Anna-Marie Ortloff

I work as an IT expert at IAB (Institute for Employment Research). I am interested in advancing and developing methods to extract meaning and insights from data and I value collaboration and open science.

During my Phd in the Behavioral Security and Privacy group at the University of Bonn, I investigated resesarch methodology in domains at the intersection of usability, privacy, security, and human information behavior, conducting studies with stakeholders like researchers, software developers, security experts and (technology) users. I defended my doctoral dissertation on research practice and methods in usable security and privacy with summa cum laude in December 2025.

first dot last at iab.de

AM dot last at gmx.de

Publications

Asli Yardim, Anna-Marie Ortloff, Anne Mertens, Carina Wiesen & Alena Naiakshina
"How do security threats affect my work?" - Software Developers’ Mental Models of IT Security Threats and Mitigation Strategies
(2026) Mensch und Computer (MuC'26)

[Bibtex]

[Abstract]

@inproceedings{Yardim2026_SecurityThreatsAffect,
author = {Yardim, Asli and Ortloff, Anna-Marie and Mertens, Anne and Wiesen, Carina and Naiakshina, Alena},
title = {"How do security threats affect my work?" - Software Developers’ Mental Models of IT Security Threats and Mitigation Strategies },
year = {2026},
isbn = {},
publisher = {},
url = {},
doi = {},
booktitle = {},
location = {},
series = {}
}

While end-user decisions primarily impact their own data, software developers' security behavior can affect millions of users' data. To understand developers' decision-making processes, we explored their mental models of security threats. We conducted semi-structured interviews, based on Wash with 37 professional software developers and categorized the threats they discussed using the STRIDE threat modeling approach. We describe three mental models of threat types: Developers focused on threats as exploits, vulnerabilities, or the impact of the threat. Besides development-specific threats (e.g., injection-, denial-of-service attacks), they also expressed concerns about end-user threats (e.g., malware, phishing attacks). We identified mitigation strategies used across threats: soft skills (e.g., communication), hard skills (e.g., security tools and libraries), and organizational strategies (e.g., IT infrastructure). We also discovered distinct roles in interacting with threats, e.g., developers viewed threats as employees or users of (security) tools. We provide recommendations on supporting developers in managing security risks and decisions.
Asli Yardim, Raphael Serafini, Nadine Jost, Anna-Marie Ortloff, Joshua Gabriel Speckels & Alena Naiakshina
"The AI tool can’t make it any worse." Investigating Developers’ Security Behavior with AI Assistants in a Password Storage Study
(2026) Conference on Human Factors in Computing Systems (CHI'26)

[Bibtex]
[PDF]
[Abstract]

@inproceedings{Yardim2026_AIToolMake,
author = {Yardim, Asli and Serafini, Raphael and Jost, Nadine and Ortloff, Anna-Marie and Speckels, Joshua Gabriel and Naiakshina, Alena},
title = {"The AI tool can’t make it any worse." Investigating Developers’ Security Behavior with AI Assistants in a Password Storage Study },
year = {2026},
isbn = {9798400722783},
publisher = {Association for Computing Machinery},
url = {https://doi.org/10.1145/3772318.3791693},
doi = {10.1145/3772318.3791693},
articleno = {1216},
numpages = {33},
booktitle = {Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems},
location = {Barcelona, Spain},
series = {CHI '26}
}

Past research showed that software developers often require explicit instructions to implement security measures. With the rapid rise of AI assistant tools such as ChatGPT, it remains unclear whether AI assistance supports or undermines secure practices, whether explicit security instructions are still essential, and how developers behave without guidance. To investigate these research questions, we conducted a qualitative lab study with 21 computer science students and a quantitative online study with 80 freelance developers. We focused on secure password storage and asked participants to implement registration logic under four conditions: without instructions, with AI assistance, with security instructions, or with both AI assistance and security instructions. Our study reveals a clear behavioral shift: In our task, many participants relied on AI-assisted code generation for security-related tasks, often prioritizing convenience over security. However, explicit security-focused instructions can redirect this behavior toward secure outcomes, demonstrating that AI tools alone are insufficient without targeted guidance.
Florin Martius, Lukas Struck, Nele Borgert, Anna-Marie Ortloff, Simon Lenau, Kay Schröder, Theo Sans-Raimbault, Leonard Heinrich, Matthew Smith & Christian Tiefenau
PowerMeter - User Friendly Power Analysis for HCI Studies
(2026) Poster at Conference on Human Factors in Computing Systems (CHI'26)

