# Evoking Comprehensive Mental Models of Anonymous Credentials

Erik Wästlund, Julio Angulo, Simone Fischer-Hübner

► To cite this version:

Erik Wästlund, Julio Angulo, Simone Fischer-Hübner. Evoking Comprehensive Mental Models of Anonymous Credentials. International Workshop on Open Problems in Network Security (iNetSec), Jun 2011, Lucerne, Switzerland. pp.1-14, 10.1007/978-3-642-27585-2_1. hal-01481502

HAL Id: hal-01481502

https://inria.hal.science/hal-01481502

Submitted on 2 Mar 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Evoking Comprehensive Mental Models of Anonymous Credentials

Erik Wästlund, Julio Angulo, and Simone Fischer-Hübner

Karlstad University,
Universitetsgatan 2, 651 88 Karlstad, Sweden
{erik.wastlund,julio.angulo,simone.fischer-huebner}@kau.se
http://www.kau.se

**Abstract.** Anonymous credentials are a fundamental technology for preserving end users' privacy by enforcing data minimization for online applications. However, the design of user-friendly interfaces that convey their privacy benefits to users is still a major challenge. Users are still unfamiliar with the new and rather complex concept of anonymous credentials, since no obvious real-world analogies exists that can help them create the correct mental models. In this paper we explore different ways in which suitable mental models of the data minimization property of anonymous credentials can be evoked on end users. To achieve this, we investigate three different approaches in the context of an e-shopping scenario: a *card-based* approach, an *attribute-based* approach and an *adapted card-based* approach. Results show that the adapted card-based approach is a good approach towards evoking the right mental models for anonymous credential applications. However, better design paradigms are still needed to make users understand that attributes can be used to satisfy conditions without revealing the value of the attributes themselves.

**Keywords:** Credential Selection, Anonymous Credentials, Mental Models, Usability

## 1 Introduction

Data minimization is a fundamental privacy principle which requires that applications and services should use only the minimal amount of personal data necessary to carry out an online transaction. A key technology for enforcing the principle of data minimization for online applications are *anonymous credentials* [1], [2], [5]. In contrast to traditional electronic credentials, which require the disclosure of all attributes of the credential to a service provider when performing an online transaction, anonymous credentials let users reveal any possible subset of attributes of the credential, characteristics of these attributes, or prove possession of the credential without revealing the credential itself, thus providing users with the right of anonymity and the protection of their privacy.

Even though Microsoft's U-Prove and IBM's Idemix anonymous credential technologies are currently introduced into commercial and open source systems
and products, the design of easily understandable interfaces for introducing these concepts to end users is a major challenge, since end users are not yet familiar with this rather new and complex technology and no obvious real-world analogies exist. Besides, users have grown accustomed to believe that their identity cannot remain anonymous when acting online and have learned from experience or word of mouth that unwanted consequences can come from distributing their information to some services providers on the Internet.

In other words, people do not yet possess the right *mental models* regarding how anonymous credentials work and how anonymous credentials can be used to, for example, protect their personal information.

In order to tackle the challenge of designing interfaces that convey the principle of data minimization with the use of anonymous credentials, we have, within the scope of the EU FP7 project PrimeLife<fnref n="1" /> and the Swedish U-PrIM project<fnref n="2" />, investigated the way mental models of average users work with regards to anonymous credentials and have tried to evoke their correct mental models with various experiments [10].

In this article, we first provide background information on the concepts of anonymous credentials and mental models and then present previous related work. Then, we describe the experiments that were carried out using three different approaches, and present the analyses and interpretations of the collected data. Finally, we provide conclusions in the last section.

## 2 Background

In this section we present a description of the concept of anonymous credentials and the definition of mental models.

### 2.1 Anonymous Credentials

A traditional credential (also called a certificate or attribute certificate) is a set of personal identifiable attributes which is signed by a certifying trust party and is bound to its owner by cryptographic means (e.g., by requiring the owner's secret key to use the credential). With a credential system, users can obtain a credential from the certifying party and demonstrate possession of these credentials at the moment of carrying out online transactions. In terms of privacy, the use of (traditional or anonymous) credentials is better than the direct request to the certifying party, as this prevents the certifying party from profiling the user. When using traditional credentials, all of the attributes contained in the credential are disclosed to the service provider when proving certain properties during

<footnote n="1">¹ EU FP7 integrated project PrimeLife (Privacy and Identity Management for Life), http://www.primelife.eu/</footnote>

<footnote n="2">² U-PrIM (Usable Privacy-enhancing Identity Management for smart applications) is funded by the Swedish Knowledge Foundation, KK-Styftelsen, http://www.kau.se/en/computer-science/research/research-projects/u-prim</footnote>
online transactions. This contradicts the privacy principle of data minimization and can also lead to unwanted user profiling by the service provider.

