Search

Objective: The goal of this study was to examine the relation between users' reported risk concerns and their choice behaviors in a mobile application (app) selection task. Background: Human users are typically regarded as the weakest link in cybersecurity and privacy protection; however, it is possible to leverage the users' predilections to increase security. There have been mixed results on the relation between users' self-reported privacy concerns and their behaviors. Method: In three experiments, the timing of self-reported risk concerns was either a few weeks before the app-selection task (pre-screen), immediately before it (pre-task), or immediately after it (post-task). We also varied the availability and placement of clear definitions and quizzes to ensure users' understanding of the risk categories. Results: The post-task report significantly predicted the app-selection behaviors, consistent with prior findings. The pre-screen report was largely inconsistent with the reports implemented around the time of the task, indicating that participants' risk concerns may not be stable over time and across contexts. Moreover, the pre-task report strongly predicted the app-selection behaviors only when elaborated definitions and quizzes were placed before the pre-task question, indicating the importance of clear understanding of the risk categories. Conclusion: Self-reported risk concerns may be unstable over time and across contexts. When explained with clear definitions, self-reported risk concerns obtained immediately before or after the app-selection task significantly predicted app-selection behaviors. Application: We discuss implications for including personalized risk concerns during app selection that enable comparison of alternative mobile apps. [ABSTRACT FROM AUTHOR]

People encouraged to think about their survival when encoding information experience a memory advantage even when compared to other tried-and-true methods. Despite the evidence in support of the survival-processing advantage, how this advantage might apply to current-day issues has received little attention. This study aimed to determine if password generation strategies modified to encourage fitness-related encoding would yield an additional benefit in password recall. Participants recruited from online and college samples generated passwords using a sentence-based mnemonic (pilot experiment and Experiment 1) or person-action-object strategy (Experiments 2 and 3), in survival or control scenarios. Results support the plausibility of implementing different strategies for password generation, particularly the person-action-object strategy, and the importance of providing users instructions with which to create their passwords. Although the results illustrated the value of using scenarios for password creation, they did not show evidence of an additional fitness-related benefit, for possible reasons that we discuss. [ABSTRACT FROM AUTHOR]

Objective: Evaluate the effectiveness of training embedded within security warnings to identify phishing webpages.Background: More than 20 million malware and phishing warnings are shown to users of Google Safe Browsing every week. Substantial click-through rate is still evident, and a common issue reported is that users lack understanding of the warnings. Nevertheless, each warning provides an opportunity to train users about phishing and how to avoid phishing attacks.Method: To test use of phishing-warning instances as opportunities to train users' phishing webpage detection skills, we conducted an online experiment contrasting the effectiveness of the current Chrome phishing warning with two training-embedded warning interfaces. The experiment consisted of three phases. In Phase 1, participants made login decisions on 10 webpages with the aid of warning. After a distracting task, participants made legitimacy judgments for 10 different login webpages without warnings in Phase 2. To test the long-term effect of the training, participants were invited back a week later to participate in Phase 3, which was conducted similarly as Phase 2.Results: Participants differentiated legitimate and fraudulent webpages better than chance. Performance was similar for all interfaces in Phase 1 for which the warning aid was present. However, training-embedded interfaces provided better protection than the Chrome phishing warning on both subsequent phases.Conclusion: Embedded training is a complementary strategy to compensate for lack of phishing webpage detection skill when phishing warning is absent.Application: Potential applications include development of training-embedded warnings to enable security training at scale. [ABSTRACT FROM AUTHOR]

Objective: To evaluate the effectiveness of domain highlighting in helping users identify whether Web pages are legitimate or spurious.Background: As a component of the URL, a domain name can be overlooked. Consequently, browsers highlight the domain name to help users identify which Web site they are visiting. Nevertheless, few studies have assessed the effectiveness of domain highlighting, and the only formal study confounded highlighting with instructions to look at the address bar.Method: We conducted two phishing detection experiments. Experiment 1 was run online: Participants judged the legitimacy of Web pages in two phases. In Phase 1, participants were to judge the legitimacy based on any information on the Web page, whereas in Phase 2, they were to focus on the address bar. Whether the domain was highlighted was also varied. Experiment 2 was conducted similarly but with participants in a laboratory setting, which allowed tracking of fixations.Results: Participants differentiated the legitimate and fraudulent Web pages better than chance. There was some benefit of attending to the address bar, but domain highlighting did not provide effective protection against phishing attacks. Analysis of eye-gaze fixation measures was in agreement with the task performance, but heat-map results revealed that participants' visual attention was attracted by the highlighted domains.Conclusion: Failure to detect many fraudulent Web pages even when the domain was highlighted implies that users lacked knowledge of Web page security cues or how to use those cues.Application: Potential applications include development of phishing prevention training incorporating domain highlighting with other methods to help users identify phishing Web pages. [ABSTRACT FROM AUTHOR]