Your attention please: designing security-decision UIs to make genuine risks harder to ignore
Upcoming SlideShare
Loading in...5
×
 

Your attention please: designing security-decision UIs to make genuine risks harder to ignore

on

  • 227 views

Presented at SOUPS 2013, at Newcastle, UK. ...

Presented at SOUPS 2013, at Newcastle, UK.

We designed and tested attractors for computer security dialogs: user-interface modifications used to draw users’ attention to the most important information for making decisions. Some of these modifications were purely visual, while others temporarily inhibited potentially-dangerous behaviors to redirect users’ attention to salient information. We conducted three between-subjects experiments to test the effectiveness of the attractors. In the first two experiments, we sent participants to perform a task on what appeared to be a third-party site that required installation of a browser plugin. We presented them with what appeared to be an installation dialog from their operating system. Participants who saw dialogs that employed inhibitive attractors were significantly less likely than those in the control group to ignore clues that installing this software might be harmful.

In the third experiment, we attempted to habituate participants to dialogs that they knew were part of the experiment. We used attractors to highlight a field that was of no value during habituation trials and contained critical information after the habituation period. Participants exposed to inhibitive attractors were two to three times more likely to make an informed decision than those in the control condition.

Get this paper at http://cups.cs.cmu.edu/soups/2013/program.html.

Statistics

Views

Total Views
227
Views on SlideShare
220
Embed Views
7

Actions

Likes
0
Downloads
1
Comments
0

2 Embeds 7

http://www.linkedin.com 4
https://www.linkedin.com 3

Accessibility

Upload Details

Uploaded via as Adobe PDF

Usage Rights

CC Attribution License

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

Your attention please: designing security-decision UIs to make genuine risks harder to ignore Your attention please: designing security-decision UIs to make genuine risks harder to ignore Presentation Transcript

  • CMU Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ Your attention please: Designing security-decision UIs to make genuine risks harder to ignore Cristian Bravo-Lillo, Lorrie Cranor, Julie Downs, Saranga Komanduri, Robert W. Reeder, Stuart Schechter, Manya Sleeper SOUPS 2013, July 25, Newcastle, UK
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 22 Motivation  We (technologists) have habituated users to ignore security warnings/decisions by flooding them with too many  Many security dialogs are impossible to understand  Not all security dialogs can be eliminated
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 33 Research question How can we get people to pay attention to the salient information in security decisions that really matter?
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 44 Baseline dialog
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 55 Thesis It is possible to improve attention to salient information, even under habituation
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 66 Animated Connector (AC)
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 77 Reveal
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 88 Swipe
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 99 Type
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 1010 ANSI
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 1111 11
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 1212 12
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 1313 13
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 1414 14
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 1515 15
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 1616 16
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 1717 17
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 1818 18
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 1919 19
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 2020 20
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 2121 21
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 2222 22
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 2323 23
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 2424 24 Benign condition: “Microsoft Corporation”
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 2525 25 Suspicious condition: “Miicr0s0ft Corporation”
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 2626 Experimental design “Give us your opinion about online games” Exit survey
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 2727 Experimental design  For each treatment (attractor), we ran two conditions: benign and suspicious  Each subject saw only one warning  Each subject either installed or not
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 2828 Metric and Hypothesis  Metric: Installation Rate • Benign condition most people will install→ • Suspicious condition most people will not install→  Hypothesis: • An attractor will increase the difference in installation rate between the benign condition and the suspicious condition
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 2929 Results N=2,227 participants, 28.6 years old (σ=9.3), 54% male, 75% caucasian. Top two reported occupations: ‘student’ (27%), ‘unemployed’ (17%). 23% reported having knowledge of computer programming. Benign install rate Suspicious install rate (lower is better)
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 3030 Experiment 2 with permission-granting dialog
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 3131 What happens when users become habituated to our attractors?
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 3232 Experiment 3: habituation  Research question: are attractors resilient to repeated exposure to dialogs?  Idea: • Show a dialog repeatedly to participants with field X • Ask to click on “Yes” for 5 minutes • Change the field X to Y in the middle • Check if participants notice the change
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 3333 33 Those who perform well may be rewarded with opportunities to finish the study early while still receiving their full payment.
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 3434 34
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 3535 35
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 3636 36
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 3737 37
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 3838 38
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 3939 39
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 4040 40
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 4141 Experimental design: Phases  Habituation phase: “You have dismissed N dialogs”  Test dialogs: “Press the No option below to finish this study early”
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 4242 Experimental conditions  Fixed time: 2.5 minutes  Fixed exposures: 22 times Condition Fixed time Fixed exposures Control   ANSI   AC+Delay  AC+Reveal  AC+Swipe  Swipe  Type 
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 4343 Immediate detection rate after 2.5 min/22 repetitions N=872 participants, 30.8 years old (σ=11.7), 60% male, 77% caucasian 2.5 minutes 22 repetitions
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 4444 Median delay time imposed by attractors 2.5 minutes 22 repetitions
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 4545 Conclusions  Inhibitive attractors: • Are effective at driving users' attention to dialogs • Are resilient to heavy, repeated exposure  Recent progress: • Study performance of attractors under different levels of habituation.
  • • CMU Usable Privacy and Security Laboratory • http://cups.cs.cmu.edu/ 4646 CMU Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/