Anonymous credentials (also called private certificates) were first introduced by Chaum [5] and later enhanced by Brands [1] and Camenisch & Lysyanskaya [2] and have stronger privacy properties than traditional credentials. Anonymous credentials implement the property of data minimization by allowing users to select a subset of the attributes of the credential or to prove the possession of a credential with specific properties without revealing the credential itself or any other additional information. For instance, a user who has a governmentally issued anonymous passport credential (with attributes that are typically stored in a passport, such as the date of birth) can prove either the fact that she is older than 18 without revealing her actual age, her date of birth or any other attribute of the credential, such as her name or personal identification number. In other words, anonymous credentials allow the selective disclosure of identity information encoded into the credential. However, also information about the certifier is revealed (if the user uses for instance a governmentally issued credential, information about the government of the user (i.e. his nationality) is also revealed as meta-information) - illustrating the disclosure of this type of meta-information to end users poses further HCI challenges.

In addition, the Idemix anonymous credential system has also the property that multiple uses of the same credential cannot be linked to each other. If, for instance, the user later wants to shop another video which is only permitted for adults at the same video online shop, she can use the same anonymous credential as proof that she is over 18 without the video shop being able to recognize that the two proofs are based on the same credential. This means that the two rental transactions cannot be linked to the same person. The main focus of our usability studies, which we present in this paper, has so far been on the comprehension of the selective data disclosure property.

## 2.2 Mental Models

Mental models are people's perceptions or understandings on how a system works. A mental model provides a deep understanding of people's motivations and thought processes [6], [7], [12]. One of the major obstacles when introducing new technology to the general public is presenting the technology in terms that the average user will comprehend without having to resort to the advice of an expert or complicated instruction manuals. For the users to adapt novel technologies, they have to comprehend their advantages, disadvantages, and the benefits that the technology can bring into their daily lives. The introduction of incremental innovations is often framed in the terms of previously existing systems or objects that users are already familiar with. For example, people can generate a mental picture of how fast, functional, aesthetic, and effective the new system is in comparison with its predecessors. Then, they are able to adjust their already existing mental models accordingly, without great effort. However, when it comes to radical changes or completely new innovations the adaptation of the mental model is not always an easy task. It is therefore that designing
interfaces that support the relatively new anonymous credential technology is
an excruciating challenge for user interface (UI) designers.

In this work, we explore different user interface approaches based on three dif-
ferent metaphors (*card-based*, *attribute-based* and *adapted card-base* approaches)
that we have developed in order to get users to start thinking in the right di-
rection when it comes to anonymous credentials and their private information
on the Internet. In other words, our aim is to investigate which of these ap-
proaches works better at evoking a comprehensive mental model of anonymous
credentials.

3 Related work

Within the scope of the PRIME<fnref n="3" /> project, our usability tests of PRIME pro-
totypes revealed that users often did not trust privacy-enhancing technologies
and their data minimization properties, as the possibility to use Internet services
anonymously did not fit to their mental model of Internet technology [3], [9]. Ca-
menisch et al. [4] discuss contextual, browser-integrated user interfaces for using
anonymous credential systems. In user tests of anonymous credential selection
mockups developed within the PRIME project, test subjects were asked to ex-
plain what information was actually given to a web site that demanded some
proof of age when a passport was used to produce that proof (more precisely,
the phrase *Proof of ‘age > 18’* [built on ‘*Swedish Passport*’] was
used as a menu selection choice in the mockup). The test results showed that the
test participants assumed that all data normally visible in the physical item re-
ferred to (i.e., a passport) was also disclosed to the web site [8]. Hence, previous
HCI studies in the PRIME project showed already that designing user interfaces
supporting the comprehension of anonymous credentials and their selective dis-
closure property is a challenging task. As far as we are aware of, no many other
studies have considered the usability of anonymous credentials, neither the way
people perceive this relatively new technology.

