Large Language Models (LLMs) have rapidly become ubiquitous, demonstrating remarkable proficiency in generating text and responding to prompts. Despite their potential, concerns about privacy and trust persist, yet methods for engaging end-users in designing privacy-conscious AI remain limited. This paper presents a replicable co-design methodology for engaging end-users in privacy-conscious LLM design. Through workshops with 36 participants across three speculative scenarios—mental health applications, travel assistants, and workplace assistants—we demonstrate how combining speculative scenarios with established frameworks (Grice’s Maxims, Schaub’s privacy design space) and trained facilitators enables meaningful participation from users without technical expertise. The co-designed dialogues reveal that users desire dynamic, context-sensitive privacy communication that leverages LLMs’ conversational capabilities. We provide practitioners with a replicable methodology comprising: (1) scenario creation methods, (2) framework scaffolding approaches, and (3) facilitator training guidance, alongside design implications for privacy-conscious conversational AI.

Progressive digitisation and adoption of artificial intelligence (AI) are reshaping welfare services in ways that risk compounding inequalities for disabled people. Globally, many governments present these reforms as beneficial–streamlining processes, reducing costs and eliminating delays. Yet digitisation and automation of welfare decision-making can deepen exclusion and erode human accountability. In response, this paper foregrounds the lived experiences of people with the communication disability aphasia in navigating digitised welfare and their perspectives on AI-automated futures. We report findings from a four-stage participatory design study involving eight workshops with 42 recruited co-designers. Reflexive thematic analysis identified five challenges: the cost of performing disability, geographies of inequity, navigating digital bureaucracy, the accessibility paradox and hostile design. Co-designers voiced concerns about AI-automation but envisioned inclusive future alternatives: AI dialogues that are patient, multimodal and supportive; welfare systems that are compassionate, transparent and retain human recourse; and infrastructures that are open, publicly governed and truthful.

As more young women in China live alone, they navigate entangled privacy, security, and safety (PSS) risks across smart homes, online platforms, and public infrastructures. Drawing on six participatory threat modeling (PTM) workshops (n = 33), we present a human-centered threat model that illustrates how digitally facilitated physical violence, digital harassment and scams, and pervasive surveillance by individuals, companies, and the state are interconnected and mutually reinforcing. We also document four mitigation strategies employed by participants: smart home device configurations, boundary management, sociocultural practices, and social media tactics–each of which can introduce new vulnerabilities and emotional burdens. Based on these insights, we developed a digital PSS guidebook for young women living alone (YWLA) in China. We further propose actionable design implications for smart home devices and social media platforms, along with policy and legal recommendations and directions for educational interventions.

Providing accurate and actionable advice about phishing emails is challenging. The majority of advice is generic and hard to implement. Phishing emails that pass through filters and land in user inboxes are usually sophisticated and exploit differences between how humans and computers interpret emails. Therefore, users need accurate and relevant guidance to take the right action. This study investigates the effectiveness of guidance based on features extracted from emails, which even in AI-driven systems can sometimes be inaccurate, leading to poor advice. We examined three conditions: control (generic advice), perfect advice, and realistic advice, through an online survey of 489 participants on Prolific, and measured user accuracy and confidence in phishing detection with and without guidance. Our findings indicate that having advice specific to the email is more effective than generic guidance (control). Inaccuracies in the guidance can also impact user decisions and reduce detection accuracy.

