Publications

(2024). Using AI Assistants in Software Development: A Qualitative Study on Security Practices and Concerns. CCS.

(2024). “I can say I’m John Travolta...but I’m not John Travolta.” Investigating the Impact of Changes to Social Media Verification Policies on User Perceptions of Verified Accounts. SOUPS (Acceptance: 21%).

PDF

(2024). A Survey of Cybersecurity Professionals’ Perceptions and Experiences of Safety and Belonging in the Community. SOUPS (Acceptance: 21%).

PDF

(2024). 'There are Rabbit Holes I Want to Go Down that I'm Not Allowed to Go Down': An Investigation of Security Expert Threat Modeling Practices for Medical Devices. USENIX Security (Acceptance: TBD%).

PDF

(2024). An Investigation of US Universities’ Implementation of FERPA Student Directory Policies and Student Privacy Preferences. CHI (Acceptance: 26.4%).

PDF

(2023). Bug Hunters’ Perspectives on the Challenges and Benefits of the Bug Bounty Ecosystem. USENIX Security (Acceptance: 29%).

PDF

(2023). Vulnerability Discovery for All: Experiences of Marginalization in Vulnerability Discovery. IEEE S&P (Acceptance: 18%).

PDF

(2023). Everybody’s Got ML, Tell Me What Else You Have: Practitioners' Perception of ML-Based Security Tools and Explanations. IEEE S&P (Acceptance: 18%).

PDF

(2022). Understanding the How and the Why: Exploring Secure Development Practices Through a Course Competition. CCS (Acceptance: 23%).

PDF Poster

(2022). A Qualitative Evaluation of Reverse Engineering Tool Usability. ACSAC (Acceptance: 24%).

PDF

(2022). Where to Recruit for Security Development Studies: Comparing Six Software Developer Samples. USENIX Security (Acceptance: 18%).

PDF

(2022). How Ready is Your Ready? Assessing the Usability of Incident Response Playbook Frameworks. CHI (Acceptance: 26%).

PDF

(2021). Benefits and Drawbacks of Adopting a Secure Programming Language: Rust as a Case Study. SOUPS (Acceptance: 26.5%).

PDF

(2021). HackEd: A Pedagogical Analysis of Online Vulnerability Discovery Exercises. IEEE S&P (Acceptance: 12%).

PDF Poster

(2021). An Investigation of Online Reverse Engineering Community Discussions in the Context of Ghidra. Euro S&P (Acceptance: 32%).

PDF

(2020). The Hackers’ Viewpoint: Exploring Challenges and Benefits of Bug-Bounty Programs. WSIW.

PDF

(2020). On the Other Side of the Table: Hosting Capture-the-Flag (CTF) Competitions, An Investigation from the CTF Organizer’s Perspective. WSIW.

PDF

(2020). An Observational Investigation of Reverse Engineers' Processes. USENIX Security (Acceptance: 16%).

PDF Poster Slides Video

(2020). Understanding security mistakes developers make: Qualitative analysis from Build It, Break It, Fix It. USENIX Security (Acceptance: 16%).

PDF Poster Slides Video

(2020). Building and Validating a Scale for Secure Software Development Self-Efficacy. CHI (Acceptance: 24%).

PDF Poster Slides Video

(2019). Symbolic Path Tracing to Find Android Permission-Use Triggers. BAR.

PDF

(2019). Does Being Verified Make You More Credible? The Effect of Account Verification on Tweet Credibility. CHI (Acceptance: 23%).

PDF Video

(2018). The Battle for New York: A Case Study of Applied Digital Threat Modeling at the Enterprise Level. USENIX Security (Acceptance: 19%).

PDF Slides Video

(2018). User Comfort with Android Background Resource Accesses in Different Contexts. SOUPS (Acceptance: 23%).

PDF Poster Slides

(2018). Toward a Field Study on the Impact of Hacking Competitions on Secure Development. WSIW.

PDF Slides

(2018). Hackers vs Testers: A Comparison of Software Vulnerability Discovery Processes. IEEE S&P (Acceptance: 14%).

PDF Poster Slides Video

(2017). User Interactions and Permission Use on Android. CHI (Acceptance: 25%).

PDF Poster

(2013). Passe-Partout:A General Collection Methodology for Android Devices. TIFS.

PDF

(2011). All Your Droids are Belong to Us: A Survey of Current Android Attacks. WOOT.

PDF Slides Video