay, Tim Vidas, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Julio López. In the 2012 IEEE Symposium on Security and Privacy. May 2012. PDF.

Tag, You Can See It! Using tags for access control in photo sharing. Peter F. Klemperer, Yuan Liang, Michelle L. Mazurek, Manya Sleeper, Blase Ur, Lujo Bauer, Lorrie Faith Cranor, Nitin Gupta, and Michael K. Reiter. In CHI 2012: ACM Conference on Human Factors in Computing Systems. May 2012. PDF.

ZZFS: A hybrid device and cloud file system for spontaneous users. Michelle L. Mazurek, Eno Thereska, Dinan Gundawardena, Richard Harper, and James Scott. In FAST 2012: USENIX Conference on File and Storage Technologies. February 2012. PDF.

Exploring reactive access control. Michelle L. Mazurek, Peter F. Klemperer, Richard Shay, Hassan Takabi, Lujo Bauer, and Lorrie Faith Cranor. In CHI 2011: ACM Conference on Human Factors in Computing Systems. May 2011. PDF.

Of passwords and people: Measuring the effect of password-composition policies. Saranga Komanduri, Richard Shay, Patrick Gage Kelley, Michelle L. Mazurek, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Serge Egelman. In CHI 2011: ACM Conference on Human Factors in Computing Systems. May 2011. Honorable Mention award. PDF.

Encountering stronger password requirements: User attitudes and behaviors. Richard Shay, Saranga Komanduri, Patrick Gage Kelley, Pedro Giovanni Leon, Michelle L. Mazurek, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. In SOUPS 2010: Symposium on Usable Privacy and Security. July 2010. PDF.

Access control for home data sharing: Attitudes, needs and practices. Michelle L. Mazurek, J.P. Arsenault, Joanna Bresee, Nitin Gupta, Iulia Ion, Christina Johns, Daniel Lee, Yuan Liang, Jenny Olsen, Brandon Salmon, Richard Shay, Kami Vaniea, Lujo Bauer, Lorrie Faith Cranor, Gregory R. Ganger, and Michael K. Reiter. In CHI 2010: ACM Conference on Human Factors in Computing Systems. April 2010. PDF.

 

JOURNAL ARTICLES

Threat modeling health care in the United States. Nora McDonald, Alan F. Lou, Phoebe Moh, Michelle L. Mazurek, and Nazanin Andalibi. ACM Transactions on Computer-Human Interaction (ToCHI). To appear.

What does it mean to be creepy? Responses to visualizations of personal browsing activity, online tracking, and targeted ads. Nathan Reitinger, Bruce Wen, Michelle L. Mazurek, and Blase Ur. PoPETS 2024 (3). July 2024. HTML

ML-CB: Machine Learning Canvas Block. Nathan Reitinger and Michelle L. Mazurek. PoPETS 2021 (3). July 2021. HTML.

Build It, Break It, Fix It: Contesting Secure Development. James Parker, Michael Hicks, Andrew Ruef, Michelle L. Mazurek, Dave Levin, Daniel Votipka, Piotr Mardziel, and Kelsey R. Fulton. ACM Transactions on Privacy and Security (TOPS): Volume 23, Number 2. April 2020. PDF.

Cracking ShadowCrypt: Exploring the limitations of secure I/O systems in Internet Browsers. Michael Freyberger, Warren He, Devdatta Akhawe, Michelle L. Mazurek, and Prateek Mittal. PoPETS 2018 (2). July 2018. PDF.

Designing password policies for strength and usability. Richard Shay, Saranga Komanduri, Adam Durity, Phillip (Seyoung) Huh, Michelle L. Mazurek, Sean Segreti, Blase Ur, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. ACM Transactions on Information Systems Security (TISSEC): Volume 18, Number 4. May 2016. PDF.

 

WORKSHOP PAPERS

Evaluation of ad transparency systems. Kevin Bryson, Arthur Borem, Phoebe Moh, Omer Akgul, Laura Edelson, Chris Geeing, Tobias Launder, Michelle L. Mazurek, Damon McCoy, and Blase Ur. In ConPro 2024: IEEE SPW Workshop on Technology and Consumer Protection. May 2024.

