Ehsan Toreini

The digitalisation of the reproductive body has engaged myriads of cutting-edge technologies to support people in understanding and managing their intimate health. Generally understood as female technologies (FemTech), these products and systems collect a wide range of intimate data, predominantly related to sexual and reproductive health. This sensitive data is then processed, transferred, saved, and shared with other parties. The data-hungry nature of this industry and the lack of proper safeguarding mechanisms, standards, and regulations for this vulnerable data can lead to complex harms or diminished user agency. In this article, we adopted mixed methods, including an online survey and a Story Completion Method (SCM), to explore user understanding of the security and privacy (SP) of these technologies. We conducted online user studies in two countries: the UK and Iran, in English and Farsi (Persian), respectively. We recruited 102 UK and 130 Iranian participants for our surveys, and 17 UK and 34 Iranian participants for our SCM studies. Our findings show that while users can speculate on the range of harms and risks associated with these technologies, they are not necessarily presented and equipped with the technical skills to protect themselves. We identified a larger gap in the Iranian group compared to the UK group, which can be attributed to factors such as differences in data protection regulations between the two countries. This comparative study highlights how disparate data protection frameworks and unique cultural contexts can shape user vulnerability to FemTech risks. We discuss how participatory threat modelling and Security and Privacy by Design are critical to protecting users in these sensitive systems.

Browser extensions are commonly used to improve the browsing experience and accessibility. However, installing extensions naturally increases the user’s risk. This work presents AXECC , a novel framework for measuring the impact of web tracking and accessibility. The AXECC framework includes static, dynamic, and accessibility analyses across multiple web pages. We utilise the AXECC framework to analyse the web tracking and accessibility impact in the wild on 21k real-world extensions collected from the Chrome Web Store. In our analysis, we identify that 15.97% of extensions (with more than 600M users) perform a type of third–party tracking in the first 60 seconds after loading. These results are highly correlated with the extension category and are consistent across different web pages. Furthermore, we find that a small number of extensions (with 65M users) alter the accessibility of a web page when browsing, and these alterations are often complex and involve more tracking. Our work reveals a significant privacy risk from web tracking within popular browser extensions, often intertwined with complex accessibility alterations.

Rapidly changing social norms and national, legal, and political conditions socially constrain people from discussing sensitive topics such as sexuality or religion. Such constrained, vulnerable minorities are often worried about inadvertent information disclosure and may be unsure about the extent to which their communications are being monitored in public or semi-public spaces like workplaces or cafes. Personal devices extend trust to the digital domain, making it desirable to have strictly private communication between trusted devices. Currently, messaging services like WhatsApp provide alternative means for exchanging sensitive private information, while personal safety apps such as Noonlight enable private signaling. However, these rely on third-party mechanisms for secure and private communication, which may not be accessible for justifiable reasons, such as insecure internet access or companion device connections. In these cases, it is challenging to achieve communication that is strictly private between two devices instead of user accounts without any dependency on third-party infrastructure. The goal of this paper is to support private communications by setting up a shared secret between two or more devices without sending any data on the network. We develop a method to create a shared secret between phones by shaking them together. Each device extracts the shared randomness from the shake, then conditions the randomness to 7.798 bits per byte of key material. This paper proposes three different applications of this generated shared secret: message obfuscation, trust delegation, and encrypted beacons. We have implemented the message obfuscation on Android as an independent app that can be used for private communication with trusted contacts. We also present research on the usability, design considerations, and further integration of these tools in mainstream services.

The number of digital health products is increasing faster than ever. These technologies (e.g. mobile apps and connected devices) collect massive amounts of data about their users, including health, medical, sex life, and other intimate data. In this paper, we study a set of 21 Internet of Things (IoT) devices advertised for general and intimate health purposes of female bodies (aka female-oriented technologies or FemTech). We focus on the security of the Bluetooth connection and communications between the IoT device and the mobile app. Our results highlight serious security issues in the current off-the-shelf FemTech devices. These include unencrypted Bluetooth traffic, unknown Bluetooth services and insecure Bluetooth authentication when connecting to the app. We implement Bluetooth attacks on the communication between these devices and apps, resulting in malfunctioning of the device and app. We discuss our results and provide recommendations for different stakeholders to improve the security practices of Bluetooth-enabled IoT devices in such a sensitive and intimate domain.

This article investigates the accessibility of cookie notices on websites for users with visual impairments (VI) via a set of system studies on top UK websites ( n =46) and a user study ( n =100). We use a set of methods and tools—including accessibility testing tools, text-only browsers, and screen readers—to perform our system studies. Our results demonstrate that the majority of cookie notices on these websites have some form of accessibility issue, including contrast issues, not having headings, and not being read aloud immediately when the page is loaded. We discuss how such practices impact the user experience and privacy and provide a set of recommendations for multiple stakeholders for more accessible websites and better privacy practices for users with VIs. To complement our technical contribution, we conduct a user study, finding that people with VIs generally have a negative view of cookie notices and believe our recommendations could help their online experience.

With recent developments in deep learning, the ubiquity of micro-phones and the rise in online services via personal devices, acoustic side channel attacks present a greater threat to keyboards than ever. This paper presents a practical implementation of a state-of-the-art deep learning model in order to classify laptop keystrokes, using a smartphone integrated microphone. When trained on keystrokes recorded by a nearby phone, the classifier achieved an accuracy of 95%, the highest accuracy seen without the use of a language model. When trained on keystrokes recorded using the video-conferencing software Zoom, an accuracy of 93% was achieved, a new best for the medium. Our results prove the practicality of these side channel attacks via off-the-shelf equipment and algorithms. We discuss a series of mitigation methods to protect users against these series of attacks.

The digitalisation of the reproductive body has seen a myriad of cutting-edge technologies to prioritise neglected intimate health and care topics, such as fertility and contraception. The impact of these intimate data on livelihood and society is pervasive including that privacy is critical to safeguarding security as this increasing digitalisation also produces increasingly large datasets. In this paper, we enquire the collective nature of privacy in female-oriented technologies (FemTech) to show how this ever-extending collection of data implicates many beyond the individual. We introduce a pilot study on the data collection practices of a subset of FemTech devices with fertility tracking service. We demonstrate that data is collected about the user and others, such as their immediate relationships and user groups as a whole. We suggest that it is critical we ask who is vulnerable and discuss approaches to mitigate collective harm.