[Bibtex]
[PDF]
[Abstract]

@inproceedings{Martius2026_PowerMeterUserFriendly,
author = {Martius, Florin and Struck, Lukas and Borgert, Nele and Ortloff, Anna-Marie and Lenau, Simon and Schr\"{o}der, Kay and Sans-Raimbault, Theo and Heinrich, Leonard and Smith, Matthew and Tiefenau, Christian},
title = {PowerMeter - User Friendly Power Analysis for HCI Studies},
year = {2026},
isbn = {9798400722813},
publisher = {Association for Computing Machinery},
url = {https://doi.org/10.1145/3772363.3799267},
doi = {10.1145/3772363.3799267},
booktitle = {Proceedings of the Extended Abstracts of the 2026 CHI Conference on Human Factors in Computing Systems},
location = {Barcelona, Spain},
articleno = {525},
numpages = {11},
series = {CHI EA '26}
}

Determining the right sample size for empirical studies is a persistent challenge in human–computer interaction research. Studies with too few participants risk low statistical power and unreliable findings, yet existing tools for power analysis, such as G*Power, are often difficult to use. We present PowerMeter, a user-centered tool that helps researchers estimate appropriate sample sizes for quantitative studies. PowerMeter focuses on usability and interpretability, guiding users through the process of defining key study parameters and understanding the implications of statistical power. In a pilot study (N=60), we find that participants using PowerMeter produced more accurate sample size estimates and reported higher levels of trust and satisfaction than those using G*Power.
Anna-Marie Ortloff, Jenny Tang, Arthi Arumugam, Daniel Huschina, Lisa Geierhaas, Florin Martius, Luisa Jansen, Kolja von der Twer, Lilly Jungbluth & Matthew Smith
Replication: "No one can hack my mind" - 10 years later: An update and outlook on experts' and non-experts' security practices and advice
(2025) Symposium on Usable Privacy and Security (SOUPS'25)

[Bibtex]
[PDF]
[Abstract]
[Presentation Video]

@inproceedings{Ortloff2025_ReplicationNoOne,
author = {Ortloff, Anna-Marie and Tang, Jenny and Arumugam, Arthi and Huschina, Daniel and Geierhaas, Lisa and Martius, Florin and Jansen, Luisa and von der Twer, Kolja and Jungbluth, Lilly and Smith, Matthew},
title = {Replication: "No one can hack my mind" - 10 years later: An update and outlook on experts' and non-experts' security practices and advice},
year = {2025},
isbn = {978-1-939133-51-9},
publisher = {USENIX Association},
url = {https://www.usenix.org/conference/soups2025/presentation/ortloff},
doi = {},
booktitle = {Twentyfirst Symposium on Usable Privacy and Security (SOUPS 2025)},
location = {Seattle, USA},
series = {SOUPS '25}
}

In 2015, Ion, Reeder, and Consolvo studied IT security advice and self-reported security behavior of experts and non-experts. In 2019, Busse et al. replicated this study and found only minor changes in expert advice and non-expert behavior, with persisting differences between the two groups. Now, 10 years later, we replicated the study with an updated survey and compared our results to both prior studies. Additionally, we interviewed security experts and asked them for their views on the past and future of IT security advice. We report the current state of security behavior and advice based on two survey samples: one non-expert (N=990), and one expert sample (N=75) and an additional expert interview sample (N=35). We identified notable changes in reported security behavior for both experts and non-experts, including that experts and non-experts are beginning to adopt new security practices in authentication. The expert interviews show a path forward, with experts hoping for more improvements to usability and targeted advice for specific user and device contexts.
Laura Marie Abels, Matthew Smith & Anna-Marie Ortloff
I never reuse passwords! Development and Validation of a Security and Privacy Social Desirability Scale (SP-SDS) for end users without a background in computer science
(2025) Symposium on Usable Privacy and Security (SOUPS'25)
Distinguished Paper Award

[Bibtex]
[PDF]
[Abstract]
[Presentation Video]

@inproceedings{Abels2025_NeverReusePasswords,
author = {Abels, Laura Marie and Smith, Matthew and Ortloff, Anna-Marie},
title = {I never reuse passwords! Development and Validation of a Security and Privacy Social Desirability Scale (SP-SDS) for end users without a background in computer science},
year = {2025},
isbn = {978-1-939133-51-9},
publisher = {Usenix Association},
address = {},
url = {https://www.usenix.org/conference/soups2025/presentation/abels},
doi = {},
booktitle = {Twentyfirst Symposium on Usable Privacy and Security (SOUPS 2025)},
location = {Seattle, USA},
series = {SOUPS '25}
}

