Users’ interactions with and expectations of technology often differ from assumptions held by developers and security experts. This is especially notable when designers assume that only one user is involved with a given system, when in reality there are multiple users and stakeholders. Our first instinct as security experts may be to discourage this behavior, whether it be advising users to better secure their devices or admonishing any kind of credential sharing altogether. However, users will continue to engage in these ``insecure'' behaviors for a wide variety of reasons rational and important to them. Rather than attempt to fit users into frameworks that are not aligned with their actual behavior and goals, my thesis focuses on understanding how users' motivations and behaviors around privacy and security differ from traditional assumptions in these multi-user environments and ways design and advice can be improved to take these realities into account.

First, to better understand how do users' perceptions and lived experiences differ from traditional assumptions related to security and privacy, I conducted a series of surveys with smart home device owners and users. I find that that owners of smart home devices often face casual, unauthorized use of their devices by people within their close social network, and their perceptions of what constitutes appropriate and inappropriate device use often differs from what we would expect. I then examine how users, when going against popular security advice and convention, create shared passwords in multi-user settings. I find that despite the shared nature of these passwords, these passwords are primarily create non-collaboratively. Finally, I examine ways in which a technological intervention, password managers, falls short in the space of password sharing. I highlight ways in which users' lived realities need to be taken into account when designing systems and solutions, especially when there are multiple users and stakeholders involved.