<figure><img src="image_8.png" /><figcaption>Fig. 7. Recommended design for a 2-stage account creation process.</figcaption></figure>

Another (partial and controversial, as explained above) countermeasure is to offer the possibility to register and log in via a third-party SSO service. However, the practicality and impact of SSO on security and usability should be thoroughly assessed. Moreover, service providers should offer an easy online procedure to delete one's account, rather than going through a tedious e-mail-based procedure, making it more user-friendly and efficient. Future research can explore the design and implementation of streamlined account deletion processes. Finally, service providers could rely on usernames instead of e-mail addresses as identifiers. The impact of all the aforementioned countermeasures would be even higher if they were implemented in user-management frameworks such as UserFrosting (PHP, https://www.userfrosting.com) and flask-base (Python, https://github.com/hack4impact/flask-base).

Finally, service providers could put in place mechanisms for detecting such attacks (e.g., when many requests associated with different e-mail addresses come from a limited set of IP addresses) and for warning users about requests related to their e-mail addresses, regardless of whether they have an account, as done by LEGO® and Zoom. Naturally, service providers should strike a balance between security/privacy of online accounts and users' information load. Such mechanisms would make the considered attacks non-stealth, thus deterring covert adversaries from carrying these attacks. On the user side, simple protective measures could also be implemented (yet, we believe that, to concretely counter these attacks, it should be the service provider who implements protective measures). For instance, a user could use distinct e-mail addresses for different online services (or use disposable e-mails), at least for those that are critical from a privacy viewpoint. A relatively simple way to do so is to rely on the alias feature offered by e-mail service providers. For instance, GMail users can use aliases of the form `username+alias@gmail.com` (the “+” symbol denotes the “+” ASCII character, not a concatenation operation) for generating an arbitrary number of different e-mail addresses while still receiving the e-mails sent to these addresses in the mailbox of their address `username@gmail.com`.<fnref n="41" /> For such a countermeasure to be efficient, however, users should make sure that the aliases they use are not too easy to guess. For instance, alias `username+servicename@gmail.com` is relatively easy to guess. Another simple countermeasure is to systematically delete accounts on services that the user no longer uses.

While the countermeasures discussed primarily focus on e-mail-based attacks, it is essential to consider their applicability to phone-based attacks. Phone numbers play a significant role in account registration, especially in mobile applications, and may be vulnerable to enumeration attacks. Unlike e-mail addresses, phone numbers are often more personal, less frequently changed, and may require additional steps or fees to obtain new ones. The effectiveness and practicality

<footnote n="41">⁴¹See blog.101domain.com, last visited: Feb. 2024.</footnote>
of applying the same countermeasures to phone-based attacks require further investigation. For
example, displaying oblivious messages for phone-based operations related to account management
could have different usability implications than for e-mail-based operations. Similarly, while a
two-step account creation process with e-mail verification is common, similar verification methods
can be applied to phone numbers. Future research should explore the specific challenges and
nuances of countering phone-based enumeration attacks and evaluate the usability and security
implications of applying similar countermeasures.

7.3 Legal Analysis

The vast majority of the services considered in our analysis are available to residents of the European Union (EU), who are protected by the General Data Protection Regulation (GDPR). Under the GDPR, an e-mail address is considered as personal data (Article 4(1)) and, by extension, so is the existence of the corresponding service account data associated with this e-mail address. In its capacity of data controller, the service provider is obliged to protect the data of its users (the data subjects, identified by at least their e-mail addresses), including the existence of their accounts on the service. Therefore, revealing through different features of an online service the existence of an account associated with the given e-mail address constitutes a data breach. To avoid this, the service provider could implement the aforementioned recommendations, such as displaying the same response to requests, regardless of whether an account associated with an e-mail address exists.

8 CONCLUSION

In this paper, we have studied three well-known basic attacks that enable an adversary to infer
the existence of an online account associated with a given e-mail address, on a specific service.
Our experimental results show that the considered attacks are quite successful and can often be
carried out stealthily. Our user survey then shows that users find this information sensitive, but
only a small fraction of them take (effective) measures to conceal it. As part of future work, we
intend to further research the feasibility of automating the attack across websites and to study
other known attack vectors (e.g., based on timings) for accessing the same information and to
identify new ones. We also intend to study user behavior (instead of attitude) through in-the-wild
experiments and to study the usability and user perception of the proposed countermeasures (e.g.,
two-stage account creation process). Finally, we intend to collaborate with service providers and
developers of user-management frameworks to fix the vulnerabilities exploited by the considered
attack and with data protection authorities to increase compliance regarding the protection of
account databases of online services.

ACKNOWLEDGEMENTS

The authors are grateful to Vincent Vandersluis for his great editing job, to Bertil Chapuis, Nicolas Frey, and Christophe Hauert for their feedback on the attack, to Valérie Junod and Sylvain Métille for their feedback on the legal aspects, and to Arnaud Salvadori for his help in the preliminary investigation. The work was partially funded with grant #22018 from the Hasler Foundation.

REFERENCES

[1] Ayako Akiyama Hasegawa, Takuya Watanabe, Eitaro Shioji, Mitsuaki Akiyama, and Tatsuya Mori. 2020. Addressing the Privacy Threat to Identify Existence of a Target’s Account on Sensitive Services. Journal of Information Processing 28, 0 (2020), 1030–1046. https://doi.org/10.2197/ipsjjip.28.1030

[2] Yonatan Aumann and Yehuda Lindell. 2007. Security Against Covert Adversaries: Efficient Protocols for Realistic Adversaries. In Proc. of the Theory of Cryptography Conference (TCC), Vol. 4392. Springer, 137–156. https://doi.org/10.1007/978-3-540-70936-7_8
of applying the same countermeasures to phone-based attacks require further investigation. For example, displaying oblivious messages for phone-based operations related to account management could have different usability implications than for e-mail-based operations. Similarly, while a two-step account creation process with e-mail verification is common, similar verification methods can be applied to phone numbers. Future research should explore the specific challenges and nuances of countering phone-based enumeration attacks and evaluate the usability and security implications of applying similar countermeasures.

## 7.3 Legal Analysis

The vast majority of the services considered in our analysis are available to residents of the European Union (EU), who are protected by the General Data Protection Regulation (GDPR). Under the GDPR, an e-mail address is considered as personal data (Article 4(1)) and, by extension, so is the existence of the corresponding service account data associated with this e-mail address. In its capacity of data controller, the service provider is obliged to protect the data of its users (the data subjects, identified by at least their e-mail addresses), including the existence of their accounts on the service. Therefore, revealing through different features of an online service the existence of an account associated with the given e-mail address constitutes a data breach. To avoid this, the service provider could implement the aforementioned recommendations, such as displaying the same response to requests, regardless of whether an account associated with an e-mail address exists.

