Making Encryption Feel Secure: Investigating how Descriptions of Encryption Impact Perceived Security

Abstract

When communication about security to end users is ineffective, people frequently misinterpret the protection offered by a system. The discrepancy between the security users perceive a system to have and the actual system state can lead to potentially risky behaviors. It is thus crucial to understand how security perceptions are shaped by interface elements such as text-based descriptions of encryption. This article addresses the question of how encryption should be described to non-experts in a way that enhances perceived security. We tested the following within-subject variables in an online experiment (N=309): a) how to best word encryption, b) whether encryption should be described with a focus on the process or outcome, or both c) whether the objective of encryption should be mentioned d) when mentioning the objective of encryption, how to best describe it e) whether a hash should be displayed to the user. We also investigated the role of context (between subjects). The verbs "encrypt" and "secure" performed comparatively well at enhancing perceived security. Overall, participants stated that they felt more secure not knowing about the objective of encryption. When it is necessary to state the objective, positive wording of the objective of encryption worked best. We discuss implications and why using these results to design for perceived lack of security might be of interest as well. This leads us to discuss ethical concerns, and we give guidelines for the design of user interfaces where encryption should be communicated to end users.

Structural and functional explanations for informing lay and expert users: the case of functional encryption

“…Although a few participants with technical backgrounds indicated the use of terms such as 'protected' for the general public, participants with nontechnical backgrounds indicated otherwise. Our findings support recent work which shows that encryption, as a (meanwhile) wellunderstood term, is a useful privacy indicator and has outperformed other lay term descriptions [2,16]. Similar to our results, related work shows that experts may underestimate non-expert technical knowledge [24]).…”

“…Also, another recent study [16] investigating the effect of the wording of encryption on users' perceived security, reports that the technical terms "encrypt" and "secure" have outperformed lay wording "translating to secret code".…”

The Impact of Citizen Participation on Public Sentiments during Crises: Comparative Study of Estonia, Latvia, and Lithuania

“…The sense of security was measured using one statement: I feel secure living in my country. This simplified statement was used to overcome the issues related to security text-based descriptions reported in previous studies (see [38]). The statement is one of the items from the State-Trait Anxiety Inventory (STAI), which is used to measure the state of anxiety in subjects.…”