This article proposes a user-adaptable and personalized authentication paradigm for healthcare organizations, which anticipates to seamlessly reflect patients’ episodic and autobiographical memories to graphical and textual passwords aiming to improve the security strength of user-selected passwords and provide a positive user experience. We report on a longitudinal study that spanned over 3 years in which three public European healthcare organizations participated to design and evaluate the aforementioned paradigm. Three studies were conducted ( n = 169) with different stakeholders: (1) a verification study aiming to identify existing authentication practices of the three healthcare organizations with diverse stakeholders ( n = 9), (2) a patient-centric feasibility study during which users interacted with the proposed authentication system ( n = 68), and (3) a human guessing attack study focusing on vulnerabilities among people sharing common experiences within location-aware images used for graphical passwords ( n = 92). Results revealed that the suggested paradigm scored high with regard to users’ likeability, perceived security, usability, and trust, but more importantly it assists the creation of more secure passwords. On the downside, the suggested paradigm introduces password guessing vulnerabilities by individuals sharing common experiences with the end users. Findings are expected to scaffold the design of more patient-centric knowledge-based authentication mechanisms within today's dynamic computation realms.

In this paper, we propose an eye gaze-driven metric based on hotspot vs. non-hotspot segments of images for unobtrusively estimating the strength of user-created graphical passwords by analyzing the users' eye gaze behavior during password creation. To examine the feasibility of this method, i.e., the existence of correlation between the proposed metric and the strength of users' generated passwords, we conducted an eye-tracking study (n=42), in which users created a graphical password with a personalized image that triggers declarative memory of users (familiar image) vs. an image illustrating generic content unfamiliar to the users' episodic and semantic memory (generic image). Results revealed a strong positive correlation between the password strength and the proposed eye gaze-driven metric, pointing towards a new direction for the design of intelligent eye gaze-driven graphical password schemes for unobtrusively assisting users in making better password choices.

The Second International Workshop on Adaptive and Personalized Privacy and Security (APPS 2020) aims to bring together researchers and practitioners working on diverse topics related to understanding and improving the usability of privacy and security software and systems, by applying user modeling, adaptation and personalization principles. Our special focus in 2020 is on healthcare systems, more specifically on ensuring security and privacy of medical data in smart patient-centric healthcare systems. The second edition of the workshop includes interdisciplinary contributions from Austria, Canada, China, Cyprus, Denmark, Germany, Greece, Israel, the Netherlands, Turkey and the UK that introduce new and disruptive ideas, suggest novel solutions, and present research results about various aspects (theory, applications, tools) for bringing user modeling, adaptation and personalization principles into privacy and systems security. This summary gives a brief overview of APPS 2020, held online in conjunction with the 28th ACM Conference on User Modeling, Adaptation and Personalization (ACM UMAP 2020).

Picture passwords, which require users to draw selections on images as their secret password, typically provide globalized solutions without taking into consideration that people across diverse cultures exhibit differences within interactive systems. Aiming to shed light on the effects of culture towards users' interactions within picture password schemes, we conducted a between-subjects cross-cultural (Eastern vs. Western) study (n=67). Users created a password on a picture illustrating content highly related to their daily-life experiences (culture-internal) vs. a picture illustrating the same daily-life experiences, but in a different cultural context (culture-external). Results revealed that people across cultures exhibited differences in visual processing, comprehension, and exploration of the picture content prior to making their password selections. The observed differences can be accounted by considering sociocultural theories highlighting the holistic preference of Eastern populations compared to the analytic preference of Western populations. Qualitative data also triangulate the findings by exposing the likeability and users' engagement towards the picture content familiar to individual's culture. Findings underpin the necessity to consider cultural differences in the design of personalized picture passwords.

Future-generation healthcare systems will be highly distributed, combining centralised hospital systems with decentralised home-, work-and environment-based monitoring and diagnostics systems. These will reduce costs and injury-related risks whilst both improving quality of service, and reducing the response time for diagnostics and treatments made available to patients. To make this vision possible, medical data must be accessed and shared over a variety of mediums including untrusted networks. In this paper, we present the design and initial implementation of the SERUMS tool-chain for accessing, storing, communicating and analysing highly confidential medical data in a safe, secure and privacy-preserving way. In addition, we describe a data fabrication framework for generating large volumes of synthetic but realistic data, that is used in the design and evaluation of the tool-chain. We demonstrate the present version of our technique on a use case derived from the Edinburgh Cancer Centre, NHS Lothian, where information about the effects of chemotherapy treatments on cancer patients is collected from different distributed databases, analysed and adapted to improve ongoing treatments.