Social desirability bias can be a problem in human-subjects-research, if participants give answers they believe researchers want to hear, instead of their true opinion. This is especially concerning for sensitive topics, which are prevalent in Usable Security and Privacy (USP) research, e.g. when asking users about their security habits, experiences of digital abuse or opinions on surveillance. While validated scales measuring general social desirability bias exist, it is unclear how applicable they are in USP. Besides the jarring context switch, it is uncertain how well social desirability of security and privacy related behavior matches general social desirability. To address this, we developed and validated a 13-item security and privacy-specific social desirability scale (SP-SDS), (total N=1167). A correlation of τ = .43 between SP-SDS and the established Marlowe-Crowne SDS confirms that social desirability bias in USP is related to, but distinct from, general social desirability bias. Based on our validated scale we conducted a study with a representative US-sample (N=867) for participants without a CS-background, to measure the perception of social desirability for the behaviors contained in the SP-SDS and to create a baseline for comparison with other samples. Finally, we make recommendations for using SP-SDS in USP studies.
Anna-Marie Ortloff, Florin Martius, Mischa Meier, Theo Raimbault, Lisa Geierhaas & Matthew Smith
Small, Medium, Large? A Meta-Study of Effect Sizes at CHI to Aid Interpretation of Effect Sizes and Power Calculation
(2025) Conference on Human Factors in Computing Systems (CHI'25)

[Bibtex]
[PDF]
[Abstract]

@inproceedings{Ortloff2025_SmallMediumLarge,
author = {Ortloff, Anna-Marie and Martius, Florin and Meier, Mischa and Raimbault, Theo and Geierhaas, Lisa and Smith, Matthew},
title = {Small, Medium, Large? A Meta-Study of Effect Sizes at CHI to Aid Interpretation of Effect Sizes and Power Calculation},
year = {2025},
isbn = {979-8-4007-1394-1/25/04},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3706598.3713671},
doi = {10.1145/3706598.3713671},
booktitle = {Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems},
location = {Yokohama, Japan},
series = {CHI '25}
}

Statistical reporting, especially of effect sizes, is at the root of many methodological issues in quantitative research at CHI. Effect sizes are necessary for assessing practical relevance of results, a-priori power analysis, and meta-analyses, but currently, they are often not reported. Interpretations in the context of the study and the research field are also rare. To aid to researchers in reporting and contextualizing their effect sizes within their research field as well as choosing effect sizes for power analysis, we conducted a meta-study of quantitative CHI papers. We extracted statistics from all quantitative CHI papers published between 2019-2023 (N=1692). Based on effect sizes and the papers' CCS categories, we present effect size distributions in 12 CHI research fields. Through an additional qualitative analysis of 67 quantitative CHI'23 publications, we identify five categories of approaches that researchers take when interpreting effect size: Comparing test-specific values, assigning size labels, using a statistical or methodological reference frame, comparing different observations and interpreting for the big picture.
Anna-Marie Ortloff, Julia Grohs, Simon Lenau & Matthew Smith
A Qualitative Study on How Usable Security and HCI Researchers Judge the Size and Importance of Odds Ratio and Cohen's d Effect Sizes
(2025) Conference on Human Factors in Computing Systems (CHI'25)
Best Paper Award

[Bibtex]
[PDF]
[Abstract]

@inproceedings{Ortloff2025_QualitativeStudy,
author = {Ortloff, Anna-Marie and Grohs, Julia Angelika and Lenau, Simon and Smith, Matthew},
title = {A Qualitative Study on How Usable Security and HCI Researchers Judge the Size and Importance of Odds Ratio and Cohen's d Effect Sizes},
year = {2025},
isbn = {979-8-4007-1394-1/25/04},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3706598.3714022},
doi = {10.1145/3706598.3714022},
booktitle = {Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems},
location = {Yokohama, Japan},
series = {CHI '25}
}