# 8 CONCLUSION

In this paper, we have studied three well-known basic attacks that enable an adversary to infer the existence of an online account associated with a given e-mail address, on a specific service. Our experimental results show that the considered attacks are quite successful and can often be carried out stealthily. Our user survey then shows that users find this information sensitive, but only a small fraction of them take (effective) measures to conceal it. As part of future work, we intend to further research the feasibility of automating the attack across websites and to study other known attack vectors (e.g., based on timings) for accessing the same information and to identify new ones. We also intend to study user behavior (instead of attitude) through in-the-wild experiments and to study the usability and user perception of the proposed countermeasures (e.g., two-stage account creation process). Finally, we intend to collaborate with service providers and developers of user-management frameworks to fix the vulnerabilities exploited by the considered attack and with data protection authorities to increase compliance regarding the protection of account databases of online services.

## ACKNOWLEDGEMENTS

The authors are grateful to Vincent Vandersluis for his great editing job, to Bertil Chapuis, Nicolas Frey, and Christophe Hauert for their feedback on the attack, to Valérie Junod and Sylvain Métille for their feedback on the legal aspects, and to Arnaud Salvadori for his help in the preliminary investigation. The work was partially funded with grant #22018 from the Hasler Foundation.

## REFERENCES

[1] Ayako Akiyama Hasegawa, Takuya Watanabe, Eitaro Shioji, Mitsuaki Akiyama, and Tatsuya Mori. 2020. Addressing the Privacy Threat to Identify Existence of a Target's Account on Sensitive Services. Journal of Information Processing 28, 0 (2020), 1030-1046. https://doi.org/10.2197/ipsjjip.28.1030

[2] Yonatan Aumann and Yehuda Lindell. 2007. Security Against Covert Adversaries: Efficient Protocols for Realistic Adversaries. In Proc. of the Theory of Cryptography Conference (TCC), Vol. 4392. Springer, 137-156. https://doi.org/10.1007/978-3-540-70936-7_8
[3] Marco Balduzzi, Christian Platzer, Thorsten Holz, Engin Kirda, Davide Balzarotti, and Christopher Kruegel. 2010. Abusing Social Networks for Automated User Profiling. In Proc. of the Int'l Workshop on Recent Advances in Intrusion Detection (RAID), Vol. 6307. Springer, 422-441. https://doi.org/10.1007/978-3-642-15512-3_22

[4] Lujo Bauer, Cristian Bravo-Lillo, Elliott Fragkaki, and William Melicher. 2013. A comparison of users' perceptions of and willingness to use Google, Facebook, and Google+ single-sign-on functionality. In Proc. of the ACM Workshop on Digital identity management (DIM). Colocated with the ACM Conf. on Computer and Communications Security (CCS). ACM, Berlin, Germany, 25-36. https://doi.org/10.1145/2517881.2517886

[5] Andrew Bortz and Dan Boneh. 2007. Exposing private information by timing web applications. In Proc. of the Int'l Conf. on World Wide Web (WWW). ACM, Banff, Alberta, Canada, 621. https://doi.org/10.1145/1242572.1242656

[6] Rahul Chatterjee, Periwinkle Doerfler, Hadas Orgad, Sam Havron, Jackeline Palmer, Diana Freed, Karen Levy, Nicola Dell, Damon McCoy, and Thomas Ristenpart. 2018. The Spyware Used in Intimate Partner Violence. In Proc. of the IEEE Symp. on Security and Privacy (S&P). IEEE, San Francisco, CA, 441-458. https://doi.org/10.1109/SP.2018.00061

[7] Eugene Cho, Jinyoung Kim, and S. Shyam Sundar. 2020. Will You Log into Tinder using your Facebook Account? Adoption of Single Sign-On for Privacy-Sensitive Apps. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI) - Extended Abstracts. ACM, Honolulu, HI, USA, 1-7. https://doi.org/10.1145/3334480.3383074

[8] Yana Dimova, Tom Van Goethem, and Wouter Joosen. 2023. Everybody's Looking for SSOMething: A large-scale evaluation on the privacy of OAuth authentication on the web. Proceedings on Privacy Enhancing Technologies (2023). https://petsymposium.org/popets/2023/popets-2023-0119.php

[9] Verena Distler. 2023. The Influence of Context on Response to Spear-Phishing Attacks: an In-Situ Deception Study. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI) (CHI '23). ACM, New York, NY, USA, 1-18. https://doi.org/10.1145/3544548.3581170

[10] D. Dittrich and E. Kenneally. 2012. The Menlo Report: Ethical Principles Guiding Information and Communication Technology Research. Technical Report. U.S. Department of Homeland Security.

[11] Vincent Drury and Ulrike Meyer. 2020. No Phishing With the Wrong Bait: Reducing the Phishing Risk by Address Separation. In Proc. of the IEEE European Symp. on Security and Privacy Workshops (EuroS&P). 646-652. https://doi.org/10.1109/EuroSPW51379.2020.00093

[12] Serge Egelman. 2013. My profile is my password, verify me!: the privacy/convenience tradeoff of facebook connect. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI). ACM, Paris, France, 2369-2378. https://doi.org/10.1145/2470654.2481328

[13] Serge Egelman, Marian Harbach, and Eyal Peer. 2016. Behavior Ever Follows Intention?: A Validation of the Security Behavior Intentions Scale (SeBIS). In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI). ACM, San Jose, CA, USA, 5257-5261. https://doi.org/10.1145/2858036.2858265

[14] Diana Freed, Sam Havron, Emily Tseng, Andrea Gallardo, Rahul Chatterjee, Thomas Ristenpart, and Nicola Dell. 2019. "Is my phone hacked?" Analyzing Clinical Computer Security Interventions with Survivors of Intimate Partner Violence. Proceedings of the ACM on Human-Computer Interaction 3, CSCW (Nov. 2019), 1-24. https://doi.org/10.1145/3359304

[15] Mohammad Ghasemisharif, Chris Kanich, and Jason Polakis. 2022. Towards Automated Auditing for Account and Session Management Flaws in Single Sign-On Deployments. In Proc. of the IEEE Symp. on Security and Privacy (S&P). IEEE, San Francisco, CA, USA, 1774-1790. https://doi.org/10.1109/SP46214.2022.9833753

[16] Hacksplaining. 2022. Avoiding User Enumeration. (2022). https://www.hacksplaining.com/prevention/user-enumeration\lastvisited.

