Many children are growing up in a “digital-by-default” world, where technologies mediate many of their interactions. There is emerging consensus that those who design technology must support children's privacy and security. However, privacy and security are complex concepts that are challenging to design for, and centering the interests of children is similarly difficult. Through a document analysis of 90 HCI publications, we examine what problems and solutions designing for children's privacy and security addresses and how this research engages with children. Applying Solove's privacy taxonomy, we find that research addresses a range of problems related to information collection, processing, dissemination, and invasion at the organizational, system, and individual levels. Children's participation in this research is largely limited to providing feedback rather than helping to guide the research itself. Based on these findings, we offer recommendations for designers to sharpen their privacy and security contributions and center children in their work.

To prevent credential stuffing attacks, industry best practice now proactively checks if user credentials are present in known data breaches. Recently, some web services, such as HaveIBeenPwned (HIBP) and Google Password Checkup (GPC), have started providing APIs to check for breached passwords. We refer to such services as compromised credential checking (C3) services. We give the first formal description of C3 services, detailing different settings and operational requirements, and we give relevant threat models. One key security requirement is the secrecy of a user's passwords that are being checked. Current widely deployed C3 services have the user share a small prefix of a hash computed over the user's password. We provide a framework for empirically analyzing the leakage of such protocols, showing that in some contexts knowing the hash prefixes leads to a 12x increase in the efficacy of remote guessing attacks. We propose two new protocols that provide stronger protection for users' passwords, implement them, and show experimentally that they remain practical to deploy.