Annika Selzer is leading a research group for information law and interdisciplinary research at the Fraunhofer-Institute for Secure Information Technology SIT in Darmstadt (Germany); Daniel Woods is Post-Doc at the Security and Privacy Lab of the University of Innsbruck (Austria); Rainer Böhme is a Principal Investigator at the University of Münster (Germany) and a professor in the faculty of computer science and leads the Security and Privacy Lab of the University of Innsbruck (Austria). This research work has been funded by the German Federal Ministry of Education and Research and the Hessian Ministry of Higher Education, Research, Science and the Arts within their joint support of the National Research Center for Applied Cybersecurity ATHENE and by the German Federal Ministry of Education and Research within the project Edumida (16KIS1361K & 16KIS1363). Daniel Woods is funded by the European Commission’s call H2020-MSCA-IF-2019 under grant number 894700. This paper was written during a two-month research stay at the Security and Privacy Lab of the University of Innsbruck in 2020. The author Annika Selzer thanks Rainer Böhme and the entire team of the Security and Privacy Lab for making this research stay possible.