Security Engineering Lab, Two Papers Accepted at CHI 2025
2025-02-20
[25.01.21] Security Engineering Lab, Two Papers Accepted at CHI 2025 The Security Engineering Lab (Advisor: Professor Hyungsik Kim) has had two papers accepted at CHI 2025 (ACM SIGCHI Conference on Human Factors in Computing Systems), one of the top-tier conferences in the field of Human-Computer Interaction (HCI). The papers will be presented in April 2025 in Yokohama, Japan. 1. Paper: "Understanding and Improving User Adoption and Security Awareness in Password Checkup Services" Authors: Sanghak Oh (PhD Student, Department of Electrical and Computer Engineering) Heewon Baek (MS Student, Department of Electrical and Computer Engineering) Taeyoung Kim (PhD Student, Department of Electrical and Computer Engineering) Woojin Jeon (PhD Student, Department of Electrical and Computer Engineering) Junho Heo (Samsung Research) Professor Ian Oakley (KAIST) Professor Hyungsik Kim (Sungkyunkwan University) Password Checkup Services (PCS) help users protect accounts by identifying compromised, reused, or weak passwords. However, these services have low adoption rates. This study conducted an online survey (N=238) to identify factors influencing PCS adoption and barriers to changing compromised passwords. Key findings include: Adoption factors: Perceived usefulness, ease of use, and self-efficacy were significant motivators. Barriers to password changes: Warning fatigue from frequent alerts, low awareness of password compromise risks, and reliance on other security measures discouraged users from taking action. To address these issues, the research team redesigned the PCS interface by: Clarifying warning messages related to compromised passwords. Automating the password change process, such as enabling users to update multiple reused passwords simultaneously or directly linking to password change pages. A task-based interview study (N=50) validated the effectiveness of the new design, showing a significant increase in password change rates in two scenarios: 40% and 74% change rates, compared to 16% and 60% in Google's existing PCS design. 2. Paper: "I Was Told to Install the Antivirus App, but I’m Not Sure I Need It: Understanding the Adoption, Discontinuation, and Non-Use of Smartphone Antivirus Software in South Korea" Authors: Seyoung Jin (MS Student, Department of Software) Heewon Baek (MS Student, Department of Software) Professor Euijin Lee (KAIST) Professor Hyungsik Kim (Sungkyunkwan University) This study investigates the limited effectiveness of smartphone antivirus software, despite recommendations from security firms, due to user misconceptions, regulatory requirements, and improper usage. Using a mixed-methods approach, including in-depth interviews (N=23) and a survey (N=250), the study examined the adoption status of smartphone antivirus software, particularly in South Korea, where it is often mandatory for banking and financial apps. Key findings: Many users confused antivirus software with general security tools and were unaware of its limited scope in addressing mobile malware threats. Factors influencing adoption: Perceived vulnerability, response efficacy, self-efficacy, social norms, and awareness. Factors leading to discontinuation or non-use: Concerns about system performance impact and skepticism about necessity. Additionally, the mandatory installation of antivirus software for financial apps in South Korea has contributed to user misconceptions, negative perceptions, and a false sense of security. This research highlights the need for better user education, clearer communication on mobile-specific security threats, and improved guidance to enhance effective antivirus software usage.