Visible to the public Understanding the 'H' in Science of Security HCI Research: Methods and Lessons Learned from Investigations of Phishing