Analysis of Google ads settings over time: Updated, individualized, accurate, and filtered. Nathan Reitinger, Bruce Wen, Michelle L. Mazurek, and Blase Ur. In WPES 2023: Workshop on Privacy in the Electronic Society. November 2023. HTML

This proposal was brought to you by content creators' mental models of security & privacy products. Richard Roberts, Wentao Gun, Omer Akgul, Michelle L. Mazurek, and Dave Levin. In ConPro 2023: IEEE SPW Workshop on Technology and Consumer Protection. May 2023. HTML

SoK: Considerations in measuring compliance with privacy regulations. Nathan Reitinger and Michelle L. Mazurek. In ConPro 2023: IEEE SPW Workshop on Technology and Consumer Protection. May 2023. HTML

Industry perspectives on offensive security tooling. Kaitlyn DeValk, Matthew Gwilliam, Thomas Hanson, Michael Harrity, and Michelle L. Mazurek. In WSIW 2022: The SOUPS Workshop on Security Information Workers. August 2022. PDF.

SoK: A framework for unifying at-risk user research. Noel Warford, Tara Matthews, Kaitlyn Yang, Omer Akgul, Sunny Consolvo, Patrick Gage Kelley, Nathan Malkin, Michelle L. Mazurek, Manya Sleeper, and Kurt Thomas. In WIPS 2022: The SOUPS Workshop on Inclusive Privacy and Security. August 2022. PDF.

The role of product reviewers in evaluating security and privacy. Wentao Guo, Jason Walter, and Michelle L. Mazurek. In ConPro 2022: IEEE SPW Workshop on Technology and Consumer Protection. May 2022.

From Secure to Military-Grade: Exploring the Effect of App Descriptions on User Perceptions of Secure Messaging. Omer Akgul, Ruba Abu-Salma, Wei Bai, Elissa M. Redmiles, Michelle L. Mazurek, and Blase Ur. In WPES 2021: Workshop on Privacy in the Electronic Society. November 2021. HTML.

Investigating VPN ads on YouTube. Omer Akgul, Richard Roberts, Moses Namara, Michelle L. Mazurek, and Dave Levin. In ConPro 2021: IEEE SPW Workshop on Technology and Consumer Protection. May 2021.

Mobile operandi: Behavioral-based fingerprinting using permissionless HTML5 APIs. Nathan Reitinger and Michelle L. Mazurek. In ConPro 2021: IEEE SPW Workshop on Technology and Consumer Protection. May 2021.

Improving non-experts' understanding of end-to-end encryption: An exploratory study. Wei Bai, Michael Pearson, Patrick Gage Kelley, and Michelle L. Mazurek. In the 2020 European Workshop on Usable Security (EuroUSEC). September 2020. HTML

Measuring non-expert comprehension of machine learning fairness metrics. Debjani Saha, Candice Schumann, Duncan C. McElfresh, John P. Dickerson, Michelle L. Mazurek, and Michael Carl Tschantz. In MD4SG 2020: Workshop on Mechanism Design for Social Good. August 2020.

Libraries' approaches to the security of public computers. Samuel Dooley, Michael Rosenberg, Elliott Sloate, Sungbok Shin, and Michelle L. Mazurek. In WIPS 2020: The SOUPS Workshop on Inclusive Privacy and Security. August 2020.

On the other side of the table: Hosting capture the flag competitions. Ben Carlisle, Michael Reininger, Dylan Fox, Daniel Votipka, and Michelle L. Mazurek In WSIW 2020: The SOUPS Workshop on Security Information Workers. August 2020.

Measuring non-expert comprehension of machine learning fairness metrics. Debjani Saha, Candice Schumann, Duncan C. McElfresh, John P. Dickerson, Michelle L. Mazurek, and Michael Carl Tschantz. In PAML 2020: Participatory approaches to machine learning workshop. July 2020.

Designing Visualization and Exploration Tools for Data Access Under GDPR/CCPA Sophie Veys, Madison Stamos, Nathan Reitinger, Michelle L. Mazurek, and Blase Ur. In ConPro 2020: Workshop on Technology and Consumer Protection. May 2020.

Human comprehension of fairness in machine learning. Debjani Saha, Candice Schumann, Duncan C. McElfresh, John P. Dickerson, Michelle L. Mazurek, and Michael Carl Tschantz. In AIES 2020: AAAI/ACM Conference on AI, Ethics, and Society. February 2020.

