iiinova — where your digital self keeps evolving

Kami Vaniea @kaniea.bsky.social · 28/10/2025

Training LLMs that are both safe and accurate presents challenges such as carbon footprint, fine tuning, accuracy on main tasks, and not having easy work arounds to avoid safeguards.

Kami Vaniea @kaniea.bsky.social · 28/10/2025

Sirisha Rambhatla presenting at the @uwaterloo.ca cybersecurity and privacy institute industry day. Building efficient and safe LLMs.

110

Kami Vaniea @kaniea.bsky.social · 20/10/2025

Incidents like this make patch management challenging. Windows patch broke mouse and keyboard support in *recovery mode*. Normal operation still fine, but if anything breaks.... recovery is now gone. How many admins even test for this? www.tomshardware.com/software/win...

tomshardware.com

Windows 11's October update just broke the Windows Recovery Environment — USB keyboards and mice unusable in Windows RE after latest bug hits

Another week, another OS-breaking bug.

Kami Vaniea @kaniea.bsky.social · 09/09/2025

Canadian Anti-Scam Coalition set to launch this afternoon, its an alliance between credit card companies, banks, telecoms, Canadian government, and tech companies. The aim is to share information and reduce fraud. thelogic.co/news/big-ban...

thelogic.co

Canada’s big banks, telecoms and tech firms are joining forces to fight scams - The Logic

From Bell to Google, major firms in Canada are following Australia’s model of sharing information to fight fraudsters

120

@lujobauer.bsky.social starting off USENIX security to a large packed room.

020

Closing #soups2025 remarks by our incredible general chair Patrick Gage Kelly.

130

This work reminds me greatly of the book: Taming Information Technology which was written in response to the proposal to automate system administrator tasks.

000

ICS are also under lots of regulation.

110

Clement Fung presenting about industrial control systems (ICS). They interviewed people who protect ICS. Current alarm systems have a great variety in how they are designed and even who is in charge of managing them. #soups2025 www.usenix.org/conference/s...

100

Increase self-efficacy. <- mirrors my own experiences that are hard to tell if it is even working.

000

If security and privacy was a character, what traits would they have?

100

Nina Gerber @ninag72.bsky.social presenting on social and emotional dimensions of security. How can security and privacy be made more enjoyable? Used sentence completion tasks. People found important but not interesting. #soups2025 www.usenix.org/conference/s...

100

Qiurong Song presenting on predatory monetization in video games such as Roblox. Loot boxes being a example. Developers are adding predatory design on purpose. Use of possess and in-have currency make it harder to stay aware of how much is spent. #soups2025 www.usenix.org/conference/s...

000

Teens and privacy in terms of barrier management. Navigate self disclosure. Issues like ambiguous norms. Also the ability to trust an audience. #soups2025 www.usenix.org/conference/s...

011

Lots of great discussions around yours of errors in papers. Sadly statistics errors are common.

000

Jenny Tang presenting about doing and reporting statistics in research papers. #soup2025 There are many ways to do statistics incorrectly and even if the test is correct the necessary numbers to interpret them may not be provided. @lujobauer.bsky.social www.usenix.org/conference/s...

111

Annalina Buckmann (soon on job market) presenting on sociodemographic factors and barriers to security and privacy adoption. Mapped findings to SPAF factors. #soups2025 www.usenix.org/conference/s...

001

Anna-Marie Ortloff presenting a replication of the "No one can hack my mind" paper. #soups2025 Experts have even more focus on authentication. End users also using 2FA increasing anf anti virus usage going down. www.usenix.org/conference/s...

001

Laura Marie Abels presenting on Social Desirability and developing a scale to measure it. #soups2025 www.usenix.org/conference/s...

001

Lily Klucinec presenting about mobile money in Kenya which is a financial system tied to SIM cards. To withdraw money personal information currently have to be shared with a mobile money in-person agent. #soups2025 @lorriecranor.bsky.social www.usenix.org/conference/s...

031

Security keys had a range of usability challenges linked to their physical nature, such as having to carry them and find a comparable USB slot for them.

000

Time based one time passwords, such as those generated by Google Authenticator app. Part of the FIDO Alliance. The paper compares physical secury keys to TOTPs+passwords. #soups2025 www.usenix.org/conference/s...

101

Primary password typing meant that participants saw no improvement in time use. Why type a password just so the software could enter a password. Easier to just enter the password directly.

000

Peter Mayer presenting about forest time users of password managers #soups2025 Before the study on average had 36 passwords, some of which were reused. There was use of the manager such as adding new passwords. www.usenix.org/conference/s...

101

Thank you for the resource, I am always looking at ways to fit ethics into my cyber security course.

Knowledge based questions also no longer recommended, but still common.

000

Analysis of NIST authentication advice in standards documents. #soups2025 Multi factor advice is followed by many universities. Password regular password changes (no longer recommended) still common. www.usenix.org/conference/s...

101

People take videos of strangers and then use TikTok to identify the person. Many people are identified this way. While sometimes heartwarming, it can also be used for abuse and stalking people. #soups2025 www.usenix.org/conference/s...

021

Norms are different between services. People did think that forced reciprocity is fair.

000

Was my message read? Privacy and signaling on Facebook messenger | Kami Vaniea

Reminds me a bit of my lands old paper on the seen by feature on social media. vaniea.com/publication/...

vaniea.com

100

Usability of privacy nutrition labels. #soups2025 Terms in privacy labels are widely misunderstood. www.usenix.org/conference/s...

011

Challenges in balancing harms between disclosure and getting services. Also guessing about how data will be used and then deciding if the best move is not sharing, sharing, or providing fake data.

000

Mark Wong presenting about essential online services and minoritised ethnic people. #soups2025 Concerns include control of personal data. People were being selective in what they share. They also make up days. That also don't use some services out of worries. www.usenix.org/conference/s...

111

This work looks at legal requests from law enforcement. The problem is that large tech companies have policies that are based on Western culture. So issues like abusive sharing that might lead to divorce but are not sexualy explicit are not always honoured even with court order.

000

Amna Batool presenting on between court orders and platform policies at #soups2025 Non consentual image disclosure, even seemingly innocent images can in some cultures lead to violence. www.usenix.org/conference/s...

100

#soups2025 day 2 about to start. www.usenix.org/conference/s...

000

#soups2026 keynote Greg Chappell on "Mind the gap between research and practice"

Most were not sure what should or should not be sandboxed. They were positive about Secomp but using it was hard.

000

Playing in the Sandbox: A Study on the Usability of Seccomp | USENIX

Joseph Hallett presenting on behalf of Maysara Alhindi at #soups2025 How do developers go about adding sandbox to code. All participants ran strace as a start point. Using chatgpt made it take longer. Everyone took a different approach. www.usenix.org/conference/s...

usenix.org

100

Yara Alsiyat presenting on privacy, IoT, and cultural sensitivity at #soups2025 Smart cameras are seen as a social presence, capable of violating privacy. It would be helpful to have a guest mode, and pausing for times like prayer. www.usenix.org/conference/s...

000

There are lots of ways to incorrectly use IoT devices to harm others that use the same device. Digital housework coming up again as usually the person who sets up the device has more device access and control than others.

000

Kieron Ivy Turk presenting on IoT abuse at #soups2025 Human harms model developed to categorise harms. This study looks at how people learn how to use IoT devices in abuse situation. www.usenix.org/conference/s...

110

At point of display on shelfs, browser median age 1.27 years. Even those with updates didn't necessarily include security updates. OS may be updated, but browser not updated. Recommend product labels that state update policy before purchase including non-OS software.

000