More than a decade ago, Whitten & Tygar [11] discussed the related problem
that the standard model of user interface design is not sufficient to make com-
puter security usable to people who are not already knowledgeable in that area.
They conclude that a valid conceptual model of security has to be established
and must be quickly and effectively communicated to the user.

4 Methodology

As part of the PrimeLife project, we have conducted a series of experiments
based on interactive mockups for an e-shopping scenario that used anonymous
credentials technology for proving that the user holds a credit card and an-
other credential (passport or driving license) with the same name. During the

<footnote n="3">³ PRIME (Privacy and Identity Management for Europe) https://www.prime-project.eu/</footnote>
experiments we used three different approaches to evoke different mental mod-
els of anonymous credentials and observed which of these would best fit the
representation of an actual anonymous credentials system. The different UIs
were then tested at various instances with individuals coming from different age
groups, backgrounds, and genders. Many of them were employees or students
from diverse disciplines at Karlstad University (KAU) and many others were re-
cruited at various locations, such as Karlstad's train station. The methodologies,
test designs, and results from the first two approaches, i.e. the card-based and
attribute-base approaches, have been reported in more detailed by Wästlund &
Fischer-Hübner [10]. We present an overview of the results of those two previous
approaches here. Then, we introduce the third concept of an adapted card-based
approach, the description of its interface and the results from testing.

4.1 The card-based approach

<figure><img src="image_2.png" /><figcaption>Fig. 1. Cutting out attributes to be revealed as part of a newly created virtual card.</figcaption></figure>

The first design concept was based on the idea that people are already ac-
quainted with the way cards work in the non-digital world. A person can usually
pay for a product at a store with a credit card and use an identification card to
verify their identity, such as their driving license or password. For that reason, a
card-based metaphor was used, in which test participants were introduced to the
concept of electronic credentials as being images of the ordinary “cards” they
are already familiar with. However, in the non-digital cards do not possess the
property of data minimization, thus the challenge lied on how to convey the idea
of selective disclosure to users through an interface.

A number of mockup iterations were implemented using this metaphor in
order to test the different levels of understanding on the concept of anonymous
credentials. In the initial iterations, the property of data minimization was illustrated with an animation that “cut out” selected attributes from the card and transitioned them into a newly created *virtual card*, which was to be revealed to a service provider (Figure 1). The idea was to make users visually aware of the pieces of information that were being cut out and moved into the new virtual card, making it clearer that only the information on the virtual card was being sent to the service provider. In later iterations the attributes of the card which were not to be disclosed to the service provider were blacked out, leaving only the card attributes to be sent visible to the user (Figure 2).

<figure><img src="image_3.png" /><figcaption>Fig. 2. Card-based approach blacking out non-disclosed attributes.</figcaption></figure>

In total, a number of seventh design iterations were carried out with slight improvements at every iteration cycle and testing the alternatives with five test participants at a time. Results showed that using this approach, 86% of test participants (30 out of 35) believed that the anonymous credentials would work in the same fashion as the commonly used non-digital plastic credentials. In other words, they thought that more information from the source card (passport or driving license) was sent to the service provider than it really was sent. Only 14% participants understood up to a point the principle of data minimization, indicating that using a card-based metaphor is not an ideal approach to show this concept.
## 4.2 The attribute-based approach

The second design concept was based on what we called the attribute-based approach (Figure 3), in which test participants were told that “attributes” of information were imported from different certifying authorities. Participants could select the authorities that certified certain attributes, and thereby choosing the attributes they would like to reveal to the service provider. After they had selected the attributes they were asked to confirm their decision at a second step, before the information was sent.

<figure><img src="image_4.png" /><figcaption>Fig. 3. One example of the attribute-based approach.</figcaption></figure>

A total of sixth iterations were made using this attribute-based approach with an average of 8.5 participants per iteration. This time only 33% of the test participants (16 out of 48) did not understand the data minimization property and thought that more information than the one needed was disclosed to the service provider. However, 67% understood the selective disclosure principle, showing an improvement over the card-based approach. Curiously enough, with the attribute-based approach, some of the test participants made the error of thinking that their personal identification number and address would be disclosed as well, even though these attributes were not part of the e-shopping scenario.