Studying the costs and benefits of Rust, compared to C. Kelsey Fulton, Yasmin Abdi, Christopher Neidhart, Michelle L. Mazurek, and Michael Hicks.In WSIW2019: The SOUPS Workshop on Security Information Workers. August 2019.

Symbolic path tracing to find Android permission-use triggers. Kristopher Micinski, Thomas Gilray, Daniel Votipka, Michelle L. Mazurek, and Jeffrey S. Foster. In BAR 2019: The NDSS Workshop on Binary Analysis Research. February 2019.

Comparing hypothetical and realistic privacy valuations. Joshua Tan, Mahmood Sharif, Sruti Bhagavatula, Matthias Beckerle, Michelle L. Mazurek, and Lujo Bauer. In WPES 2018: The Workshop on Privacy in the Electronic Society. October 2018. PDF.

Toward a field study on the impact of hacking competitions on secure development. Daniel Votipka, Hongyi Hu, Bryan Eastes, and Michelle L. Mazurek. In WSIW 2018: The SOUPS Workshop on Security Information Workers. August 2018.

Can you read that? First steps toward measuring the readability of security advice. Elissa M. Redmiles, Miraida Morales, Lisa Maszkiewicz, Rock Stevens, Everest Liu, Dhruv Kuchhal, and Michelle L. Mazurek. In ConPro 2018: IEEE SPW Workshop on Technology and Consumer Protection. May 2018.

Lessons learned from using an online platform to conduct large-scale, online controlled security experiments with software developers. Christian Stransky, Yasemin Acar, Duc Cuong Nguyen, Dominik Wermke, Doowon Kim, Elissa M. Redmiles, Michael Backes, Simson Garfinkel, Michelle L. Mazurek, and Sascha Fahl. In CSET 2017: USENIX Workshop on Cyber Security Experimentation and Test. August 2017. PDF.

You want me to do what? A design study of two-factor authentication messages. Elissa M. Redmiles, Everest Liu, and Michelle L. Mazurek. In WAY 2017: Who Are You?! Adventures in Authentication. July 2017.

Challenges faced in working with users to design access-control systems for domestic environments. Manya Sleeper, Michelle L. Mazurek, and Lujo Bauer. In Designing with Users for Domestic Environments. February 2014.

The post anachronism: The temporal dimension of Facebook privacy. Lujo Bauer, Lorrie Faith Cranor, Saranga Komanduri, Michelle L. Mazurek, Michael K. Reiter, Manya Sleeper, and Blase Ur. In WPES 2013: Workshop on Privacy in the Electronic Society. November 2013. PDF.

Under control: Requirements for access control for personal data. Michelle L. Mazurek, Lujo Bauer, Gregory R. Ganger, and Michael K. Reiter. In HUPS 2013: Workshop on Home Usable Privacy and Security. July 2013.

The impact of length and mathematical operators on the usability and security of system-assigned one-time PINs. Patrick Gage Kelley, Saranga Komanduri, Michelle L. Mazurek, Richard Shay, Tim Vidas, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. In USEC 2013: Workshop on Usable Security. April 2013. PDF.

 

MAGAZINE ARTICLES

It lurks within: A look at the unexpected security implications of Compliance Programs. Rock Stevens, Josiah Dykstra, Wendy Knox Everette, and Michelle L. Mazurek. In IEEE Security and Privacy: 18 (6), 51-58. 2020. HTML.

Balancing security and usability in encrypted email. Wei Bai, Doowon Kim, Moses Namara, Yichen Qian, Patrick Gage Kelley, and Michelle L. Mazurek. In IEEE Internet Computing: 21 (3), 30-38. 2017.

How internet resources might be helping you develop faster but less securely. Yasemin Acar, Michael Backes, Sascha Fahl, Doowon Kim, Michelle L. Mazurek, and Christian Stransky. In IEEE Security & Privacy: 15 (2), 50-60. 2017.

The effectiveness of security images in internet banking. Joel Lee, Lujo Bauer, and Michelle L. Mazurek. In IEEE Internet Computing: 19 (1), 54-62. 2014.

Helping users create better passwords. Blase Ur, Patrick Gage Kelley, Saranga Komanduri, Joel Lee, Michael Maass, Michelle L. Mazurek, Timothy Passaro, Richard Shay, Timothy Vidas, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Serge Egelman, and Julio López. USENIX ;login: 37(6). December 2012.