[17] Ayako Akiyama Hasegawa, Takuya Watanabe, Eitaro Shioji, and Mitsuaki Akiyama. 2019. I know what you did last login: inconsistent messages tell existence of a target's account to insiders. In Proc. of the Annual Computer Security Applications Conference (ACSAC). ACM, San Juan, Puerto Rico, USA, 732-746. https://doi.org/10.1145/3359789.3359832

[18] Sam Havron, Diana Freed, Rahul Chatterjee, Damon McCoy, Nicola Dell, and Thomas Ristenpart. 2019. Clinical computer security for victims of intimate partner violence. In Proc. of the USENIX Security Symposium (USENIX Security). USENIX Association, Santa Clara, CA, 105-122. https://www.usenix.org/conference/usenixsecurity19/presentation/havron

[19] Hang Hu, Peng Peng, and Gang Wang. 2019. Characterizing Pixel Tracking through the Lens of Disposable Email Services. In Proc. of the IEEE Symp. on Security and Privacy (S&P). IEEE, San Francisco, CA, USA, 365-379. https://doi.org/10.1109/SP.2019.00033

[20] Ruogu Kang, Laura Dabbish, Nathaniel Fruchter, and Sara Kiesler. 2015. "My Data Just Goes Everywhere:" User Mental Models of the Internet and Implications for Privacy and Security. In Proc. of the Symp. On Usable Privacy and Security (SOUPS). 39-52. https://www.usenix.org/conference/soups2015/proceedings/presentation/kang

[21] Jinwoo Kim, Kuyju Kim, Junsung Cho, Hyoungshick Kim, and Sebastian Schrittwieser. 2017. Hello, Facebook! Here Is the Stalkers' Paradise!: Design and Analysis of Enumeration Attack Using Phone Numbers on Facebook. In Proc. of the Int'l Conf. on Information Security Practice and Experience (ISPEC), Vol. 10701. Springer International Publishing, Cham,
[3] Marco Balduzzi, Christian Platzer, Thorsten Holz, Engin Kirda, Davide Balzarotti, and Christopher Kruegel. 2010. Abusing Social Networks for Automated User Profiling. In Proc. of the Int'l Workshop on Recent Advances in Intrusion Detection (RAID), Vol. 6307. Springer, 422-441. https://doi.org/10.1007/978-3-642-15512-3_22

[4] Lujo Bauer, Cristian Bravo-Lillo, Elliott Fragkaki, and William Melicher. 2013. A comparison of users' perceptions of and willingness to use Google, Facebook, and Google+ single-sign-on functionality. In Proc. of the ACM Workshop on Digital identity management (DIM). Colocated with the ACM Conf. on Computer and Communications Security (CCS). ACM, Berlin, Germany, 25-36. https://doi.org/10.1145/2517881.2517886

[5] Andrew Bortz and Dan Boneh. 2007. Exposing private information by timing web applications. In Proc. of the Int'l Conf. on World Wide Web (WWW). ACM, Banff, Alberta, Canada, 621. https://doi.org/10.1145/1242572.1242656

[6] Rahul Chatterjee, Periwinkle Doerfler, Hadas Orgad, Sam Havron, Jackeline Palmer, Diana Freed, Karen Levy, Nicola Dell, Damon McCoy, and Thomas Ristenpart. 2018. The Spyware Used in Intimate Partner Violence. In Proc. of the IEEE Symp. on Security and Privacy (S&P). IEEE, San Francisco, CA, 441-458. https://doi.org/10.1109/SP.2018.00061

[7] Eugene Cho, Jinyoung Kim, and S. Shyam Sundar. 2020. Will You Log into Tinder using your Facebook Account? Adoption of Single Sign-On for Privacy-Sensitive Apps. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI) - Extended Abstracts. ACM, Honolulu, HI, USA, 1-7. https://doi.org/10.1145/3334480.3383074

[8] Yana Dimova, Tom Van Goethem, and Wouter Joosen. 2023. Everybody's Looking for SSOMething: A large-scale evaluation on the privacy of OAuth authentication on the web. Proceedings on Privacy Enhancing Technologies (2023). https://petsymposium.org/popets/2023/popets-2023-0119.php

[9] Verena Distler. 2023. The Influence of Context on Response to Spear-Phishing Attacks: an In-Situ Deception Study. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI) (CHI '23). ACM, New York, NY, USA, 1-18. https://doi.org/10.1145/3544548.3581170

[10] D. Dittrich and E. Kenneally. 2012. The Menlo Report: Ethical Principles Guiding Information and Communication Technology Research. Technical Report. U.S. Department of Homeland Security.

[11] Vincent Drury and Ulrike Meyer. 2020. No Phishing With the Wrong Bait: Reducing the Phishing Risk by Address Separation. In Proc. of the IEEE European Symp. on Security and Privacy Workshops (EuroS&P). 646-652. https://doi.org/10.1109/EuroSPW51379.2020.00093

[12] Serge Egelman. 2013. My profile is my password, verify me!: the privacy/convenience tradeoff of facebook connect. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI). ACM, Paris, France, 2369-2378. https://doi.org/10.1145/2470654.2481328

[13] Serge Egelman, Marian Harbach, and Eyal Peer. 2016. Behavior Ever Follows Intention?: A Validation of the Security Behavior Intentions Scale (SeBIS). In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI). ACM, San Jose, CA, USA, 5257-5261. https://doi.org/10.1145/2858036.2858265

[14] Diana Freed, Sam Havron, Emily Tseng, Andrea Gallardo, Rahul Chatterjee, Thomas Ristenpart, and Nicola Dell. 2019. "Is my phone hacked?" Analyzing Clinical Computer Security Interventions with Survivors of Intimate Partner Violence. Proceedings of the ACM on Human-Computer Interaction 3, CSCW (Nov. 2019), 1-24. https://doi.org/10.1145/3359304

[15] Mohammad Ghasemisharif, Chris Kanich, and Jason Polakis. 2022. Towards Automated Auditing for Account and Session Management Flaws in Single Sign-On Deployments. In Proc. of the IEEE Symp. on Security and Privacy (S&P). IEEE, San Francisco, CA, USA, 1774-1790. https://doi.org/10.1109/SP46214.2022.9833753

[16] Hacksplaining. 2022. Avoiding User Enumeration. (2022). https://www.hacksplaining.com/prevention/user-enumeration\lastvisited.