Moreover, post-test interviews also revealed that, some of the participants who used the attribute-based UI with the instructions to select a verifying authority believed that their data was being sent via the verifier who would then be able to trace all transactions they made. Hence, those participants got the wrong impression that the verifier (e.g., the police or the Swedish road authorities) could trace their online activities. An interesting finding in this approach regarded the use of the Swedish personal number. As this number is widely used
in Sweden, users anticipated that this number should be present in the transaction portray in the scenario, despite the fact that it was neither asked for nor shown anywhere in the interface.

## 4.3 The adapted card-based approach

Our latest design concept is basically a hybrid version of the two previous approaches. The idea was to keep the notion of cards and card selection, since people already accept and comprehend that metaphor, but at the same time emphasizing the data minimization properties of the application. In order to accomplish this, the third approach was based on the idea of an adapted card-based metaphor, in which users were made aware of the fact that the information in their source cards would be adapted to fit the needs of the current online transaction (Figure 4). The idea was to show only the selected information inside the newly created adapted card, and to convey the notion that only the information in this card was sent to the service provider and nothing else.

<figure><img src="image_5.png" /><figcaption>Fig. 4. The adapted card-based approach.</figcaption></figure>

**Test design.** In order to test this approach, one more interactive mockup was created. The setup for this round of testing was made as consistent as possible to the setup for testing the two previous approaches, using the same e-shopping scenario and the same method for inputting answer to their questions (i.e., participants could freely write their beliefs about what information about them was being sent). This time we tested the users’ understanding that a service provider does not need to know the exact value of an attribute in the credential, for example the exact age of the user, but instead the service provider would only need
to know if an attribute satisfies a certain condition, for instance, that the user
is over 18 years old.

During a test session participants were first asked to read a description of
the test, which was written to fit the purposes of this metaphor and to introduce
participants to the notion of selective disclosure. The test description read as
follows:

> You are going to test an Adaptable Electronic ID System - a new way of paying on the Internet. This new way is based on the idea that you have installed this security and privacy system in your computer that only you have access to. The system lets you buy online in a secure and privacy-friendly way - no one else than you can use your information.

> The system allows you to import all types of electronic IDs and use them online, such as your driving license and passport, and other personal information, such as your credit cards. The unique feature of this system is that it adapts your IDs to the current online payment situation and makes sure to send only the information that is necessary for this transaction.

> During this test, you will pretend that your name is Inga Vainstein and that you use this Adaptable Electronic ID System to be able to shop safely and privately on the Internet. You will buy and download an e-book (audio-book) from Amazon.com which is only available for adults over 18 years old, and you will pay it with your new Adaptable Electronic ID System.

In order to create a realistic e-shopping experience, participants were then presented with an interactive Flash animation resembling a Firefox browser window showing the Amazon.com website. Participants were asked to carry out the task of buying an e-book using the presented animation, as instructed in the test description. At the moment of paying for the book, the Amazon.com website was dimmed in the background and the credential selection user interface popped-up. Using this interface, shown in Figure 4, participants were asked to select a payment method, either Visa or American Express, and a way to verify their name and the fact that they were over 18 by choosing either their driving license or their passport.

<figure><img src="image_6.png" /><figcaption>**Fig. 5.** Examples of *mouse-over* states when selecting one of the credentials.</figcaption></figure>
A mouse-over state was added to each of the credentials, so that if partici-
pants would drag the mouse over a credential, they could get a preview of the
information they were about to select, as shown in Figure 5. Once a creden-
tial (or “card”) was selected, a green frame was place around it to indicate the
selection.

When a credential was selected, the adapted information from that credential
was also faded in with a smooth transition into the card in the middle with
the title “Adapted card for this purchase only” (Figure 6). For example, if the
participant chose a driving license a method for identification, the attribute
Name, the condition Over than 18? and the issuer of the credential appeared in
the adapted card with the corresponding values.

When participants were done selecting the credentials they press the “Send”
button located in the bottom right corner and they were asked question “What
information do you believe you have sent to Amazon.com?” (and the subheading
“Write what pieces of personal information you think will be sent to Amazon.com
when you pressed the ‘Send’ button”).

<figure><img src="image_7.png" /><figcaption>Fig. 6. Example of the adapted card containing the selected information.</figcaption></figure>

In order to account for the users’ understanding that the issuer of the creden-
tial is also send to the service provider, we included the multiple choice question
“*Additionally, does Amazon.com know some of the following?*” with the options
to answer “*The fact that you hold a Swedish passport*”, “*The fact that you hold
a driving license*”, “*None of the above*”, and “*Other*”.

