In 1974 an article appeared in Science magazine with the dry-sounding title “Judgment Under Uncertainty: Heuristics and Biases” by a pair of psychologists who were not well known outside their discipline of decision theory. In it Amos Tversky and Daniel Kahneman introduced the world to Prospect Theory, which mapped out how humans actually behave when faced with decisions about gains and losses, in contrast to how economists assumed that people behave. Prospect Theory turned Economics on its head by demonstrating through a series of ingenious experiments that people are much more concerned with losses than they are with gains, and that framing a choice from one perspective or the other will result in decisions that are exactly the opposite of each other, even if the outcomes are monetarily the same. Prospect Theory led cognitive psychology in a new direction that began to uncover other human biases in thinking that are probably not learned but are part of our brain’s wiring.

Thinking fast and slow.

To date, many important threads of information privacy research have developed, but these threads have not been woven together into a cohesive fabric. This paper provides an interdisciplinary review of privacy-related research in order to enable a more cohesive treatment. With a sample of 320 privacy articles and 128 books and book sections, we classify previous literature in two ways: (1) using an ethics-based nomenclature of normative, purely descriptive, and empirically descriptive, and (2) based on their level of analysis: individual, group, organizational, and societal.

Based upon our analyses via these two classification approaches, we identify three major areas in which previous research contributions reside: the conceptualization of information privacy, the relationship between information privacy and other constructs, and the contextual nature of these relationships.

As we consider these major areas, we draw three overarching conclusions. First, there are many theoretical developments in the body of normative and purely descriptive studies that have not been addressed in empirical research on privacy. Rigorous studies that either trace processes associated with, or test implied assertions from, these value-laden arguments could add great value. Second, some of the levels of analysis have received less attention in certain contexts than have others in the research to date. Future empirical studies-both positivist and interpretive--could profitably be targeted to these under-researched levels of analysis. Third, positivist empirical studies will add the greatest value if they focus on antecedents to privacy concerns and on actual outcomes. In that light, we recommend that researchers be alert to an overarching macro model that we term APCO (Antecedents → Privacy Concerns → Outcomes).

/pdf/information-privacy-research-an-interdisciplinary-review-3ozmykcimw.pdf

Information privacy research: an interdisciplinary review

A body fluid sampling system for use on a tissue site includes a single drive force generator. A plurality of penetrating members are operatively coupled to the force generator. The force generator moves each of the members along a path out of a housing with a penetrating member exit, into the tissue site, stops in the tissue site, and withdraws out of the tissue site. A flexible support member couples the penetrating members to define a linear array. The support member is movable and configured to move each of the penetrating members to a launch position associated with the force generator.

Method and Apparatus for Penetrating tissue

Computer security depends largely on passwords to authenticate human users. However, users have difficulty remembering passwords over time if they choose a secure password, i.e. a password that is long and random. Therefore, they tend to choose short and insecure passwords. Graphical passwords, which consist of clicking on images rather than typing alphanumeric strings, may help to overcome the problem of creating secure and memorable passwords. In this paper we describe PassPoints, a new and more secure graphical password system. We report an empirical study comparing the use of PassPoints to alphanumeric passwords. Participants created and practiced either an alphanumeric or graphical password. The participants subsequently carried out three longitudinal trials to input their password over the course of 6 weeks. The results show that the graphical password users created a valid password with fewer difficulties than the alphanumeric users. However, the graphical users took longer and made more invalid password inputs than the alphanumeric users while practicing their passwords. In the longitudinal trials the two groups performed similarly on memory of their password, but the graphical group took more time to input a password.

PassPoints: design and longitudinal evaluation of a graphical password system

Starting around 1999, a great many graphical password schemes have been proposed as alternatives to text-based password authentication. We provide a comprehensive overview of published research in the area, covering both usability and security aspects as well as system evaluation. The article first catalogues existing approaches, highlighting novel features of selected schemes and identifying key usability or security advantages. We then review usability requirements for knowledge-based authentication as they apply to graphical passwords, identify security threats that such systems must address and review known attacks, discuss methodological issues related to empirical evaluation, and identify areas for further research and improved methodology.

/pdf/graphical-passwords-learning-from-the-first-twelve-years-1h8jsqlrwr.pdf

Graphical passwords: Learning from the first twelve years

The weakness of knowledge-based authentication systems, such as passwords and Personal Identification Numbers (PINs), is well known, and reflects an uneasy compromise between security and human memory constraints. Research has been undertaken for some years now into the feasibility of graphical authentication mechanisms in the hope that these will provide a more secure and memorable alternative. The graphical approach substitutes the exact recall of alphanumeric codes with the recognition of previously learnt pictures, a skill at which humans are remarkably proficient. So far, little attention has been devoted to usability, and initial research has failed to conclusively establish significant memory improvement. This paper reports two user studies comparing several implementations of the graphical approach with PINs. Results demonstrate that pictures can be a solution to some problems relating to traditional knowledge-based authentication but that they are not a simple panacea, since a poor design can eliminate the picture superiority effect in memory. The paper concludes by discussing the potential of the graphical approach and providing guidelines for developers contemplating using these mechanisms.

/pdf/is-a-picture-really-worth-a-thousand-words-exploring-the-3ht76d4tys.pdf

Is a picture really worth a thousand words? Exploring the feasibility of graphical authentication systems

https://northumbria-test.eprints-hosting.org/id/document/267258

Cybersecurity in healthcare: A narrative review of trends, threats and ways forward

This paper describes some of the consumer-driven usability research conducted by NCR Self Service Strategic Solutions in the development of an understanding of usability and user acceptance of leading-edge biometrics verification techniques. We discuss biometric techniques in general and focus upon the usability phases and issues, associated with iris verification technology at the Automated Teller Machine (ATM) user interface. The paper concludes with a review of some of the major research issues encountered, and an outline of future work in the area.

/pdf/usability-and-biometric-verification-at-the-atm-interface-7dc9aa62uq.pdf

Usability and biometric verification at the ATM interface

https://research.tees.ac.uk/ws/files/4359528/621647.pdf

Risk perceptions of cyber-security and precautionary behaviour

This paper addresses knowledge-based authentication systems in self-service technology, presenting the design and evaluation of the Visual Identification Protocol (VIP). The basic idea behind it is to use pictures instead of numbers as a means for user authentication. Three different authentication systems based on images and visual memory were designed and compared with the traditional Personal Identification Number (PIN) approach in a longitudinal study involving 61 users. The experiment addressed performance criteria and subjective evaluation. The study and associated design exploration revealed important knowledge about users, their attitudes towards and behaviour with novel authentication approaches using images. VIP was found to provide a promising and easy-to-use alternative to the PIN. The visual code is easier to remember, preferred by users and potentially more secure than the numeric code. Results also provided guidelines to help designers make the best use of the natural power of visual memory in security solutions.

/pdf/vip-a-visual-approach-to-user-authentication-zocawsv4xx.pdf

Lynne Coventry

Papers

Is a picture really worth a thousand words? Exploring the feasibility of graphical authentication systems

Cybersecurity in healthcare: A narrative review of trends, threats and ways forward

Usability and biometric verification at the ATM interface

Risk perceptions of cyber-security and precautionary behaviour

VIP: a visual approach to user authentication