Researchers often place a strong focus on statistical significance when reporting the results of statistical tests. However, effect sizes are reported less frequently, and interpretation in the context of the study and the research field is even rarer. These interpretations of effect sizes are, however, necessary to understand the practical importance of a result for the community. To explore how Usable Security & Privacy (USP) and HCI researchers interpret effect sizes and make judgments on practical importance, we conducted survey and interview studies with a total of 63 researchers at CHI and SOUPS 2023. Our studies focused on Cohen's d and odds ratios in two USP and one HCI scenario. We analyzed which artifacts researchers consider when judging effect size, and found misconceptions and variation between the participants, highlighting how difficult judging statistics can be. Based on our findings, we make concrete recommendations for improved reporting practices around effect sizes.
Florin Martius, Luisa Jansen, Lukas Struck, Arthi Arumugam, Lisa Geierhaas, Anna-Marie Ortloff, Matthew Smith & Christian Tiefenau
Out of Sight, out of Mind? Exploring Data Protection Practices for Personal Data in Usable Security & Privacy Studies
(2025) Conference on Human Factors in Computing Systems (CHI'25)
Honorable Mention Award

[Bibtex]
[PDF]
[Abstract]

@inproceedings{Martius2025_OutSight,
author = {Martius, Florin and Jansen, Luisa and Struck, Lukas and Arumugam, Arthi and Geierhaas, Lisa and Ortloff, Anna-Marie and Smith, Matthew and Tiefenau, Christian},
title = {Out of Sight, out of Mind? Exploring Data Protection Practices for Personal Data in Usable Security \& Privacy Studies},
year = {2025},
isbn = {979-8-4007-1394-1/25/04},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3706598.3713654},
doi = {10.1145/3706598.3713654},
booktitle = {Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems},
location = {Yokohama, Japan},
series = {CHI '25}
}

Adherence to data protection measures such as pseudonymization or anonymization is critical in human subjects research because it has a direct impact on the confidentiality of participants' sensitive information, trust in research practices, and compliance with ethical and legal standards. Regulations such as the General Data Protection Regulation (GDPR) and guarantees made by researchers in informed consent forms mandate strict protocols for data security. However, compliance with these is not always straightforward. To gain qualitative insights into data protection practices in the field of Usable Security and Privacy (USP), we conducted interviews with 22 practitioners (five professors, eight researchers, nine data protection officers) and one focus group with five researchers. Overall, our results show a high awareness of ethical and legal responsibilities but highlight many practical and procedural issues. Based on these, we make concrete recommendations on how to improve the protection of personal data in research.
Anna-Marie Ortloff, Florin Martius
Meta-Science in Usable Security and Privacy and HCI
(2025) Meta-HCI: First Workshop on Meta-Research in HCI at CHI'25

[Bibtex]
[PDF]
[Abstract]

@inproceedings{Ortloff2025_MetaScienceUsable,
author = {Ortloff, Anna-Marie and Martius, Florin},
title = {Meta-Science in Usable Security and Privacy and HCI},
year = {2025},
booktitle = {Meta-HCI: First Workshop on Meta-Research in HCI at CHI'25},
location = {Yokohama, Japan},
numpages = {9},
keywords = {Usable security and privacy, meta-research, research methods}
}

Despite being a relatively young field, Usable Security and Privacy (USP) research has produced meta-research on methods, reporting practices, reproducibility, and evaluation. Much of this work focuses on study design and methodology, while broader research practices receive less attention. In this paper, we categorize existing meta-research in USP and examine how USP venues promote such efforts. We then present recommendations from our own meta-scientific studies on data handling, analysis, and reporting. Finally, we outline future directions to enhance the transparency, rigor, and impact of USP research.
Anna-Marie Ortloff, Christian Tiefenau & Matthew Smith
SoK: I Have the (Developer) Power! Sample Size Estimation for Fisher's Exact, Chi-Squared, McNemar's, Wilcoxon Rank-Sum, Wilcoxon Signed-Rank and t-tests in Developer-Centered Usable Security
(2023) Symposium on Usable Privacy and Security (SOUPS'23)
Distinguished Paper Award
12th Annual Best Scientific Cybersecurity Paper Competition - Honorable Mention

[Bibtex]
[PDF]
[Abstract]
[Presentation Video] [Companion website]

@inproceedings{Ortloff2023_DeveloperPower,
author = {Anna-Marie Ortloff and Christian Tiefenau and Matthew Smith},
title = {{SoK}: I Have the (Developer) Power! Sample Size Estimation for Fisher{\textquoteright}s Exact, {Chi-Squared}, {McNemar{\textquoteright}s}, Wilcoxon {Rank-Sum}, Wilcoxon {Signed-Rank} and t-tests in {Developer-Centered} Usable Security},
booktitle = {Nineteenth Symposium on Usable Privacy and Security (SOUPS 2023)},
year = {2023},
isbn = {978-1-939133-36-6},
address = {Anaheim, CA},
pages = {341--359},
url = {https://www.usenix.org/conference/soups2023/presentation/ortloff},
publisher = {USENIX Association},
}