Afterwards, participants were also inquired about their beliefs of other third
parties being able to get a hold of their information for the transaction ("When
you transferred your information to Amazon.com (by clicking the 'Send' button),
do you think anybody else will be able to get a hold of that information?"). This
question was asked since our experience with previous tests of the attribute-based
approach showed that some participants believed that their information would
also be sent to the issuer in the credential, which is the wrong mental model of
information flow (for example, when identifying themselves with their passport
credential, the police would also get their information, since the police is the
issuer of the credential). In this test, we wanted to confirm that the interface did
not mislead participants to create this incorrect mental model.
Finally, participants were asked to fill in some demographic information and other short questions about their experience paying for services or products online.

**Data collection and results.** A total of 29 participants were invited to do the test, 16 males and 13 females from different ages (18 to 57 years old) coming from a different cultural backgrounds (15 Swedish, 5 Germans, 3 Mexicans, 2 Iranians, 1 Italian, 1 Chinese, 1 Japanese, 1 Nepali). Some of them were recruited at KAU, and the majority were recruited outside the University premises. All of them had previous experience paying over the internet.

The tests were carried out with the use of laptop computers and smart tablet computers running the prototyped Flash animation. The data was gathered using a common survey online tool and analyzed in terms of the number of extra attributes that participants mistakenly believed were sent and the concealed attributes that they mistakenly believe were not sent to a service provider during the transaction portrayed in the e-shopping scenario. Also, to examine the participants' understanding on attributes satisfying conditions, we classified the data in two categories: the answers that stated that the service provider only knows the fact that they are over 18 years old, and the answers which mention either the age, date of birth or personal identification number (which in Sweden is an identification for age).

The results showed that 65% of the test participants (19 out of 29) understood the data minimizing properties of the adapted card approach which is approximately the same as in the attribute based approach (66%). However, of the ten remaining test participants that overestimated the amount of data being send, six added only the attribute of “address”. Presumably, these participants were thinking that their address was being sent in order to be able to receive the product by mail, and misunderstood the scenario in which an e-book was being downloaded into their computer and no postal address was necessary. Assuming that these six participants were thinking in terms of their own experiences when buying products online and having them delivered at home, we can deduce that a total of 86% of the test participants (25 out of 29) understood that not all data from the source was being send, but that only a subset of data was being selected and subsequently sent; thus understanding the property of data minimization.

Regarding the mental model of information flow, only 2 out of 29 participants mentioned that the issuer of the credential (i.e., the police) would be able to get a hold of their information. This is a great improvement from the attribute-based approach, in which many of participants seemed to think that their information would travel via the issuing authority. Besides, we believed that the two participants of this test who responded that the police would be able to get a hold of their information, were actually thinking in terms of the authority the police has to access their information at a certain point in the future, but not that their information was flowing through the police when sending it to the service provider.
With regards to the attributes being selected to satisfy a condition (i.e., proving if the user is over 18 years old), 35% of the participants (10 out of 29) understood that they had proved only the fact that they were over 18, three participants made no reference to age at all, and the remaining sixteen stated that they had revealed their age, birth date, or personal identification number (some as part of revealing the full source credential). This low proportion leaves further challenges for the design of user interfaces that convey the notion that attributes can satisfy conditions without their actual value being sent to service providers.

# 5 Conclusions

The results of our user studies show that users often lack adequate mental models to protect their privacy online. Our work with a credential selection mechanism for anonymous credentials highlights the difficulties in using metaphors when describing this novel technology. In our first rounds of testing the majority of users believed that anonymous credentials would work in the same fashion as the plastic credentials we compared them to, such as driving licenses or passports. However, in our latest tests we focused on the main difference between the two types of credentials (i.e. that they are adapted) and thus successfully changing the induced mental model of most test participants.

Taken together, the results from the three rounds of testing using the three different approaches clearly show how inducing adequate mental models is a key issue in the successful deployment of the novel technology of anonymous credentials. Our results also show that the adapted card-based approach is a right step towards evoking a comprehensive mental model for anonymous credential applications, and that using a traditional card-based approach (as presented in our first approach) is not recommended since it does not seem to fit the appropriate mental models of this technology. The adapted card-based approach also seems to be very efficient at making users understand that the issuer of a credential is not involved in the flow of the data during an online transaction. Moreover, the results also indicate that better user interface paradigm are needed for making users understand that attributes in a credential can be used to satisfy conditions, and that service providers would not have knowledge of the actual value of the attribute when it is not requested.