[17] Ayako Akiyama Hasegawa, Takuya Watanabe, Eitaro Shioji, and Mitsuaki Akiyama. 2019. I know what you did last login: inconsistent messages tell existence of a target's account to insiders. In Proc. of the Annual Computer Security Applications Conference (ACSAC). ACM, San Juan, Puerto Rico, USA, 732-746. https://doi.org/10.1145/3359789.3359832

[18] Sam Havron, Diana Freed, Rahul Chatterjee, Damon McCoy, Nicola Dell, and Thomas Ristenpart. 2019. Clinical computer security for victims of intimate partner violence. In Proc. of the USENIX Security Symposium (USENIX Security). USENIX Association, Santa Clara, CA, 105-122. https://www.usenix.org/conference/usenixsecurity19/presentation/havron

[19] Hang Hu, Peng Peng, and Gang Wang. 2019. Characterizing Pixel Tracking through the Lens of Disposable Email Services. In Proc. of the IEEE Symp. on Security and Privacy (S&P). IEEE, San Francisco, CA, USA, 365-379. https://doi.org/10.1109/SP.2019.00033

[20] Ruogu Kang, Laura Dabbish, Nathaniel Fruchter, and Sara Kiesler. 2015. "My Data Just Goes Everywhere:" User Mental Models of the Internet and Implications for Privacy and Security. In Proc. of the Symp. On Usable Privacy and Security (SOUPS). 39-52. https://www.usenix.org/conference/soups2015/proceedings/presentation/kang

[21] Jinwoo Kim, Kuyju Kim, Junsung Cho, Hyoungshick Kim, and Sebastian Schrittwieser. 2017. Hello, Facebook! Here Is the Stalkers' Paradise!: Design and Analysis of Enumeration Attack Using Phone Numbers on Facebook. In Proc. of the Int'l Conf. on Information Security Practice and Experience (ISPEC), Vol. 10701. Springer International Publishing, Cham,
663-677. https://doi.org/10.1007/978-3-319-72359-4_41

[22] K. Krombholz, K. Busse, K. Pfeffer, M. Smith, and E. von Zezschwitz. 2019. "If HTTPS Were Secure, I Wouldn't Need 2FA" - End User and Administrator Mental Models of HTTPS. In Proc. of the IEEE Symp. on Security and Privacy (S&P). IEEE, San Francisco, CA, USA, 1138-1155. https://doi.org/10.1109/SP.2019.00060

[23] Leona Lassak, Philipp Markert, Maximilian Golla, Elizabeth Stobert, and Markus Dürmuth. 2024. A Comparative Long-Term Study of Fallback Authentication Schemes. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI) (CHI'24).

[24] Karen Levy and Bruce Schneier. 2020. Privacy threats in intimate relationships. Journal of Cybersecurity 6, 1 (Jan. 2020), tyaa006. https://doi.org/10.1093/cybsec/tyaa006

[25] Naresh K. Malhotra, Sung S. Kim, and James Agarwal. 2004. Internet Users' Information Privacy Concerns (IUIPC): The Construct, the Scale, and a Causal Model. Information Systems Research 15, 4 (Dec. 2004), 336-355. https://doi.org/10.1287/isre.1040.0032

[26] Ioana Andreea Marin, Pavlo Burda, Nicola Zannone, and Luca Allodi. 2023. The Influence of Human Factors on the Intention to Report Phishing Emails. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI) (CHI '23). ACM, New York, NY, USA, 1-18. https://doi.org/10.1145/3544548.3580985

[27] Philipp Markert, Leona Lassak, Maximilian Golla, and Markus Dürmuth. 2024. Understanding Users' Interaction with Login Notifications. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI) (CHI'24). https://doi.org/10.1145/3613904.3642823 arXiv:2212.07316 [cs].

[28] Tenga Matsuura, Ayako A. Hasegawa, Mitsuaki Akiyama, and Tatsuya Mori. 2021. Careless Participants Are Essential for Our Phishing Study: Understanding the Impact of Screening Methods. In Proc. of the European Symp. on Usable Security (EuroUSEC) (EuroUSEC '21). ACM, New York, NY, USA, 36-47. https://doi.org/10.1145/3481357.3481515

[29] Tara Matthews, Kathleen O'Leary, Anna Turner, Manya Sleeper, Jill Palzkill Woelfler, Martin Shelton, Cori Manthorne, Elizabeth F. Churchill, and Sunny Consolvo. 2017. Stories from Survivors: Privacy & Security Practices when Coping with Intimate Partner Abuse. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI). ACM, Denver, CO, USA, 2189-2201. https://doi.org/10.1145/3025453.3025875

[30] Allison McDonald, Carlo Sugatan, Tamy Guberek, and Florian Schaub. 2021. The Annoying, the Disturbing, and the Weird: Challenges with Phone Numbers as Identifiers and Phone Number Recycling. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI). ACM, Yokohama Japan, 1-14. https://doi.org/10.1145/3411764.3445085

[31] Gregory D. Moody, Dennis F. Galletta, and Brian Kimball Dunn. 2017. Which phish get caught? An exploratory study of individuals' susceptibility to phishing. European Journal of Information Systems 26, 6 (Nov. 2017), 564-584. https://doi.org/10.1057/s41303-017-0058-x

[32] Srivathsan G. Morkonda, Sonia Chiasson, and Paul C. van Oorschot. 2023. Influences of Displaying Permission-related Information on Web Single Sign-On Login Decisions. (Aug. 2023). https://doi.org/10.48550/arXiv.2308.13074 arXiv:2308.13074 [cs].

[33] Srivathsan G. Morkonda, Sonia Chiasson, and Paul C. van Oorschot. 2023. "Sign in with ... Privacy": Timely Disclosure of Privacy Differences among Web SSO Login Options. (Aug. 2023). https://doi.org/10.48550/arXiv.2209.04490 arXiv:2209.04490 [cs].

[34] pagvac. 2007. Username Enumeration Vulnerabilities. (April 2007). https://www.gnucitizen.org/blog/username-enumeration-vulnerabilities/ \lastvisited.

[35] Elissa M. Redmiles, Ziyun Zhu, Sean Kross, Dhruv Kuchhal, Tudor Dumitras, and Michelle L. Mazurek. 2018. Asking for a Friend: Evaluating Response Biases in Security User Studies. In Proc. of the ACM Conf. on Computer and Communications Security (CCS). ACM, Toronto, ON, Canada, 1238-1255. https://doi.org/10.1145/3243734.3243740

[36] Kristen Roggemann, Galia Nurko, and Alexandra Tyers-Chowdhury. 2020. User Perceptions of trust and Privacy on the Internet. Technical Report. DAI's Center for Digital Acceleration. 48 pages.

[37] Johnny Saldaña. 2021. The coding manual for qualitative researchers (4th ed ed.). SAGE Publishing, Thousand Oaks.

[38] Dafydd Stuttard. 2007. Preventing username enumeration. (April 2007). https://portswigger.net/blog/preventing-username-enumeration \lastvisited.