A priori power analysis would be very beneficial for researchers in the field of developer-centered usable security since recruiting developers for studies is challenging. Power analysis allows researchers to know how many participants they need to test their null hypotheses. However, most studies in this field do not report having conducted power analysis. We conducted a meta-analysis of 54 top-tier developer study papers and found that many are indeed underpowered even to detect large effects. To aid researchers in conducting a priori power analysis in this challenging field, we conducted a systematization of knowledge to extract and condense the needed information. We extracted information from 467 tests and 413 variables and developed a data structure to systematically represent information about hypothesis tests, involved variables, and study methodology. We then systematized the information for tests with categorical independent variables with two groups, i.e., Fisher's exact, chi-squared, McNemar's, Wilcoxon rank-sum, Wilcoxon signed-rank, and paired and independent t-tests to aid researchers with power analysis for these tests. Additionally, we present overview information on the field of developer-centered usable security and list recommendations for suitable reporting practices to make statistical information for power analysis and interpretation more accessible for researchers.
Anna-Marie Ortloff, Matthias Fassl, Alexander Ponticello, Florin Martius, Anne Mertens, Katharina Krombholz & Matthew Smith
Different Researchers, Different Results? Analyzing the Influence of Researcher Experience and Data Type During Qualitative Analysis of an Interview and Survey Study on Security Advice
(2023) Conference on Human Factors in Computing Systems (CHI'23)

[Bibtex]
[PDF]
[Abstract]
[supplemental]

@inproceedings{Ortloff2023_DifferentResearchers,
author = {Ortloff, Anna-Marie and Fassl, Matthias and Ponticello, Alexander and Martius, Florin and Mertens, Anne and Krombholz, Katharina and Smith, Matthew},
title = {Different Researchers, Different Results? Analyzing the Influence of Researcher Experience and Data Type During Qualitative Analysis of an Interview and Survey Study on Security Advice},
year = {2023},
isbn = {9781450394215},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3544548.3580766},
doi = {10.1145/3544548.3580766},
abstract = {When conducting qualitative research it is necessary to decide how many researchers should be involved in coding the data: Is one enough or are more coders beneficial? To offer empirical evidence for this question, we designed a series of studies investigating qualitative coding. We replicated and extended a usable security and privacy study by Ion et al. to gather both simple survey data and complex interview data. We had a total of 65 students and seven researchers analyze different parts of this data. We analyzed the codebook creation process, similarity of outcomes, inter-rater reliability, and compared the student to the researcher outcomes. We also surveyed five years of SOUPS-PC members about their views on coding. The reviewers view on coding practices for complex and simple data are almost identical. However, our results suggest that the coding process can be different for the two types of data, with complex data benefiting more from interaction between coders.},
booktitle = {Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems},
articleno = {864},
numpages = {21},
keywords = {quality criteria, qualitative analysis, reliability},
location = {Hamburg, Germany},
series = {CHI '23}
}

When conducting qualitative research it is necessary to decide how many researchers should be involved in coding the data: Is one enough or are more coders beneficial? To offer empirical evidence for this question, we designed a series of studies investigating qualitative coding. We replicated and extended a usable security and privacy study by Ion et al. to gather both simple survey data and complex interview data. We had a total of 65 students and seven researchers analyze different parts of this data. We analyzed the codebook creation process, similarity of outcomes, inter-rater reliability, and compared the student to the researcher outcomes. We also surveyed five years of SOUPS-PC members about their views on coding. The reviewers view on coding practices for complex and simple data are almost identical. However, our results suggest that the coding process can be different for the two types of data, with complex data benefiting more from interaction between coders.
Lisa Geierhaas, Anna-Marie Ortloff, Matthew Smith & Alena Naiakshina
Let's Hash: Helping Developers with Password Security
(2022) Symposium on Usable Privacy and Security (SOUPS'22)
Distinguished Paper Award

[Bibtex]
[PDF]
[Abstract]
[Presentation Video]

@inproceedings{Geierhaas2022_LetsHash,
title = {Let{\textquoteright}s} Hash: Helping Developers with Password Security},
author = {Geierhaas, Lisa and Ortloff, Anna-Marie and Smith, Matthew and Naiakshina, Alena},
year = {2022},
isbn = {978-1-939133-30-4},
publisher = {USENIX Association},
url = {},
doi = {},
booktitle = {Eighteenth Symposium on Usable Privacy and Security (SOUPS 2022)},
pages = {503--522},
location = {Boston, USA},
series = {SOUPS '22}
}

