Phishing warning researchers have proposed two forms of hyperlink restrictions for reducing phishing click-through rates: focused attention, which prevents users from proceeding to a suspicious URL until they click the uncovered link inside the warning; and time delay, which disables link clicking for a short period of time. Both measures aim to draw user attention to the warning and nudge them to carefully evaluate the respective link's URL. However, the effectiveness of these measures has so far not been comparatively evaluated. We conducted a mixed-methods online experiment (n=1,320) to understand differences in the effectiveness of focused attention and time delay both independently and together. Our study used an instrumented email inbox environment, in which participants were asked to assess emails and email hyper-links. We found that, while both focused attention and time delay reduced click-through rates independently, the strength of these effects were significantly different from each other with focused attention being more effective than time delay. Combining both measures reduced CTR even further. We also found that participants who saw a warning with a time delay were more likely to hover over hyperlinks for longer than those who saw a focused attention warning. We discuss the implications of our findings for the design of anti-phishing warnings.

While data are the backbone for home Internet of Things’ (IoT) functional and economic model, data remain elusive and abstract for home dwellers. In response, we present the Odd Interpreters (OIs): a collection of three artifacts that materialize alternative ways of engaging with IoT data in home environments. The OIs recast home data as imaginative sounds (Broadcast), fading fabric (Soft Fading), and cookie recipes (Data Bakery) with the intent to reveal the hidden human labor and material infrastructures of data and to critique data's assumed objectivity. Following a Research-through-Design approach, we unpack design events that mark our process for making the Odd Interpreters. We conclude with a discussion around the need for pluralizing data encounters, the tactic of designing between illusion and precision, and a reflection on living with the prototypes while designing.

There is increasing agreement that teaching students ethics in computer science (CS) is important, but there is little agreement about how to teach ethics, when to teach ethics, or even what ethics curricula should include. CS programs are experimenting with both stand-alone courses and approaches that integrate ethics throughout the computer science curriculum. Drawing from work in CS education and Science & Technology Studies, we designed an integrated and interdisciplinary ethics intervention to help computer security students identify where ethics and politics intersect with their technical field and encourage students to see themselves as practitioners of politics and ethics. Through analysis of student assignments, post-course surveys, and instructor reflections, we found that, while our intervention had benefits for students and instructors, it only weakly encouraged students to think of themselves as practitioners of ethics and politics. Students also struggled to confidently adjudicate ethical dilemmas given only a set of ethical principles. Finally, the ethical principles we gave students strongly shaped their analysis -- for example, students were more likely to consider disparate impacts of technology on marginalized groups when directly prompted to do so. Our results suggest that integrated and inter-disciplinary approaches have many benefits, but they require additional resources beyond a single course to effectively support students in adjudicating ethical dilemmas.

The right of access, found in the EU's GDPR and similar data protection regulations around the world, requires corporations and other organizations to give people access to the data they hold about them. Such regulations create obligations for data controllers but leave flexibility on how to achieve them, resulting in variation in how Data Subject Access Requests (DSARs) are implemented by different corporations. To understand the various practices emerging around DSARs and how requesting data influences the way people think of data protection laws, we asked participants in India, the UK and USA to make 38 DSARs from 11 different companies. Using the metaphor of the policy-design-practice "knot" ~\citejacksonPolicyKnotReintegrating2014, we examine DSARs as a case of the co-constitutive links between policy, design, and practice. We find that the DSAR process was not linear and participants employed many work-arounds. The challenges they encountered in the overall DSAR process negatively affected their perceptions of data protection policies. Our study suggests that researchers have to be flexible in adapting research methodology to understanding emerging practices, and that there is a need for more collaborative experimentation with DSARs before standardizing the process.

Good faith disagreements and healthy conflict management are essential to deliberative democracy and building strong relationships. People increasingly use computer-mediated communication during disagreements, which raises the question of how technology and design impact users' disagreements and relationships. We conducted a mixed-methods study with 257 participants to understand how design impacts disagreements across both existing social media platforms and novel, user-generated designs. Through interviews, a survey, and storyboard evaluations, we found that users often want to discuss challenging topics online but avoid them due to fear of hurting their relationships. Further, we found that users are most excited about design interventions that empower collective group action, humanize others online, or support channel switching to more private or socially rich contexts. Our results suggest that although technology has the potential to support users during conflict, it is also rife with possibilities to do more harm than good by diluting users' intentions, intruding, or backfiring. We introduce "interpersonal design,'' which centers relationships in the design process, an essential step in supporting users in the challenging task of arguing well.

Research in personal informatics (PI) calls for systems to sup- port social forms of tracking, raising questions about how privacy can and should support intentionally sharing sensitive health information. We focus on the case of personal data related to the self-tracking of bipolar disorder (BD) in order to explore the ways in which disclosure activities intersect with other privacy experiences. While research in HCI of- ten discusses privacy as a disclosure activity, this does not reflect the ways in which privacy can be passively experienced. In this paper we broaden conceptions of privacy by defining transparency experiences and contributing factors in contrast to disclosure activities and preferences. Next, we ground this theoretical move in empirical analysis of personal narratives shared by people managing BD. We discuss the resulting emer- gent model of transparency in terms of implications for the design of socially-enabled PI systems. CAUTION: This paper contains references to experiences of mental illness, including self-harm, depression, suicidal ideation, etc.

A digital calculator is one of the most frequently used touch screen applications. However, keypad-based character input in existing calculator applications requires precise, targeted key presses that are time-consuming and error-prone for many screen readers users. We introduce GestureCalc, a digital calculator that uses target-free gestures for arithmetic tasks. It allows eyes-free target-less input of digits and operations through taps and directional swipes with one to three fingers, guided by minimal audio feedback. We conducted a mixed methods longitudinal study with eight screen reader users and found that they entered characters with GestureCalc 40.5% faster on average than with a typical touch screen calculator. Participants made more mistakes but also corrected more errors with GestureCalc, resulting in 52.2% fewer erroneous calculations than the baseline. Over the three sessions in the study, participants were able to learn the GestureCalc gestures and efficiently perform short calculations. From our interviews after the second session, participants recognized the effort in learning a new gesture set, yet reported confidence in their ability to become fluent in practice.

Keypad-based character input in existing digital calculator applications on touch screen devices requires precise, targeted key presses that are time-consuming and error-prone for many screen reader users. We demonstrate GestureCalc, a digital calculator that uses target-free gestures for arithmetic tasks. It allows eyes-free target-less input of digits and operations through taps and directional swipes with one to three fingers, guided by minimal audio feedback. A study of the effectiveness of GestureCalc for screen reader users appears in a full paper by the authors at this conference.

Phishing emails often disguise a link's actual URL. Thus, common anti-phishing advice is to check a link's URL before clicking, but email clients do not support this well. Automated phishing detection enables email clients to warn users that an email is suspicious, but current warnings are often not specific. We evaluated the effects on phishing susceptibility of (1) moving phishing warnings close to the suspicious link in the email, (2) displaying the warning on hover interactions with the link, and (3) forcing attention to the warning by deactivating the original link, forcing users to click the URL in the warning. We assessed the effectiveness of such link-focused phishing warning designs in a between-subjects online experiment (n=701). We found that link-focused phishing warnings reduced phishing click-through rates compared to email banner warnings; forced attention warnings were most effective. We discuss the implications of our findings for phishing warning design.