The document summarizes a study that examined how interactions with online security interfaces can influence people's understanding of sensitive information. Researchers conducted surveys to determine what types of information should be used in an experiment about login processes and sensitive data. Two surveys involving 200 participants total identified information like social security numbers and phone numbers as consistently sensitive across contexts. The findings from the surveys informed the design of an experiment that tested how different login experiences affected people's awareness and concerns about sensitive online information.

1. Survey
Part I: the
Professor
Part II: the
Student
Survey
Interactions between Security Interfaces, Learning, and Sensitivity of Information
Lezlie España (Wisconsin Lutheran College), Rick Wash, Kami Vaniea, Emilee Rader (Michigan State University BITLab)
Purpose:
We want to understand more about online security interfaces and what people learn from them.
Specifically, do people learn that certain types of information are sensitive or non-sensitive based on the information that is
accessible via the log in process online?
Survey
One-time login: Users
logged in once to see all
content on the site
No login: Users were
automatically logged in
to the site
Sensitive: Users
logged in every time they
visited a page that
contained sensitive
information
Non-sensitive: Users
logged in every time they
visited a page that
contained non-sensitive
information
Retrieve pieces of
information about students
from the site
Log in to view different
types of information
Fill out the incomplete
student profile
Select privacy settings for
each piece of information
Intended to add an additional
measure for changes in security
awareness and privacy concerns
about sensitive informationGauge privacy concerns
about sensitive information
Set the context of a beta test
for class websites testing
functionality and usability
What constitutes sensitive information?
We conducted two sensitivity surveys to determine what types of information we should
use in the experiment:
100 subjects per survey were recruited through Amazon Mechanical Turk
Gender distribution across both surveys: 60% men, 40% women
Conditions
Context is key!
The information considered sensitive depends greatly on where that information is being shared and its
intended use within that context. Determining context played an integral part in the design of the experiment and
choosing what types of information to use in the experiment itself.
Social Networks Survey
M age: 33.5
R age: 18-65
3 parts: Facebook, LinkedIn, Other
Student Class Website Survey:
M age: 32.5
R age: 18-67
4.91
4.52 4.51
3.85 3.69 3.42 3.24 3.02
1.96 1.88
4.95
4.62 4.46
3.89
3.34
2.94 2.75 2.75
1.66 1.66
0
0.5
1
1.5
2
2.5
3
3.5
4
4.5
5
Social Security
Number
Home Address Mobile Phone
Number
E-mail Address Standardized
Test Scores
Friends Birthday Marital Status Known
Languages
Gender
SensitivityMean
Student Class Website
Survey
Social Networks Survey
Sensitivity was measured using a Likert scale from 1-5, 1
being “Not Sensitive” and 5 being “Very Sensitive”
Some information is consistent
across contexts: Social Security
Number, Mobile Phone Number, E-mail
Address
Sensitivity of information can
change over time: Phone numbers used
to be listed in the white pages but are
now considered more sensitive
Survey Findings
This material is based upon work supported by the National
Science Foundation under Grant No. CNS-1116544 and CNS-
1115926.
Experiment