Software developers are rarely security experts and often struggle with security-related programming tasks. The resources developers use to work on them, such as Stack-Overflow or Documentation, have a significant impact on the security of the code they produce. However, work by Acar et al. [4] has shown that these resources are often either easy to use but insecure or secure but hard to use. In a study by Naiakshina et al. [44], it was shown that developers who did not use resources to copy and paste code did not produce any secure solutions at all. This highlights how essential programming resources are for security. Inspired by the Let’s Encrypt and Certbot that support admins in configuring TLS, we created a programming aid called Let’s Hash to help developers create secure password authentication code easily. We created two versions. The first is a collection of code snippets developers can use, and the second adds a wizard interface on top that guides developers through the decisions which need to be made and creates the complete code for them. To evaluate the security and usability of Let’s Hash, we conducted a study with 179 freelance developers, asking them to solve three password programming tasks. Both versions of Let’s Hash significantly outperformed the baseline condition in which developers used their regular resources. On average, Let’s Hash users were between 5 and 32 times as likely to create secure code than those in the control condition.
Maximiliane Windl, Anna-Marie Ortloff, Valentin Schwind & Niels Henze
Privacy at a Glance: A Process to Learn Modular Privacy Icons During Web Browsing
(2022) ACM SIGIR Conference on Human Information Interaction and Retrieval. (CHIIR'22)

[Bibtex]
[PDF]
[Abstract]
[Presentation Video]

@inproceedings{Windl2022_PrivacyGlance,
title = {Privacy at a Glance: A Process to Learn Modular Privacy Icons During Web Browsing},
author = {Windl, Maximiliane and Ortloff, Anna-Marie and Henze, Niels and Schwind, Valentin},
year = {2022},
isbn = {9781450391863},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3498366.3505813},
doi = {10.1145/3498366.3505813},
booktitle = {ACM SIGIR Conference on Human Information Interaction and Retrieval},
pages = {102–112},
numpages = {11},
keywords = {privacy policy, privacy, icons, online study, web browsing, survey},
location = {Regensburg, Germany},
series = {CHIIR '22}
}

Privacy policies (PPs) are currently the only way to inform users about their rights and choices during web browsing and searching. However, users avoid engaging with them, because of their length and abstract legal language, which makes them hard to read and understand. We propose to support the understanding of PPs by using modular icons. Icons have already proven to be helpful in visualizing concepts with high information density. However, the value of using icons to supplement PPs lacks a scientific foundation. Thus, we conducted two studies to evaluate existing icon sets for their understandability and to teach participants their meaning in situ. We show that modular privacy icons can be taught using our process, which has the potential to aid quicker and easier comprehension of PPs. We contribute a set of tested modular privacy icons and a verified process on how to teach them to users incidentally during web browsing.
Anna-Marie Ortloff, Maike Vossen & Christian Tiefenau
Replicating a Study of Ransomware in Germany
(2021) European Symposium on Usable Security (EuroUSEC'21)

[Bibtex]
[PDF]
[Abstract]

@inproceedings{Ortloff2021_ReplicatingStudy,
title = {Replicating a Study of Ransomware in Germany},
author = {Ortloff, Anna-Marie and Vossen, Maike and Tiefenau, Christian},
year = {2021},
isbn = {978-1-4503-8423-0/21/10},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3481357.3481508},
doi = {10.1145/3481357.3481508},
booktitle = {European Symposium on Usable Security 2021},
numpages = {23},
location = {Karlsruhe, Germany},
series = {EuroUSEC '21}
}

Ransomware is a pertinent threat to businesses and end user data. While several attacks on enterprises are reported and give insights into the prevalence of such ransomware attacks, this prevalence in the general population is hard to estimate since they are not monitored by an official entity. A 2019 study by Simoiu et al. surveyed a representative sample of American consumers to estimate it for the US population. One year later, we aimed to replicate this effort for a representative German population (N=963) to study the spread of ransomware in a different context. Our findings suggest some differences between the two samples concerning payment methods and the participants' way of dealing with ransomware. Other aspects, like the ransom amounts and behavioral changes after an attack, were largely similar. We extend prior work by examining disagreements and uncertainty in judging whether a ransomware attack occurred for participants and researchers alike.
Anna-Marie Ortloff, Steven Zimmerman, David Elsweiler & Niels Henze
The Effect of Nudges and Boosts on Browsing Privacy in a Naturalistic Environment
(2021) Proceedings of the Conference on Human Information Interaction and Retrieval. (CHIIR'21)

