SECUSO is welcoming two visiting researchers this month: Judith Kankam Boateng, PhD student at the University of Southern Denmark (SDU), is visiting us as part of a three-week guest stay. Judith is conducting research on mental models, misalignments, and implementation gaps in the context of cybersecurity measures in Danish SMEs. Furthermore, Yorick Last from the University of Paderborn visited our group and presented his research on digital identity wallets. Both also gave a presentation at the SECUSO Research Seminar.

The paper "The (Un)suitability of Passwords and Password Managers in Virtual Reality" by Emiram Kablo, Yorick Last, Patricia Arias Cabarcos, and Melanie Volkamer was accepted for presentation at the Conference on Sociotechnical Cybersecurity and Privacy (SCP 2026). The paper first examines the experiences, preferences, and expectations of 126 VR users regarding authentication in virtual reality through a user study. The study revealed a clear preference for simple passwords, as well as interest in biometric methods and password managers. The paper then conducts the first comprehensive evaluation of existing password managers in VR based on 91 cognitive walkthroughs and expert reviews. The results show that while password managers improve usability, important features such as cross-app autofill are still missing. Building on this, the paper formulates recommendations for more secure and user-friendly VR authentication. In a Google search for “Password Managers in VR,” the preprint currently ranks first. SCP will take place September 2nd and 3rd, 2026 in Belval, Luxembourg.

The second Cyren Summer School will take place in Zurich from June 29 to July 3. Hanna Algedri from SECUSO will be there this year! Focusing on “Human Factors in Cybersecurity and Privacy: Interdisciplinary Research Methods,” participants will delve into interdisciplinary research methods as well as transdisciplinary topics such as communication skills, ethical considerations, and collaboration with industry. In addition, the group will take a field trip to the armasuisse Cyber Defense Campus. The program offers ample opportunity for networking and getting to know other researchers in the field of usable security. We look forward to exciting insights and new connections!

The paper "Hook & Match - Development and Evaluation of a Pair Matching Phishing Card Game" by Benjamin Maximilian Berens, Sebastian Pape, and Melanie Volkamer was accepted for publication in the journal ACM Transactions on Privacy and Security (TOPS). The article describes and evaluates the card game “Hook & Match,” which was developed to improve phishing detection. The analog pair-matching card game effectively enhances phishing detection skills without exacerbating digital fatigue. Empirical evaluation demonstrates significant learning gains for all participants, with the most pronounced improvements observed among novices who initially lack awareness.