Individuals can become victims of security incidents, privacy violations, online scams, and social media abuse. In addition to prevention, users should create response strategies in case misfortune strikes. To better understand response to digital harm, we conducted the first study of personal cyber insurance in the US and the UK. We explored the supply-side via a content analysis of 24 cyber insurance policies. The results show personal cyber insurance compensates security, privacy and fraud incidents, with a slim majority also covering cyberbullying. Comparing these results to prior work, we find that coverage in the US and UK has significant differences to coverage in Germany. We study the demand-side via a survey distributed to 584 participants with an even US/UK split. Just 1.6% of respondents have cyber coverage and 8.5% are aware of the product. We introduce the concepts of risk uncertainty and coverage uncertainty, finding both are prevalent for personal cyber insurance. Studying coverage uncertainty, we discover a gap between insurers and participants, which is broadest for online fraud and narrowest for identity theft and cyber-bullying. Turning to risk uncertainty, we discovered that in the aggregate users are relatively well calibrated regarding the frequency of different incidents. Individuals estimate that fraud incidents have the greatest impact, followed by security and privacy incidents. Cyberbullying has very low estimated impact. Regarding purchasing a policy, participants raised uncertainties about contractual details, reporting requirements, victimization statistics, and access to security solutions.

Augmentative and alternative communication (AAC) technologies are typically fixed-form factor mobile devices, which can be physically obtrusive and visually identifiable – perpetuating public stigmas and limiting non-verbal communication. These qualities are undesirable for many AAC-using communities including stroke survivors, who can have complex communication needs onset by aphasia and hemiplegic body paralysis. Furthermore, underrepresented communities such as people with aphasia are often unconsidered in the design of emerging technologies. We contest these trends by asking what these emerging and future technologies might mean for communication support. To do this, we envision and prototype mixed reality and discreet assistive technologies that support communication with people living with aphasia. We report results from the co-design process, including participants’ perspectives on nascent mixed reality, diegetic technologies, and outcomes from low-fidelity AAC prototyping. These activities culminated in three high-fidelity prototypes with different characteristics and form-factors: Pico-project AAC, Prompt AAC and Holo AAC, which embody projection, worn audio devices, and headset driven mixed reality. From subsequent focus groups, we present findings from an evaluation of all prototypes, reflecting on the possibilities of present and future mixed-reality technologies to augment communication.

Patching software theoretically leads to improvements including security critical changes, but it can also lead to new issues. For System Administrators (sysadmins) new issues can negatively impact operations at their organization. While mitigation options like test environments exist, little is known about their prevalence or how contextual factors like size of organization impact the practice of Patch Management. We surveyed 220 sysadmins engaged in Patch Management to investigate self-reported behaviors. We found that dedicated testing environments are not as prevalent as previously assumed. We also expand on known behaviours that sysadmins perform when facing a troublesome patch, such as employing a range of problem solving behaviours to inform their patching decisions.

Malicious communications aimed at tricking employees are a serious threat for organizations, necessitating the creation of procedures and policies for quickly respond to ongoing attacks. While automated measures provide some protection, they cannot completely protect an organization. In this case study, we use interviews and observations to explore the processes staff at a large University use when handling reports of malicious communication, including how the help desk processes reports, whom they escalate them to, and how teams who manage protections such as the firewalls and mail relays use these reports to improve defenses. We found that the process and work patterns are a distributed cognitive process requiring multiple distinct teams with narrow system access and tactic knowledge. Sudden large campaigns were found to overwhelm the help desk with reports, greatly impacting staff's workflow and hindering the effective application of mitigations and the potential for reflection. We detail potential improvements to ticketing systems and reflect on ITIL, a common framework of best practice in IT management.

Applying regular patches is vital for the timely correction of security vulnerabilities, but installing patches also risks disrupting working systems by potentially introducing unknown errors. System administrators must manage the challenges of patching using a combination of reliance on best practice and available information to best match their organizations' needs. In this work, we study how patch-related activities are supported by the mailing list of the website PatchManagement.org which is dedicated to the task. We qualitatively coded 356 list emails sent between March and July, 2018, to understand how members interact with the list community. Based on our results, we argue that the mailing list is an example of an Online Community of Practice, where practitioners engage in communal learning and support. We find that the community supports members in multiple phases of the patching process by providing workarounds before a patch is available, guidance prioritizing released patches, and helping with post-patch trouble. Additionally, the community provides help around tool selection and facilitating discussions.