I never reuse passwords! Development and Validation of a Security and Privacy Social Desirability Scale (SP-SDS) for end users without a background in computer science

Social desirability bias can be a problem in human-subjects research, if participants give answers they believe researchers want to hear, instead of their true opinion. This is especially concerning for sensitive topics, which are prevalent in Usable Security and Privacy (USP) research, e.g. when asking users about their security habits, experiences of digital abuse or opinions on surveillance. While validated scales measuring general social desirability bias exist, it is unclear how applicable they are in USP. Besides the jarring context switch, it is uncertain how well social desirability of security and privacy related behavior matches general social desirability. To address this, we developed and validated a 13-item security and privacy-specific social desirability scale (SP-SDS), (total N=1167). A correlation of τ = .43 between SP-SDS and the established Marlowe-Crowne SDS confirms that social desirability bias in USP is related to, but distinct from, general social desirability bias. Based on our validated scale we conducted a study with a representative US-sample (N=867) for participants without a CS-background, to measure the perception of social desirability for the behaviors contained in the SP-SDS and to create a baseline for comparison with other samples. Finally, we make recommendations for using SP-SDS in USP studies.