Serge Egelman
About the author:
No description available of Serge Egelman...
Publications by Serge Egelman (bibliography)
» 2009 «
Egelman, Serge, Tsai, Janice, Cranor, Lorrie Faith and Acquisti, Alessandro (2009): Timing is everything?: the effects of timing and placement of online privacy indicators. In: Proceedings of ACM CHI 2009 Conference on Human Factors in Computing Systems 2009. pp. 319-328. Available online
Many commerce websites post privacy policies to address Internet shoppers' privacy concerns. However, few users read or understand them. Iconic privacy indicators may make privacy policies more accessible and easier for users to understand: in this paper, we examine whether the timing and placement of online privacy indicators impact Internet users' browsing and purchasing decisions. We conducted a laboratory study where we controlled the placement of privacy information, the timing of its appearance, the privacy level of each website, and the price and items being purchased. We found that the timing of privacy information had a significant impact on how much of a premium users were willing to pay for privacy. We also found that timing had less impact when users were willing to examine multiple websites. Finally, we found that users paid more attention to privacy indicators when purchasing privacy-sensitive items than when purchasing items that raised minimal privacy concerns.
Copyrights may apply
Schechter, Stuart, Egelman, Serge and Reeder, Robert W. (2009): It's not what you know, but who you know: a social approach to last-resort authentication. In: Proceedings of ACM CHI 2009 Conference on Human Factors in Computing Systems 2009. pp. 1983-1992. Available online
Backup authentication mechanisms help users who have forgotten their passwords regain access to their accounts-or at least try. Today's systems fall short in meeting both security and reliability requirements. We designed, built, and tested a new backup authentication system that employs a social-authentication mechanism. The system employs trustees previously appointed by the account holder to verify the account holder's identity. We ran three experiments to determine whether the system could (1) reliably authenticate account holders, (2) resist email attacks that target trustees by impersonating account holders, and (3) resist phone-based attacks from individuals close to account holders. Results were encouraging: seventeen of the nineteen participants who made the effort to call trustees authenticated successfully. However, we also found that users must be reminded of who their trustees are. While email-based attacks were largely unsuccessful, stronger countermeasures will be required to counter highly-personalized phone-based attacks.
Copyrights may apply
Tsai, Janice, Egelman, Serge, Cranor, Lorrie and Acquisti, Alessandro (2009): The impact of privacy indicators on search engine browsing patterns. In: Proceedings of the 2009 Symposium on Usable Privacy and Security 2009. p. 29. Available online
Schechter, Stuart, Brush, A. J. Bernheim and Egelman, Serge (2009): It's no secret: measuring the security and reliability of authentication via 'secret' questions. In: Proceedings of the 2009 Symposium on Usable Privacy and Security 2009. p. 40. Available online
Schechter, Stuart, Egelman, Serge and Reeder, Robert W. (2009): It's not what you know, but who you know: a social approach to last-resort authentication. In: Proceedings of the 2009 Symposium on Usable Privacy and Security 2009. p. 41. Available online
» 2008 «
Egelman, Serge, Cranor, Lorrie Faith and Hong, Jason (2008): You've been warned: an empirical study of the effectiveness of web browser phishing warnings. In: Proceedings of ACM CHI 2008 Conference on Human Factors in Computing Systems April 5-10, 2008. pp. 1065-1074. Available online
Many popular web browsers are now including active phishing warnings after previous research has shown that passive warnings are often ignored. In this laboratory study we examine the effectiveness of these warnings and examine if, how, and why they fail users. We simulated a spear phishing attack to expose users to browser warnings. We found that 97% of our sixty participants fell for at least one of the phishing messages that we sent them. However, we also found that when presented with the active warnings, 79% of participants heeded them, which was not the case for the passive warning that we tested -- where only one participant heeded the warnings. Using a model from the warning sciences we analyzed how users perceive warning messages and offer suggestions for creating more effective warning messages within the phishing context.
Copyrights may apply
Egelman, Serge, Brush, A. J. Bernheim and Inkpen, Kori M. (2008): Family accounts: a new paradigm for user accounts within the home environment. In: Proceedings of ACM CSCW08 Conference on Computer-Supported Cooperative Work 2008. pp. 669-678. Available online
In this paper we present Family Accounts, a new user account model for shared home computers. We conducted a study with sixteen families, eight who used individual profiles at home, and eight who shared a single profile. Our results demonstrate that Family Accounts is a good compromise between a single shared profile and individual profiles for each family member. In particular, we observed that because Family Accounts allowed individuals to switch profiles without forcing them to interrupt their tasks, family members tended to switch to their own profiles only when a task required some degree of privacy or personalization.
Copyrights may apply
» 2006 «
Gideon, Julia, Cranor, Lorrie, Egelman, Serge and Acquisti, Alessandro (2006): Power strips, prophylactics, and privacy, oh my!. In: Proceedings of the 2006 Symposium on Usable Privacy and Security 2006. pp. 133-144. Available online
While Internet users claim to be concerned about online privacy, their behavior rarely reflects those concerns. In this paper we investigate whether the availability of comparison information about the privacy practices of online merchants affects users' behavior. We conducted our study using Privacy Finder, a "privacy-enhanced search engine" that displays search results annotated with the privacy policy information of each site. The privacy information is garnered from computer-readable privacy policies found at the respective sites. We asked users to purchase one non-privacy-sensitive item and then one privacy-sensitive item using Privacy Finder, and observed whether the privacy information provided by our search engine impacted users' purchasing decisions (participants' costs were reimbursed, in order to separate the effect of privacy policies from that of price). A control group was asked to make the same purchases using a search engine that produced the same results as Privacy Finder, but did not display privacy information. We found that while Privacy Finder had some influence on non-privacy-sensitive purchase decisions, it had a more significant impact on privacy-sensitive purchases. The results suggest that when privacy policy comparison information is readily available, individuals may be willing to seek out more privacy friendly web sites and perhaps even pay a premium for privacy depending on the nature of the items to be purchased.
Copyrights may apply
Egelman, Serge, Cranor, Lorrie Faith and Chowdhury, Abdur (2006): An analysis of P3P-enabled web sites among top-20 search results. In: Fox, Mark S. and Spencer, Bruce (eds.) Proceedings of the 8th International Conference on Electronic Commerce - ICEC 2006 2006, Fredericton, New Brunswick, Canada. pp. 197-207. Available online
SHOW THIS LIST ON YOUR HOMEPAGE
What do YOU think?
Give us your opinion! Do you have any comments/additions
that you would like other visitors to see?
You say:
Mar 20th, 2010
Changes to this page (author)
18 Feb 2010: Enabled abstracts to be shown on Serge Egelman's author page.08 Sep 2009: Author was edited 08 Sep 2009: Author was edited
08 Sep 2009: Author was edited
30 May 2009: Author was edited
09 May 2009: Author was edited
09 May 2009: Author was edited
07 Apr 2009: Author was edited
12 May 2008: Author was edited
12 May 2008: Author was added to the bibliography