[Bibtex]
[PDF]
[Abstract]
[Presentation Video]

@inproceedings{Ortloff2021_NudgeBoost,
title = {The Effect of Nudges and Boosts on Browsing Privacy in a Naturalistic Environment},
author = {Ortloff, Anna-Marie and Zimmerman, Steven and Elsweiler, David and Henze, Niels},
year = {2021},
isbn = {9781450380553},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3406522.3446014},
doi = {10.1145/3406522.3446014},
booktitle = {Proceedings of the 2021 Conference on Human Information Interaction and Retrieval},
pages = {63–73},
numpages = {11},
keywords = {privacy, web browsing, human information behavior, boosts, nudges},
location = {Canberra ACT, Australia},
series = {CHIIR '21}
}

During everyday web browsing and search users reveal many pieces of private information to third parties. Even though people report being concerned about their privacy online, they often do not take steps to protect it. This is known as the 'privacy paradox' in the literature. In this work we study two well-known strategies based on theories from the behavioral sciences, nudging and boosting, which encourage users to browse in a way that their private data are less exposed. First, an online survey (N=127) tested the comprehensibility and efficacy of various facts (boosts), before the most effective of these were evaluated against 'nudge' interventions previously shown to be efficacious in lab-studies. A three week naturalistic study (N=68) using a browser extension revealed that both nudges and boosts improve browsing privacy, as approximated by different measures. Boosts are also shown to improve user knowledge about privacy in the short term, but the benefit weakens over time.
Anna-Marie Ortloff, Maximiliane Windl, Valentin Schwind & Niels Henze
Implementation and In Situ Assessment of Contextual Privacy Policies
(2020) Proceedings of the Designing Interactive Systems Conference. (DIS'20)

[Bibtex]
[PDF]
[Abstract]

@inproceedings{Ortloff2020_CPP,
title = {Implementation and In Situ Assessment of Contextual Privacy Policies},
author = {Anna-Marie Ortloff and Maximiliane Windl and Valentin Schwind and Niels Henze},
doi = {10.1145/3357236.3395549},
isbn = {9781450369749},
year = {2020},
date = {2020-07-06},
booktitle = {Proceedings of the 2020 Designing Interactive Systems Conference},
numpages = {14},
publisher = {Association for Computing Machinery},
address = {Eindhoven, Netherlands},
series = {DIS ’20}
}

Online services collect an increasing amount of data about their users. Privacy policies are currently the only common way to inform users about the kinds of data collected, stored and processed by online services. Previous work showed that users do not read and understand privacy policies, due to their length, difficult language, and often non-prominent location. Embedding privacy-relevant information directly in the context of use could help users understand the privacy implications of using online services. We implemented Contextual Privacy Policies (CPPs) as a browser extension and provide it to the community to make privacy information accessible for end-users. We evaluated CPPs through a one-week deployment and in situ questionnaires as well as pre- and post-study interviews. We found that CPPs were well received by participants. The analysis revealed that provided information should be as compact as possible, be adjusted to user groups and enable users to take action.
Anna-Marie Ortloff, Maximiliane Windl, Lydia Güntner & Thomas Schmidt
Towards a Graphical User Interface for Quantitative Analysis in Digital Musicology
(2019) Mensch und Computer, workshop paper (MuC '19)

[Bibtex]
[PDF]
[Abstract]

@inproceedings{Ortloff2019_BeyondTheNotes,
author = {Ortloff, Anna-Marie and Windl, Maximiliane and Güntner, Lydia and Schmidt, Thomas},
title = {Towards a Graphical User Interface for Quantitative Analysis in Digital Musicology},
booktitle = {Mensch und Computer 2019 - Workshopband},
year = {2019},
editor = {Alt, Florian and Bulling, Andreas and Döring, Tanja},
doi = {10.18420/muc2019-ws-568},
publisher = {Gesellschaft für Informatik e.V.},
address = {Bonn}
}

We introduce the first prototype of a web application for digital musicology: BeyondTheNotes (working title). The goal of the tool is to support the in-depth analysis of individual pieces of music as well as the large scale analysis and comparison of summative features of multiple pieces of music. In contrast to existing tools, BeyondTheNotes is ready to use without installation, enables the upload and analysis of own material and offers different visualizations of musical metrics like chords, pitches, durations and key. We design the tool according to the User Centered Design Approach to improve the usability and address the specific needs of musicologists. We describe the results of the requirement analysis and discuss future steps.
Anna-Marie Ortloff, Lydia Güntner, Maximiliane Windl, Thomas Schmidt, Martin Kocur & Christian Wolff
SentiBooks: Enhancing audiobooks via affective computing and smart light bulbs
(2019) Proceedings of Mensch und Computer (MuC '19)

