Maryam Mehrnezhad

Cybersecurity, safety, and privacy research on menopause technologies is sparse. In this work, we employ the story completion method (SCM) and collect data from 51 UK participants across four stories on (mis)information on social media, app data sharing and monetisation, social taboo and workplace digital resources, and Hormone Replacement Therapy (HRT) wearable devices and trust. Our analysis reveals that while menopause is a challenging, personal, and contextual experience, many people use technology to support their journey. Our results show that technology is being used to help reduce taboos around menopause by enabling access to information, allowing experiences to be shared, and communities of support to be formed. The appetite for data sharing is conditional, and users expect privacy-preserving methods to be embedded within the tech they use. These findings demonstrate that privacy perceptions in intimate health technologies are shaped and influenced by socio-cultural elements such as stigma, relational risks, and social context rather than by purely technical threat models.

The digitalisation of the reproductive body has engaged myriads of cutting-edge technologies to support people in understanding and managing their intimate health. Generally understood as female technologies (FemTech), these products and systems collect a wide range of intimate data, predominantly related to sexual and reproductive health. This sensitive data is then processed, transferred, saved, and shared with other parties. The data-hungry nature of this industry and the lack of proper safeguarding mechanisms, standards, and regulations for this vulnerable data can lead to complex harms or diminished user agency. In this article, we adopted mixed methods, including an online survey and a Story Completion Method (SCM), to explore user understanding of the security and privacy (SP) of these technologies. We conducted online user studies in two countries: the UK and Iran, in English and Farsi (Persian), respectively. We recruited 102 UK and 130 Iranian participants for our surveys, and 17 UK and 34 Iranian participants for our SCM studies. Our findings show that while users can speculate on the range of harms and risks associated with these technologies, they are not necessarily presented and equipped with the technical skills to protect themselves. We identified a larger gap in the Iranian group compared to the UK group, which can be attributed to factors such as differences in data protection regulations between the two countries. This comparative study highlights how disparate data protection frameworks and unique cultural contexts can shape user vulnerability to FemTech risks. We discuss how participatory threat modelling and Security and Privacy by Design are critical to protecting users in these sensitive systems.

Browser extensions are commonly used to improve the browsing experience and accessibility. However, installing extensions naturally increases the user’s risk. This work presents AXECC , a novel framework for measuring the impact of web tracking and accessibility. The AXECC framework includes static, dynamic, and accessibility analyses across multiple web pages. We utilise the AXECC framework to analyse the web tracking and accessibility impact in the wild on 21k real-world extensions collected from the Chrome Web Store. In our analysis, we identify that 15.97% of extensions (with more than 600M users) perform a type of third–party tracking in the first 60 seconds after loading. These results are highly correlated with the extension category and are consistent across different web pages. Furthermore, we find that a small number of extensions (with 65M users) alter the accessibility of a web page when browsing, and these alterations are often complex and involve more tracking. Our work reveals a significant privacy risk from web tracking within popular browser extensions, often intertwined with complex accessibility alterations.

Menopause affects half of the world’s population directly and everyone indirectly. As the world’s population is ageing, more healthcare services are becoming digitised. People experiencing menopause seek online and digital help for various reasons. Menopause education, awareness, and research—including the usage and risks of menopause tech and data, are limited. In this work, we designed and conducted a large-scale online survey with 310 United Kingdom (UK) participants to investigate the experiences of women with menopause, the use of technology, and security and privacy perceptions and expectations regarding their data. We identify several factors influencing the use of menopause tech, including perceived benefits, community support, workplace, and healthcare. Users express concerns about misinformation and current data sharing practices associated with these technologies. Conditional consent for data access and sharing is prevalent, depending on the recipient and user control options. This research provides crucial empirical data and analysis on menopause tech use, security, and privacy while identifying user concerns and informing secure user-centric design and policy.

Online hate speech can harmfully impact individuals and groups, specifically on non-moderated platforms such as 4chan where users can post anonymous content. This work focuses on analysing and measuring the prevalence of online hate on 4chan’s politically incorrect board (/pol/) using state-of-the-art Natural Language Processing (NLP) models, specifically transformer-based models such as RoBERTa and Detoxify. By leveraging these advanced models, we provide an in-depth analysis of hate speech dynamics and quantify the extent of online hate non-moderated platforms. The study advances understanding through multi-class classification of hate speech (racism, sexism, religion, etc.), while also incorporating the classification of toxic content (e.g., identity attacks and threats) and a further topic modelling analysis. The results show that 11.20% of this dataset is identified as containing hate in different categories. These evaluations show that online hate is manifested in various forms, confirming the complicated and volatile nature of detection in the wild.

We show that perceptual hashing, crucial for detecting and removing image-based sexual abuse (IBSA) online, faces vulnerabilities from low-budget inversion attacks based on generative AI. This jeopardizes the privacy of users, especially vulnerable groups. We advocate to implement secure hash matching in IBSA removal tools to mitigate potentially fatal consequences.

The number of digital health products is increasing faster than ever. These technologies (e.g. mobile apps and connected devices) collect massive amounts of data about their users, including health, medical, sex life, and other intimate data. In this paper, we study a set of 21 Internet of Things (IoT) devices advertised for general and intimate health purposes of female bodies (aka female-oriented technologies or FemTech). We focus on the security of the Bluetooth connection and communications between the IoT device and the mobile app. Our results highlight serious security issues in the current off-the-shelf FemTech devices. These include unencrypted Bluetooth traffic, unknown Bluetooth services and insecure Bluetooth authentication when connecting to the app. We implement Bluetooth attacks on the communication between these devices and apps, resulting in malfunctioning of the device and app. We discuss our results and provide recommendations for different stakeholders to improve the security practices of Bluetooth-enabled IoT devices in such a sensitive and intimate domain.

The security, privacy, and safety issues around Female-oriented technologies (FemTech) and data can lead to differential harms. These complex risks and harms are enabled by many factors including inadequate regulations, the non-compliant practices of the industry, and the lack of research and guidelines for cyber-secure, privacy-preserving, and safe products. In this paper, we review the existing regulations related to FemTech in the United Kingdom, EU, and Switzerland and identify the gaps. We run experiments on a range of FemTech devices and apps and identify several exploitative practices. We advocate for the policymakers to explicitly acknowledge and accommodate the risks of these technologies in the relevant regulations.

This article investigates the accessibility of cookie notices on websites for users with visual impairments (VI) via a set of system studies on top UK websites ( n =46) and a user study ( n =100). We use a set of methods and tools—including accessibility testing tools, text-only browsers, and screen readers—to perform our system studies. Our results demonstrate that the majority of cookie notices on these websites have some form of accessibility issue, including contrast issues, not having headings, and not being read aloud immediately when the page is loaded. We discuss how such practices impact the user experience and privacy and provide a set of recommendations for multiple stakeholders for more accessible websites and better privacy practices for users with VIs. To complement our technical contribution, we conduct a user study, finding that people with VIs generally have a negative view of cookie notices and believe our recommendations could help their online experience.