As a future suggestion for evoking correct mental models of anonymous credentials we suggest the exploration of a *form filling* approach, based on the idea that users are already accustomed to fill forms when carrying out online transactions. In this approach users would be presented with a common Internet form with its boxes already filled with values from a credential and some visual indication showing that these values are certified by the issuer of the credential. The data minimization property in this case can be illustrated by only filling the textboxes required by the service provider and indicating to the user that additional data is not needed for a particular transaction.
Moreover, the increased use of smart mobile devices brings the challenge of creating user-friendly interfaces that allow users to select anonymous credentials and are able to convey the property of data minimization.

All in all, it can be noted that, when it comes to privacy, the effects of incorrect mental models leads to difficulties in using a given application or not being able to take adequate steps in order to protect one's information. Even though our attempt to evoke the correct mental models of anonymous credentials has shown positive results throughout the different approaches, there is still room for improvement and future research in this area and in the usability of credential selection in general.

## Acknowledgments

Parts of the research leading to these results have received funding from the Swedish Knowledge Foundation (KK-stiftelsen) for the U-PrIM project and from the EU 7th Framework programme (FP7/2007-2013) for the project PrimeLife. The information in this document is provided "as is", and no guarantee or warranty is given that the information is fit for any particular purpose. The PrimeLife consortium members shall have no liability for damages of any kind including without limitation direct, special, indirect, or consequential damages that may result from the use of these materials subject to any liability which is mandatory due to applicable law.

## References

1. Brands, S.: Rethinking Public Key Infrastructure and Digital certificates - Building in Privacy. Ph.D. thesis, Eindhoven. Institute of Technology (1999)

2. Camenisch, J., Lysyanskaya, A.: Efficient non-transferable anonymous multi-show credential system with optional anonymity revocation. In Advances in Cryptology - Eurocrypt 2045, 93-118 (2001)

3. Camenisch, J., Crane, S., Fischer-Hbner, S., Leenes, R., Pearson, S., Pettersson, J.S., Sommer, D., Andersson, C.: Trust in PRIME. In: Signal Processing and Information Technology, 2005. Proceedings of the Fifth IEEE International Symposium on. pp. 552-559 (December 2005)

4. Camenisch, J., Shelat, A., Sommer, D., Zimmermann, R.: Securing user inputs for the web. In: Proceedings of the second ACM workshop on Digital identity management. pp. 33-44. DIM '06, ACM, New York, NY, USA (2006)

5. Chaum, D.: Security without identification: Transaction systems to make big brother obsolete. Communications of the ACM 28(10), 1030-1044 (1985)

6. Johnson-Laird, P.N.: Mental models: towards a cognitive science of language, inference, and consciousness. Harvard University Press, Cambridge, MA, USA (1983)

7. Jonassen, D.H.: Operationalizing mental models: strategies for assessing mental models to support meaningful learning and design-supportive learning environments. In: The first international conference on Computer support for collaborative learning. pp. 182-186. CSCL '95, L. Erlbaum Associates Inc., Hillsdale, NJ, USA (1995)
8. Pettersson, J.S.: HCI Guidelines. PRIME deliverable D6.1.f (February 2008)

9. Pettersson, J.S., Fischer-Hübner, S., Danielsson, N., Nilsson, J., Bergmann, M., Clauss, S., Kriegelstein, T., Krasemann, H.: Making PRIME usable. In: Proceedings of the 2005 symposium on Usable privacy and security. pp. 53–64. SOUPS ’05, ACM, New York, NY, USA (2005)

10. Wästlund, E., Fischer-Hübner, S.: Privacy and Identity Management for Life, chap. The Users’ Mental Models’ Effect on their Comprehension of Anonymous Credentials, pp. 229–240. Springer (2011)

11. Whitten, A., Tygar, J.D.: Why Johnny Can’t Encrypt: A Usability Evaluation of PGP 5.0. In: Proceedings of the 8th USENIX Security Symposium (1999)

12. Young, I.: Mental Models: Aligning Design Strategy with Human Behavior. Rosenfeld media (2008)