[Bibtex]
[PDF]
[Abstract]

@inproceedings{Ortloff2019_Sentibooks,
author = {Ortloff, Anna-Marie and Güntner, Lydia and Windl, Maximiliane and Schmidt, Thomas and Kocur, Martin and Wolff, Christian},
title = {SentiBooks: Enhancing Audiobooks via Affective Computing and Smart Light Bulbs},
booktitle = {Mensch und Computer 2019 - Tagungsband},
year = {2019},
editor = {Alt, Florian and Bulling, Andreas and Döring, Tanja},
doi = { 10.1145/3340764.3345368 },
publisher = {ACM},
address = {New York}
}

We present SentiBooks, a smartphone application to enhance the audiobook listening experience via affective computing and smart light bulbs. Users can connect to Philips Hue Light Bulbs with a smartphone app while listening to an audiobook. The app analyzes the emotional expression of the narrator of the audiobook using speech emotion recognition and adjusts the colors of the lighting settings according to the expression of the narrator in 10-seconds intervals. By transitioning between colors that are connected to the specific emotion that is currently dominant in the reading, the overall audiobook experience is intensified.
Anna-Marie Ortloff, Lydia Güntner, Maximiliane Windl, Denis Feth & Svenja Polst
Evaluation kontextueller Datenschutzerklärungen
(2018) Mensch und Computer, workshop paper (MuC '18)

[Bibtex]
[PDF]
[Abstract]

@inproceedings{Ortloff2018_CPP,
author = {Ortloff, Anna-Marie and Güntner, Lydia and Windl, Maximiliane and Feth, Denis and Polst, Svenja},
title = {Evaluation kontextueller Datenschutzerklärungen},
booktitle = {Mensch und Computer 2018 - Workshopband},
year = {2018},
editor = {Dachselt, Raimund and Weber, Gerhard},
doi = {10.18420/muc2018-ws08-0541},
publisher = {Gesellschaft für Informatik e.V.},
address = {Bonn}
}

Datenschutzerklärungen sind häufig schwer zu finden und zu verstehen. Daher lesen viele Nutzer sie nur teilweise oder gar nicht. Kontextuelle Datenschutzerklärungen verfolgen einen alternativen Ansatz. Hier werden Datenschutzinformationen für den Nutzungskontext maßgeschneidert und nur die jeweils relevanten Informationen angezeigt. In dieser Arbeit wurde in einer Nutzerstudie untersucht, ob Nutzer diesen Ansatz akzeptieren und ob sie ein besseres, gefühltes Verständnis bezüglich der Datenschutzinformationen haben. Es zeigte sich, dass kontextuelle Datenschutzerklärungen durchweg positiv aufgenommen werden und gegenüber der klassischen Darstellung im Fließtext präferiert werden.

[English translation] Privacy policies are often both hard to find and hard to understand, and because of this, many users read them only partially, or not at all. Contextual privacy policies are a different approach, whereby privacy statements are tailored to the current context of use. Only the respective relevant information is displayed. In this work, a user study was employed to test if users accept this approach, and if they reach a better perceived understanding of privacy policies through it. We could show that contextual privacy policies were received positively, and preferred over the common long textual form of presentation.

Academic Service

PC:

SCP 2026, EuroUSEC 2024 + 2025, MuC - Usable Security and Privacy Workshop 2023 - 2026
Reviewing:

CHI'22 - CHI'26, MuC'25, Information & Computer Security, ACM Transactions on Privacy and Security
Conference Team:

COSIT'19 (local Assistant), CHIIR'27 (demos, resources and designs)
Student Volunteer:

MuC'18, MuC'17

Teaching

Summer 2023 - 2025

Exercise for Usable Security and Privacy
Summer 2022

Exercise for Usable Security and Privacy (Hybrid)
Summer 2021

Exercise for Usable Security and Privacy (Online)
Summer 2020

Teaching assistant for Survey and Experiment Design (Online)
Winter 2019/20

Teaching assistant for Efficient Data Processing and Storage
Summer 2019 & 2018

Teaching assistant for Survey and Experiment Design
Winter 2017/18

Teaching assistant for User Centered Design and Human Information Behavior
Winter 2016/17

Tutor for Introduction to Computer Science and Media Informatics