Graphical passwords leverage the picture superiority effect to enhance memorability, and reflect today's haptic users' interaction realms. Images related to users' past sociocultural experiences (e.g., retrospective) enable the creation of memorable and secure passwords, while randomly system-assigned images (e.g., generic) lead to easy-to-predict hotspot regions within graphical password schemes. What remains rather unexplored is whether the image type could be inferred during the password creation. In this work, we present a between-subjects user study in which 37 participants completed a recall-based graphical password creation task with retrospective and generic images, while we were capturing their visual behavior. We found that the image type can be inferred within a few seconds in real-time. User adaptive mechanisms might benefit from our work's findings, by providing users early feedback whether they are moving towards the creation of a weak graphical password.

Graphical passwords leverage the picture superiority effect to enhance memorability, and reflect today's haptic user interaction realms. Image content related to users’ past sociocultural experiences assists users with the creation of more secure and memorable passwords. Aiming to shed light on the effects of sociocultural-related image content towards graphical password selections, we conducted a between-subjects eye-tracking study (N=37) in which users selected one image among a set of images from their assigned image group (sociocultural-related vs. generic) that would be used for creating their graphical password. Results revealed differences in users’ interaction and visual behavior during image selection. Initial users’ feedback regarding the likeability and users’ engagement with the sociocultural-related image content is also presented.

Graphical password composition is an important part of graphical user authentication which affects the strength of the chosen password. Considering that graphical authentication is associated with visual search, perception, and information retrieval, in this paper we report on an eye-tracking study (N = 109) that aimed to investigate the effects of users’ cognitive styles toward the strength of the created passwords and shed light into whether and how the visual strategy of the users during graphical password composition is associated with the passwords’ strength. For doing so, we adopted Witkin’s Field Dependence-Independence theory, which underpins individual differences in visual information and cognitive processing, as graphical password composition tasks are associated with visual search. The analysis revealed that users with different cognitive processing characteristics followed different patterns of visual behavior during password composition which affected the strength of the created passwords. The findings underpin the need of considering human-cognitive characteristics as a design factor in graphical password schemes. The paper concludes by discussing implications for improving recognition-based graphical passwords through adaptation and personalization techniques based on individual cognitive characteristics.

Visual attention, search, processing and comprehension are important cognitive tasks during a graphical password composition activity. Aiming to shed light on whether individual differences on visual behavior affect the strength of the created passwords, we conducted an eye-tracking study (N=36), and adopted an accredited cognitive style theory to interpret the results. The analysis revealed that users with different cognitive styles followed different patterns of visual behavior which affected the strength of the created passwords. Motivated, by the results of the first study, we introduced adaptive characteristics to the user authentication mechanism, aiming to assist specific cognitive style user groups to create more secure passwords, and conducted a second study with a new sample (N=40) to test the adaptive characteristics. Results strengthen our assumptions that adaptive mechanisms based on users' differences in cognitive and visual behavior uncover a new perspective for improving the password's strength within graphical user authentication realms.

Evidence suggests that individual cognitive differences affect users' memorability, visual behavior, and graphical passwords' security. Such knowledge denotes the added value of personalizing graphical password schemes towards the unique cognitive characteristics of the users. However, real-time and accurate cognition-based predictive user models are necessary to reach such a breakthrough. In this paper, we present the results of such an attempt, where an in-lab eye-tracking study was conducted with 36 participants who completed a recall-based graphical password composition task. We adopted a credible cognitive style theory, and investigated a variety of eye-tracking metrics to predict participants' cognitive styles. Results' analysis reveals that inferring individual cognitive differences in real-time during graphical password composition is feasible within a few seconds and that specific eye-tracking metrics correlate stronger with certain cognitive style groups. The findings further support the vision of incorporating real-time adaptive mechanisms in graphical password schemes for the benefit of service providers and end-users.

Adaptive user authentication policies are moving in the center of attention lately aiming to assist users in creating memorable and secure passwords. Focusing on graphical user authentication, state-of-the-art research has provided evidence that image-related attributes affect password memorability and security. Nonetheless, the effects of users' contemporary cultural-related memories towards password memorability and security have not been investigated so far, although it is known that user authentication is a cross-cultural task. Aiming to shed light on whether such effects exist, we conducted a study in which users created a graphical password with a contemporary culture-intensive vs. a culture-neutral image. Results indicate that image content related to one's cultural-related memories affects the interaction behavior during password composition, and consequently password memorability. Findings point towards a promising new direction for considering human contemporary cultural memories in the design of adaptive password policies to increase memorability and preserve security.