[39] San-Tsai Sun, Eric Pospisil, Ildar Muslukhov, Nuray Dindar, Kirstie Hawkey, and Konstantin Beznosov. 2013. Investigating Users' Perspectives of Web Single Sign-On: Conceptual Gaps and Acceptance Model. ACM Transactions on Internet Technology 13, 1 (Nov. 2013), 2:1-2:35. https://doi.org/10.1145/2532639

[40] Anne Clara Tally, Jacob Abbott, Ashley M Bochner, Sanchari Das, and Christena Nippert-Eng. 2023. Tips, Tricks, and Training: Supporting Anti-Phishing Awareness among Mid-Career Office Workers Based on Employees' Current Practices. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI) (CHI '23). ACM, New York, NY, USA, 1-13. https://doi.org/10.1145/3544548.3580650

[41] Emily Tseng, Rosanna Bellini, Nora McDonald, Matan Danos, Rachel Greenstadt, Damon McCoy, Nicola Dell, and Thomas Ristenpart. 2020. The Tools and Tactics Used in Intimate Partner Surveillance: An Analysis of Online Infidelity
663-677. https://doi.org/10.1007/978-3-319-72359-4_41

[22] K. Krombholz, K. Busse, K. Pfeffer, M. Smith, and E. von Zezschwitz. 2019. "If HTTPS Were Secure, I Wouldn't Need 2FA" - End User and Administrator Mental Models of HTTPS. In Proc. of the IEEE Symp. on Security and Privacy (S&P). IEEE, San Francisco, CA, USA, 1138-1155. https://doi.org/10.1109/SP.2019.00060

[23] Leona Lassak, Philipp Markert, Maximilian Golla, Elizabeth Stobert, and Markus Dürmuth. 2024. A Comparative Long-Term Study of Fallback Authentication Schemes. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI) (CHI'24).

[24] Karen Levy and Bruce Schneier. 2020. Privacy threats in intimate relationships. Journal of Cybersecurity 6, 1 (Jan. 2020), tyaa006. https://doi.org/10.1093/cybsec/tyaa006

[25] Naresh K. Malhotra, Sung S. Kim, and James Agarwal. 2004. Internet Users' Information Privacy Concerns (IUIPC): The Construct, the Scale, and a Causal Model. Information Systems Research 15, 4 (Dec. 2004), 336-355. https://doi.org/10.1287/isre.1040.0032

[26] Ioana Andreea Marin, Pavlo Burda, Nicola Zannone, and Luca Allodi. 2023. The Influence of Human Factors on the Intention to Report Phishing Emails. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI) (CHI '23). ACM, New York, NY, USA, 1-18. https://doi.org/10.1145/3544548.3580985

[27] Philipp Markert, Leona Lassak, Maximilian Golla, and Markus Dürmuth. 2024. Understanding Users' Interaction with Login Notifications. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI) (CHI'24). https://doi.org/10.1145/3613904.3642823 arXiv:2212.07316 [cs].

[28] Tenga Matsuura, Ayako A. Hasegawa, Mitsuaki Akiyama, and Tatsuya Mori. 2021. Careless Participants Are Essential for Our Phishing Study: Understanding the Impact of Screening Methods. In Proc. of the European Symp. on Usable Security (EuroUSEC) (EuroUSEC '21). ACM, New York, NY, USA, 36-47. https://doi.org/10.1145/3481357.3481515

[29] Tara Matthews, Kathleen O'Leary, Anna Turner, Manya Sleeper, Jill Palzkill Woelfler, Martin Shelton, Cori Manthorne, Elizabeth F. Churchill, and Sunny Consolvo. 2017. Stories from Survivors: Privacy & Security Practices when Coping with Intimate Partner Abuse. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI). ACM, Denver, CO, USA, 2189-2201. https://doi.org/10.1145/3025453.3025875

[30] Allison McDonald, Carlo Sugatan, Tamy Guberek, and Florian Schaub. 2021. The Annoying, the Disturbing, and the Weird: Challenges with Phone Numbers as Identifiers and Phone Number Recycling. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI). ACM, Yokohama Japan, 1-14. https://doi.org/10.1145/3411764.3445085

[31] Gregory D. Moody, Dennis F. Galletta, and Brian Kimball Dunn. 2017. Which phish get caught? An exploratory study of individuals' susceptibility to phishing. European Journal of Information Systems 26, 6 (Nov. 2017), 564-584. https://doi.org/10.1057/s41303-017-0058-x

[32] Srivathsan G. Morkonda, Sonia Chiasson, and Paul C. van Oorschot. 2023. Influences of Displaying Permission-related Information on Web Single Sign-On Login Decisions. (Aug. 2023). https://doi.org/10.48550/arXiv.2308.13074 arXiv:2308.13074 [cs].

[33] Srivathsan G. Morkonda, Sonia Chiasson, and Paul C. van Oorschot. 2023. "Sign in with ... Privacy": Timely Disclosure of Privacy Differences among Web SSO Login Options. (Aug. 2023). https://doi.org/10.48550/arXiv.2209.04490 arXiv:2209.04490 [cs].

[34] pagvac. 2007. Username Enumeration Vulnerabilities. (April 2007). https://www.gnucitizen.org/blog/username-enumeration-vulnerabilities/ \lastvisited.

[35] Elissa M. Redmiles, Ziyun Zhu, Sean Kross, Dhruv Kuchhal, Tudor Dumitras, and Michelle L. Mazurek. 2018. Asking for a Friend: Evaluating Response Biases in Security User Studies. In Proc. of the ACM Conf. on Computer and Communications Security (CCS). ACM, Toronto, ON, Canada, 1238-1255. https://doi.org/10.1145/3243734.3243740

[36] Kristen Roggemann, Galia Nurko, and Alexandra Tyers-Chowdhury. 2020. User Perceptions of trust and Privacy on the Internet. Technical Report. DAI's Center for Digital Acceleration. 48 pages.

[37] Johnny Saldaña. 2021. The coding manual for qualitative researchers (4th ed ed.). SAGE Publishing, Thousand Oaks.

[38] Dafydd Stuttard. 2007. Preventing username enumeration. (April 2007). https://portswigger.net/blog/preventing-username-enumeration \lastvisited.

