PhD Proposal: Evaluating the Usability of Password Sharing Features in Password Managers

Users often interact with technology in ways that violate security designers' and researchers' assumptions. Other times, what users consider to be security or privacy violations differ from what we as researchers would expect. These behaviors are especially pronounced when multiple users and stakeholders are involved. In my thesis, I seek to examine the ways that users perceive and manage security on multi-user devices and accounts in order to inform design decisions and considerations that take lived user experiences and needs into account.
First, to better understand the day-to-day security and privacy violations smart home owners face, in contrast to rare but technically-advanced attacks, I conducted two surveys with representative samples in the U.S.; one (n = 100) to characterize the types of interpersonal device misuse owners experience from others and another (n = 483) to estimate the prevalence of these incidents as well as better understand how these device owners perceive the severity of device misuse. I then conducted a vignette study (n = 602) to better understand the complex social factors and norms smart home device owners use to evaluate whether unauthorized use of their devices constituted violations of privacy and security. Finally, I examined ways users maintain security while engaging in insecure behavior through a survey study (n = 300) of how participants created passwords for accounts they share with others. Many of these users rely on non-technical means, such as verbalization or text messages, to transmit passwords they share to one another. In my proposed work, I will conduct a characterization and usability study of password sharing features in popular password managers. I hope to order to better understand why users eschew technical solutions to password sharing and identify how different design choices support or conflict with users' goals for account sharing.