Recent research provides evidence that individual differences in human cognitive styles affect user performance and experience in diverse application domains. However, state-of-the-art elicitation methods of cognitive styles require researchers to apply explicit, in-lab, and time-consuming "paper-and-pencil" techniques, rendering real-time integration of cognitive styles? elicitation impractical in interactive system design. Aiming to elaborate an implicit elicitation method of cognitive styles, this paper reports two feasibility studies based on an eye-tracking multifactorial model. In both studies, participants performed visual activities of varying characteristics, and the eye-tracking analysis revealed quantitative differences on visual behavior among individuals with different cognitive styles. Based on these differences, a series of classification experiments were conducted, and the results revealed that gaze-based implicit elicitation of cognitive styles in real-time is feasible, which could be used by interactive systems to adapt to the users' cognitive needs and preferences, to better assist them, and improve their performance and experience.

This paper investigates the trade-off between security and usability in recognition-based graphical authentication mechanisms. Through a user study (N=103) based on a real usage scenario, it draws insights about the security strength and memorability of a chosen password with respect to the amount of images presented to users during sign-up. In particular, it reveals the users' predisposition in following predictable patterns when selecting graphical passwords, and its effect on practical security strength. It also demonstrates that a "sweet-spot" exists between security and usability in graphical authentication approaches on the basis of adjusting accordingly the image grid size presented to users when creating passwords. The results of the study can be leveraged by researchers and practitioners engaged in designing intelligent graphical authentication user interfaces for striking an appropriate balance between security and usability.

This demonstration paper presents a Web-based adaptive interactive system for personalizing the checkout process of M-Commerce Web environments, coined Persona Check. In particular, the system personalizes the visual and interaction design aspects of a mobile Web-based checkout process based on users' cognitive style theory which argues that individuals have differences in the way they process and organize information, as well as experience their context and environment in different manners and perspectives. The Persona Check system consists of three main components: i) an M-Commerce environment for creating and managing the checkout process designs, ii) a user modeling component in which explicit user data collection methods are performed for eliciting the users' cognitive processing characteristics, and iii) an adaptive user interface that is responsible for performing rule-based mechanisms for deciding and communicating the "best-fit" checkout process design to the users based on their cognitive styles.

An effective user authentication mechanism should embrace both security and usability aspects as its purpose is to ensure safety of operation of online services but as well usability and transparency to its end users. In an attempt to improve the usability and overall experience of user interactions during authentication, this paper proposes an alternative approach of personalizing user authentication tasks based on individual differences in cognitive processing. The presented approach is mainly driven by theories on individual differences in cognitive styles which argue that individuals recall and process textual and graphical information differently. In this realm, the paper presents a 4-month user study in which 153 participants interacted with a personalized user authentication mechanism in an ecological valid context. Analysis of results shows that the presented user authentication approach is a promising alternative to current state of user authentication practices.

Stimulated by a large number of different theories on human cognition, suggesting that individuals have different habitual approaches in retrieving, recalling, processing and storing verbal and graphical information, this paper investigates the effect of such processes with regard to user performance and preference toward two variations of knowledge-based authentication mechanisms. In particular, a text-based password authentication mechanism and a recognition-based graphical authentication mechanism were deployed in the frame of an ecological valid user study, to investigate the effect of specific cognitive factors of users toward efficiency, effectiveness and preference of authentication tasks. A total of 145 users participated during a five-month period between February and June 2012. This recent study provides interesting insights for the design and deployment of adaptive authentication mechanisms based on cognitive factors of users. The results and implications of this paper are valuable in understanding and modeling user interactions with regard to authentication mechanisms.

The research that is described in this paper focuses on incorporating theories of individual differences in information processing within the context of generic Hypertext and Hypermedia Environments. The main objective of this paper is to introduce a framework for the automatic reconstruction of Web content based on human factors. It is supported that human factors may be used in order to enhance the design of generic hypertext (or hypermedia) content in a measurable and meaningful way. A Web Browser extension set of custom xml tags has been therefore developed in order for the browser to recognize and implement these set of tags for the imminent transformation and enhancement of Web content. An increase on users’ satisfaction as well as more efficient information processing (both in terms of accuracy and task completion time), has been observed in the personalized condition than the original one. Consequently, it is supported that human factors may be used in order to enhance the design of generic hypertext (or hypermedia) content in a measurable and meaningful way.

This paper presents a Web adaptation and personalization architecture that uses cognitive aspects as its core filtering element. The innovation of the proposed architecture focuses upon the creation of a comprehensive user profiling that combines parameters that analyze the most intrinsic users' characteristics like visual, cognitive, and emotional processing parameters as well as the "traditional" user profiling characteristics and together tend to give the most optimized adapted and personalized result to the user.