[39] San-Tsai Sun, Eric Pospisil, Ildar Muslukhov, Nuray Dindar, Kirstie Hawkey, and Konstantin Beznosov. 2013. Investigating Users' Perspectives of Web Single Sign-On: Conceptual Gaps and Acceptance Model. ACM Transactions on Internet Technology 13, 1 (Nov. 2013), 2:1-2:35. https://doi.org/10.1145/2532639

[40] Anne Clara Tally, Jacob Abbott, Ashley M Bochner, Sanchari Das, and Christena Nippert-Eng. 2023. Tips, Tricks, and Training: Supporting Anti-Phishing Awareness among Mid-Career Office Workers Based on Employees' Current Practices. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI) (CHI '23). ACM, New York, NY, USA, 1-13. https://doi.org/10.1145/3544548.3580650

[41] Emily Tseng, Rosanna Bellini, Nora McDonald, Matan Danos, Rachel Greenstadt, Damon McCoy, Nicola Dell, and Thomas Ristenpart. 2020. The Tools and Tactics Used in Intimate Partner Surveillance: An Analysis of Online Infidelity
Forums. In Proc. of the USENIX Security Symposium (USENIX Security), 18.

[42] Rui Wang, Shuo Chen, and XiaoFeng Wang. 2012. Signing Me onto Your Accounts through Facebook and Google: A Traffic-Guided Security Study of Commercially Deployed Single-Sign-On Web Services. In Proc. of the IEEE Symp. on Security and Privacy (S&P). IEEE, San Francisco, CA, USA, 365–379. https://doi.org/10.1109/SP.2012.30

[43] Rick Wash, Emilee Rader, and Chris Fennell. 2017. Can People Self-Report Security Accurately? Agreement Between Self-Report and Behavioral Measures. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI) (CHI ’17). ACM, New York, NY, USA, 2228–2232. https://doi.org/10.1145/3025453.3025911
Forums. In Proc. of the USENIX Security Symposium (USENIX Security), 18.

[42] Rui Wang, Shuo Chen, and XiaoFeng Wang. 2012. Signing Me onto Your Accounts through Facebook and Google: A Traffic-Guided Security Study of Commercially Deployed Single-Sign-On Web Services. In Proc. of the IEEE Symp. on Security and Privacy (S&P). IEEE, San Francisco, CA, USA, 365–379. https://doi.org/10.1109/SP.2012.30

[43] Rick Wash, Emilee Rader, and Chris Fennell. 2017. Can People Self-Report Security Accurately? Agreement Between Self-Report and Behavioral Measures. In Proc. of the ACM Conf. on Human Factors in Computing Systems (CHI) (CHI ’17). ACM, New York, NY, USA, 2228–2232. https://doi.org/10.1145/3025453.3025911
A RAW EXPERIMENTAL DATA

<table><caption>Table 1. Raw experimental data. The 🤫 icon denotes the stealthiness of the (successful) attack and the 🔒 icon denotes the presence of CAPTCHAs for the corresponding form. The possibility to delete one's own account is denoted with icon 🤫; the ☑ icon denotes the fact that it can be done only by e-mail (no online form). The presence of the “Login with...” (i.e., single sign-on) feature is denoted with the icon of the corresponding identity provider (i.e., f, G, or 🔒).</caption><thead><tr><th>service</th><th>login</th><th>(i)</th><th>(h-)</th><th>password reset</th><th>(i)</th><th>(h-)</th><th>account creation</th><th>(i)</th><th>(h-)</th><th>ⓘ</th><th>f</th><th>G</th><th>ⓘ</th></tr></thead><tbody><tr><td>20min</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Airbnb</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Amavita</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Amazon</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Autoscout24</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Badoo</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>BettyBossi</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Blick</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Bon Prix</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Booking</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Comparis</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Coop At Home</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>DPD</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Decathlon</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>DeepL</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Doctissimo</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Doodle</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Facebook</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Flickr</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Galaxus</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Hornbach</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>IMDB</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Ifolor</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Ikea</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Immoscout24</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>InshAllah</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Instagram</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>JW</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Jeuxvidéo</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Jobs</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Jobup</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Journal des Femmes</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>JustEat</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Landi</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Loterie Romande</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Migros Online</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Moneyhouse</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Netflix</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Obi</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Ochsnersport</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Orel Füssli</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Outdooractive</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Paypal</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Playstation</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Pornhub</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Post.ch</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Qualipet</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>RTS</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Ricardo</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>SBB</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Shop Apotheke</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Shutterstock</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Spotify</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Statista</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Swisslos</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Tripadvisor</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Twitch</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Twitter</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>W</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Wikipedia</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Wuerth</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Xhamster</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Zalando</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Zooplus</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr></tbody></table>
## A RAW EXPERIMENTAL DATA

<table><caption>Table 1. Raw experimental data. The 🤫 icon denotes the stealthiness of the (successful) attack and the 🤫-icon denotes the presence of CAPTCHAs for the corresponding form. The possibility to delete one's own account is denoted with icon 🤫; the ☑ icon denotes the fact that it can be done only by e-mail (no online form). The presence of the “Login with…” (i.e., single sign-on) feature is denoted with the icon of the corresponding identity provider (i.e., f, G, or 🤫).</caption><thead><tr><th>service</th><th>login</th><th>(i)</th><th>(h-)</th><th>password reset</th><th>(i)</th><th>(h-)</th><th>account creation</th><th>(i)</th><th>(h-)</th><th>ⓘ</th><th>f</th><th>G</th><th>ⓘ</th></tr></thead><tbody><tr><td>20min</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Airbnb</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Amavita</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Amazon</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Autoscout24</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Badoo</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>BettyBossi</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Blick</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Bon Prix</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Booking</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Comparis</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Coop At Home</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>DPD</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Decathlon</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>DeepL</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Doctissimo</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Doodle</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Facebook</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Flickr</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Galaxus</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Hornbach</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>IMDB</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Ifolor</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Ikea</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Immoscout24</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>InshAllah</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Instagram</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>JW</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Jeuxvidéo</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Jobs</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Jobup</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Journal des Femmes</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>JustEat</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Landi</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Loterie Romande</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Migros Online</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Moneyhouse</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Netflix</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Obi</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Ochsnersport</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Orel Füssli</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Outdooractive</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Paypal</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Playstation</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Pornhub</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Post.ch</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Qualipet</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>RTS</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Ricardo</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>SBB</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Shop Apotheke</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Shutterstock</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Spotify</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Statista</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Swisslos</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Tripadvisor</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Twitch</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Twitter</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>W</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Wikipedia</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Wuerth</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Xhamster</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Zalando</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Zooplus</td><td>✓</td><td>✓</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr></tbody></table>
# B SURVEY QUESTIONNAIRE

Here we provide the complete transcript of the survey questionnaire.

Note: Coding rules are marked in gray (not visible to respondents)

## Sec. A: Consent Form

You are invited to participate in the **Survey on Online Accounts**, research conducted by the Information Security and Privacy Lab at the University of Lausanne (UNIL) for **improving the security of online services**. Thank you for your participation!

