Can Johnny be a whistleblower? A qualitative user study of a social authentication
summary
Implements a SOAP social authentication wizard inside a modified Signal extension and runs a one‑hour lab study where participants play whistleblowers verifying three journalist contacts under an active man‑in‑the‑middle attack. A pilot shows 3/9 compromised, the refined interface reduces that to 1/18; in the full run 7/18 participants ever send data to a journalist. The study logs UI choices (red verification bar, provider+identifier flow), finds most failures stem from incorrect comparison or stress and concludes social authentication is more graspable but needs more study.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:12Authentication ceremonies
- 2:59Social authentication risks
- 4:04Whistleblower scenario study
- 6:56User interface modifications for the study
- 8:01Study results and failures
- 10:29Social auth performance
- 11:54Conclusion and future work
related talks
28m"Something isn't secure, but I'm not sure how that translates into a problem"
09mAn Empirical Study of a Decentralized Identity Wallet...
01h 02mBuilding Identity into LLM Workflows with Verifiable Credentials
39mPrevent Phishing & Impersonation
11m"Is Reporting Worth the Sacrifice of Revealing What I've Sent?"
12mIncreasing security without decreasing usability: A comparison of various verifiable...
27mNew Phone, Who Dis?: Human Authentication in the Digital Age
13mDesign and Evaluation of Privacy-Preserving Protocols for Agent-Facilitated Mobile...