Deception Task Design in Developer Password Studies: Exploring a Student Sample Alena Naiakshina, Anastasia Danilova, Christian Tiefenau, and Matthew Smith, University of Bonn, Germany https://www.usenix.org/conference/soups2018/presentation/naiakshina This paper is included in the Proceedings of the Fourteenth Symposium on Usable Privacy and Security. August 12–14, 2018 • Baltimore, MD, USA ISBN 978-1-939133-10-6 Open access to the Proceedings of the Fourteenth Symposium on Usable Privacy and Security is sponsored by USENIX. Deception Task Design in Developer Password Studies: Exploring a Student Sample Alena Naiakshina Anastasia Danilova Christian Tiefenau University of Bonn University of Bonn University of Bonn
[email protected] [email protected] [email protected] Matthew Smith University of Bonn
[email protected] ABSTRACT To do so, we extended a developer study on password storage (pri- Studying developer behavior is a hot topic for usable security re- mary study) using different study designs (meta-study) to evaluate searchers. While the usable security community has ample experi- the effects of the design. ence and best-practice knowledge concerning the design of end-user In end-user studies, deception is a divisive topic. For instance, studies, such knowledge is still lacking for developer studies. We Haque et al. [32] argue that deception is necessary for password know from end-user studies that task design and framing can have studies: “We did not want to give the participants any clue about significant effects on the outcome of the study. To offer initial in- our experimental motive because we expected the participants to sights into these effects for developer research, we extended our spontaneously construct new passwords, exactly in the same way previous password storage study [42].