You will need about **7-10 minutes** to complete the questionnaire.

Your participation is entirely voluntary and you can withdraw your participation at any time during the experiment without specifying a reason: Your data will be deleted but you will not be paid if you stop your participation during the experiment. Your responses will be collected by the researchers in a confidential and anonymous way. If the results of this study will be published, we will do so in an anonymous manner. If you have any questions about the research, do not hesitate to email us at: ux-research@unil.ch By signing this (By clicking on "I agree"), you declare that you have read the preceding information and agree to participate in this study.

(1) [Single Selection.] Do you agree with the terms above?

(a) I agree

(b) I do not Agree [Terminate.]

## Sec. B: Services

(2) [Multiple selection. Order randomized.] Please select all the online services on which you have an account.

(a) Netflix

(b) Immoscout24

(c) Instagram

(d) Galaxus

(e) Migros Online

(f) Ricardo

(g) IKEA

(h) Zalando

(i) Loterie Romande

(j) Doctissimo

(k) impornhub

(l) Badoo

(m) Magic X Erotic Shop

(n) Grindr

(o) UDC (Union démocratique du centre)

(p) None of the above

(3) [Single Selection.] How many different e-mail addresses do you have?

(a) 1

(b) 2

(c) 3 or more

[Display Q4 if Q3$!=1]

(4) [Single Selection.] How many different e-mail addresses do you **use to register and login to different online services** (e.g., using your Swisscom e-mail address to register and login to IKEA and your Hotmail address for Netflix)?
B SURVEY QUESTIONNAIRE

Here we provide the complete transcript of the survey questionnaire.

Note: Coding rules are marked in gray (not visible to respondents)

Sec. A: Consent Form

You are invited to participate in the **Survey on Online Accounts**, research conducted by the Information Security and Privacy Lab at the University of Lausanne (UNIL) for **improving the security of online services**. Thank you for your participation!

You will need about 7-10 minutes to complete the questionnaire.

Your participation is entirely voluntary and you can withdraw your participation at any time during the experiment without specifying a reason: Your data will be deleted but you will not be paid if you stop your participation during the experiment. Your responses will be collected by the researchers in a confidential and anonymous way. If the results of this study will be published, we will do so in an anonymous manner. If you have any questions about the research, do not hesitate to email us at: ux-research@unil.ch By signing this (By clicking on "I agree"), you declare that you have read the preceding information and agree to participate in this study.

(1) [Single Selection.] Do you agree with the terms above?

(a) I agree

(b) I do not Agree [Terminate.]

Sec. B: Services

(2) [Multiple selection. Order randomized.] Please select all the online services on which you have an account.

(a) Netflix

(b) Immoscout24

(c) Instagram

(d) Galaxus

(e) Migros Online

(f) Ricardo

(g) IKEA

(h) Zalando

(i) Loterie Romande

(j) Doctissimo

(k) impornhub

(l) Badoo

(m) Magic X Erotic Shop

(n) Grindr

(o) UDC (Union démocratique du centre)

(p) None of the above

(3) [Single Selection.] How many different e-mail addresses do you have?

(a) 1

(b) 2

(c) 3 or more

[Display Q4 if Q3$!=1]

(4) [Single Selection.] How many different e-mail addresses do you **use to register and login to different online services** (e.g., using your Swisscom e-mail address to register and login to IKEA and your Hotmail address for Netflix)?
(a) 1

(b) 2 [Display this choice if Q3$=2 or Q3$=3 or more]

(c) 3 or more [Display this choice if Q3$=3 or more]

[Display Q5 if Q4$=2 or Q4$=3 or more]

(5) [Open-ended.] Why do you register to different online services with different e-mail addresses?

[ ](text field)

(6) [Single Selection.] In the last 6 months, how many times did you use the "Sign in with ..." (e.g., Apple, Facebook, Google, Microsoft, Twitter) feature to register online accounts?

(a) 0

(b) 1–2

(c) 3–4

(d) 5–6

(e) 7+

<figure><img src="image_8.png" /></figure>

Sec. C: Privacy

(7) [Grid question. Row order randomized.] From a privacy perspective, how concerned would you be if the following entities could know the list of the online services on which you have an account?

Row options:

- Companies

- Governments

- Friends

- Colleagues

- Employer

- Relatives

- Intimate partner

(a) Not at all concerned

(b) Slightly concerned

(c) Moderately concerned

(d) Very concerned

(e) Extremely concerned

(8) [Single Selection.] Do you use any strategy for preventing others to know about the existence of (some of) your online accounts?

(a) Yes

(b) No

(c) Not sure

[Display Q9 if Q8$=Yes]
(a) 1

(b) 2 [Display this choice if Q3$=2 or Q3$=3 or more]

(c) 3 or more [Display this choice if Q3$=3 or more]

[Display Q5 if Q4$=2 or Q4$=3 or more]

(5) [Open-ended.] Why do you register to different online services with different e-mail addresses?

[ ](text field)

(6) [Single Selection.] In the last 6 months, how many times did you use the "Sign in with ..." (e.g., Apple, Facebook, Google, Microsoft, Twitter) feature to register online accounts?

(a) 0

(b) 1–2

(c) 3–4

(d) 5–6

(e) 7+

<figure><img src="image_9.png" /></figure>

Sec. C: Privacy

(7) [Grid question. Row order randomized.] From a privacy perspective, how concerned would you be if the following entities could know the list of the online services on which you have an account?

Row options:

- Companies

- Governments

- Friends

- Colleagues

- Employer

- Relatives

- Intimate partner

(a) Not at all concerned

(b) Slightly concerned

(c) Moderately concerned

(d) Very concerned

(e) Extremely concerned

(8) [Single Selection.] Do you use any strategy for preventing others to know about the existence of (some of) your online accounts?

(a) Yes

(b) No

(c) Not sure

[Display Q9 if Q8$=Yes]
(9) [Multiple selection. Order randomized.] Please select all the strategies that you use for preventing others to know about (some of) your online accounts.

(a) Use an e-mail address that nobody knows

(b) Use a disposable e-mail address (e.g., YOPmail)

(c) Use a proxy

(d) Delete the account

(e) Connect only from a personal device (e.g., computer, smartphone, tablet)

(f) Other (please specify) - [ ][text field]

Sec. D: Phishing

<figure><img src="image_9.png" /></figure>

Please look at the screenshot above. Imagine that you received this e-mail today.

(10) [Single Selection.] How likely would you click on the link provided in this e-mail **if you do have an account** on this online service?

(a) Very unlikely

(b) Unlikely

(c) Somewhat unlikely

(d) Neutral (neither likely nor unlikely)

(e) Somewhat likely

(f) Likely

(g) Very likely

(11) [Single Selection.] How likely would you click on the link provided in this e-mail **if you do not have an account** on this online service?

