Improving Computer Security Dialogs

Abstract

Abstract. Security dialogs warn users about security threats on their computers; however, people often ignore these important communications. This paper explores the links between warning dialog design and user understanding of, motivation to respond to, and actual response to computer security warnings. We measured these variables through a 733-participant online study that tested a set of four existing computer security warnings and two redesigned versions of each across low-and high-risk conditions. In some cases our redesigned warnings significantly increased participants' understanding and motivation to take the safest action; however, we were not able to show that participants' responses were differentiated between low and high risk conditions. We also observed that motivation seemed to be a more important predictor of taking the safest action than understanding. However, other factors that may contribute to this behavior warrant further investigation.

Deterrent Effects of Warnings on Users Behavior in Preventing Malicious Software Use

“…All three textual elements are based on past studies which used the same or similar textual content in various contexts [9,17,22,30]. For instance, Maimon, Alper, Sobesto and Cukier [22] used similar content to inform hackers about risks they incur if they penetrate organizational systems.…”

“…Past research has tried to better understand how users interact with warnings and why users ignore them [9][10][11][12][13]. Mostly the focus was on examining the SSL web browser warning messages and their effectiveness [e.g.…”

More Harm Than Good? How Messages That Interrupt Can Make Us Vulnerable

“…Yee argues that "interrupting users with prompts presents security decisions in a terrible context: it teaches users that security issues obstruct their main task and trains them to dismiss prompts quickly and carelessly" (Yee 2004, p. 49). Bravo-Lillo et al (2011) suggest that interruptive security warnings are often ignored or suboptimally addressed because users have a limited cognitive ability to switch between tasks. Patil et al (2015) found that interruptive privacy notices on mobile devices are poorly attended to.…”

Contextualized Web Warnings, and How They Cause Distrust

“…Bravo-Lillo et al [6] showed empirically that warnings are not understoodfor example, due to technical terminology. Improved warning content may help, though: Biddle et al [5] found that their reformulated warnings made users more responsive to different levels of connection security.…”

“…on certificate warnings: Sunshine et al [19]) have shown that current warnings are ineffective at influencing the behavior of users for two main reasons: First, because of habituation effects from the frequent unhelpful warnings in non-critical situations [2]. Second, because of the technical language that prevents users from understanding the risks of proceeding -that is, how likely it is that an adverse event occurs and what the personal consequences are [6,8,13]. We thus not only need to prevent the occurrence of warnings in uncritical situations, but also make the warnings understandable so that the infrequent warnings will enable users to take informed decisions about proceeding based on the actual risks involved.…”