Accessibility research can only serve the needs of marginalized populations by considering intersectional and critical frameworks that provide a complete picture of how access is created in different contexts.To identify the novel assistive practices of often ignored disabled communities, we present findings from 12 interviews with disabled sex workers (i.e., people who sell their own erotic labor) (e.g., escorting, webcamming, lap dancing).Based on their experiences, we present systems of access as a framework to analyze how disabled people develop access strategies in contexts that include stakeholders that actively intend them harm.By applying this framework, we call on researchers to: presume the presence of adversarial stakeholders in the lives of marginalized disabled communities, respect the consequence-based and harm-reduction practices of disabled people in these contexts, and seek out these marginalized communities with safe practices that prevent undue harm.

Smart home users have a variety of controls they can use to configure their devices according to their preferences. However, it is unclear how people utilize these controls, what considerations they make, and the implications of those decisions for users' privacy. To address this gap, we have conducted two complimentary interview studies regarding the controls available for configuring, monitoring, and sharing collected information in two common smart home devices: a smart doorbell and a lock. We interviewed 21 non-owner participants in the lab and 18 owners of these devices over the phone. While both novice users and existing owners were primarily driven by desired functionality while setting up their devices, their configuration decisions impact what data gets collected and how that data and the device are used and shared. Our findings suggest a range of opportunities to improve the privacy-related features and support for smart home devices.

As smart devices are becoming commonplace in homes, we need to explore the needs of not just the residents of the home, but also of secondary stakeholders who may be granted access to these devices from outside of the home. We conducted a mixed methods study, which included a survey of 163 smart home device owners and a follow-up interview with 13 individuals who currently share their smart home devices with others outside of their home. Nearly half (47.8%) of our survey participants shared at least one smart home device with someone that did not live with them. Individuals sought greater safety and security by providing remote access to trusted family members or friends. By understanding users' perspectives about privacy and trust in relation to sharing smart home devices beyond the home, we build a case for community-based access control of smart home devices in the Internet of Things.

End user license agreements, terms of service agreements and privacy policies all suffer from many of the same problems: people rarely read them and yet still agree to whatever is contained within them. There are many usability challenges with these policies: they are often lengthy, with jargon filled language that is difficult to quickly comprehend. However, these notices are the primary tool for users to understand the privacy implications of their digital activities and make informed decisions on which websites and software they use. Prior research has explored alternative designs for such notices, using more visual and structured interfaces for conveying information. We expand upon these results by exploring a comic-based interface, examining whether it can engage users to pay more attention to a terms of service agreement. Our results indicate that the comic version did hold user attention for longer than text-based alternatives, encouraging deeper investigation into comic-based interfaces.

Many of the security problems that people face today, such as security breaches and data theft, are caused by security vulnerabilities in application source code. Thus, there is a need to understand and improve the experiences of those who can prevent such vulnerabilities in the first place - software developers as well as application security experts. Several studies have examined developers' perceptions and behaviors regarding security vulnerabilities, demonstrating the challenges they face in performing secure programming and utilizing tools for vulnerability detection. We expand upon this work by focusing on those primarily responsible for application security - security auditors. In an interview study of 32 application security experts, we examine their views on application security processes, their workflows, and their interactions with developers in order to further inform the design of tools and processes to improve application security.

Security vulnerabilities are still prevalent in today's software, yet many can be prevented with standard secure programming techniques. Thus, educators of future developers need to teach students not just how to program, but how to program securely. Many researchers advocate integrating secure programming knowledge and skills across the computer science curriculum. In this paper, we report the results of a study comparing two such methods: our own tool ESIDE, which provides students with security warnings on assignment code, and a security-clinic approach, a one-on-one session with a teaching assistant. Both methods suffered from challenges in incentivizing students to incorporate secure programming techniques into their code. We discuss the relative strengths and weaknesses of these methods, and the challenges of timing and motivation of secure programming education.