(a) Very unlikely

(b) Unlikely

(c) Somewhat unlikely

(d) Neutral (neither likely nor unlikely)

(e) Somewhat likely

(f) Likely
(9) [Multiple selection. Order randomized.] Please select all the strategies that you use for preventing others to know about (some of) your online accounts.

(a) Use an e-mail address that nobody knows

(b) Use a disposable e-mail address (e.g., YOPmail)

(c) Use a proxy

(d) Delete the account

(e) Connect only from a personal device (e.g., computer, smartphone, tablet)

(f) Other (please specify) - [ ][text field]

Sec. D: Phishing

<figure><img src="image_10.png" /></figure>

Please look at the screenshot above. Imagine that you received this e-mail today.

(10) [Single Selection.] How likely would you click on the link provided in this e-mail **if you do have an account** on this online service?

(a) Very unlikely

(b) Unlikely

(c) Somewhat unlikely

(d) Neutral (neither likely nor unlikely)

(e) Somewhat likely

(f) Likely

(g) Very likely

(11) [Single Selection.] How likely would you click on the link provided in this e-mail **if you do not have an account** on this online service?

(a) Very unlikely

(b) Unlikely

(c) Somewhat unlikely

(d) Neutral (neither likely nor unlikely)

(e) Somewhat likely

(f) Likely
(g) Very likely

<figure><img src="image_10.png" /></figure>

[Display this image if Q2$!=Badoo] Please look at the screenshot above. Imagine that **you do have an account on this service** and that you received this e-mail today **even though you did not make a request to reset your password**.

[Display this image if Q2$=Badoo] Please look at the screenshot above. Imagine that you received this e-mail today **even though you did not make a request to reset your password**.

(12) [Open-ended.] In your opinion, what could have led to the sending of this e-mail?
[ )(text field)

(13) [Single selection.] Would you take any action after you have received this e-mail?

(a) No
(b) Yes (please specify) - [ )(text field)

(14) [Single Selection.] In the last 6 months, how many times did you receive an **unsolicited** e-mail similar to the one above for one of your existing accounts?

(a) 0
(b) 1-2
(c) 3-4
(d) 5-6
(e) 7+

[Display Q15 if Q4$!=1]

(15) [Single Selection.] How likely would you check whether the e-mail above was sent to the e-mail address that you have used to register your existing account?

(a) Very unlikely
(b) Unlikely
(c) Somewhat unlikely
(d) Neutral (neither likely nor unlikely)
(e) Somewhat likely
(f) Likely
(g) Very likely

<figure><img src="image_11.png" /></figure>

[Display this image if Q2$!=Badoo] Please look at the screenshot above. Imagine that **you do have an account on this service** and that you received this e-mail today **even though you did not make a request to reset your password**.

[Display this image if Q2$Badoo] Please look at the screenshot above. Imagine that you received this e-mail today **even though you did not make a request to reset your password**.

(12) [Open-ended.] In your opinion, what could have led to the sending of this e-mail?
[ )(text field)

(13) [Single selection.] Would you take any action after you have received this e-mail?

(a) No

(b) Yes (please specify) - [ )(text field)

(14) [Single Selection.] In the last 6 months, how many times did you receive an **unsolicited** e-mail similar to the one above for one of your existing accounts?

(a) 0
(b) 1-2
(c) 3-4
(d) 5-6
(e) 7+

[Display Q15 if Q4$!=1]

(15) [Single Selection.] How likely would you check whether the e-mail above was sent to the e-mail address that you have used to register your existing account?

(a) Very unlikely
(b) Unlikely
(c) Somewhat unlikely
(d) Neutral (neither likely nor unlikely)
(e) Somewhat likely
(f) Likely
(g) Very likely

<figure><img src="image_11.png" /></figure>

[Display this image if Q2$!=Pornhub] Please look at the screenshot above. Imagine that you received this e-mail today even though you did not make a request to create an account.

[Display this image if Q2$Pornhub] Please look at the screenshot above. Imagine that you do not have an account on this service and that you received this e-mail today even though you did not make a request to create an account.

(16) [Open-ended.] In your opinion, what could have led to the sending of this e-mail?
[ ](text field)

(17) [Single selection.] Would you take any action after you have received this e-mail?
(a) No
(b) Yes (please specify) - [ ](text field)

(18) [Single Selection.] In the last 6 months, how many times did you receive an **unsolicited** e-mail similar to the one above on one of your e-mail addresses?
(a) 0
(b) 1-2
(c) 3-4
(d) 5-6
(e) 7+

Sec. E: IUIPC

(19) [Grid question. Row order randomized.] Please rate the following statements.
Row options:

- All things considered, the Internet would cause serious privacy problems.

- Compared to others, I am more sensitive about the way online companies handle my personal information.

- To me, it is the most important thing to keep my privacy intact from online companies.

- I believe other people are too much concerned with online privacy issues.

- Compared with other subjects in my mind, personal privacy is very important.

- I am concerned about threats to my personal privacy today.
(g) Very likely

<figure><img src="image_12.png" /></figure>

[Display this image if Q2$!=Pornhub] Please look at the screenshot above. Imagine that you received this e-mail today even though you did not make a request to create an account.

[Display this image if Q2$Pornhub] Please look at the screenshot above. Imagine that you do not have an account on this service and that you received this e-mail today even though you did not make a request to create an account.

(16) [Open-ended.] In your opinion, what could have led to the sending of this e-mail?
[ ](text field)

(17) [Single selection.] Would you take any action after you have received this e-mail?

(a) No
(b) Yes (please specify) - [ ](text field)

(18) [Single Selection.] In the last 6 months, how many times did you receive an **unsolicited** e-mail similar to the one above on one of your e-mail addresses?

(a) 0
(b) 1-2
(c) 3-4
(d) 5-6
(e) 7+

Sec. E: IUIPC

(19) [Grid question. Row order randomized.] Please rate the following statements.
Row options:

- All things considered, the Internet would cause serious privacy problems.

- Compared to others, I am more sensitive about the way online companies handle my personal information.

- To me, it is the most important thing to keep my privacy intact from online companies.

- I believe other people are too much concerned with online privacy issues.

- Compared with other subjects in my mind, personal privacy is very important.

- I am concerned about threats to my personal privacy today.
(a) Strongly disagree

(b) Somewhat disagree

(c) Neither disagree nor agree

(d) Somewhat agree

(e) Strongly agree
(a) Strongly disagree

(b) Somewhat disagree

(c) Neither disagree nor agree

(d) Somewhat agree

(e) Strongly agree