The Importance of Being Earnest [In Security Warnings]
The Importance of Being Earnest [In Security Warnings]
复制标题
认真的重要性[安全警告]
DOI：
--
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
Stuart E. Schechter
中科院分区：
文献类型：
--
作者：
Serge Egelman;Stuart E. Schechter
为了应对网络钓鱼的威胁，当用户到达可疑的网络钓鱼网站时，网络浏览器会显示警告。之前的研究已经为改善这些警告提供了指导。我们进行了一项实验室研究，以调查警告和描述建议操作过程的文本中背景颜色的选择如何影响用户遵守警告的决定。我们没有向参与者透露研究的主题是警告，然后我们观察了他们对模拟网络钓鱼攻击的反应。我们发现文本和背景颜色都对参与者查看警告的时间有显著影响，然而，我们没有观察到他们最终遵守警告的决定有显著差异。尽管结果为空，但我们的出口调查数据表明，对威胁模型的误解导致参与者认为警告不适用于他们。出于有限理性，参与者做出了认真的决定，无视这些警告。我们的结论是，当警告没有正确地匹配用户的风险感知时，用户可能会在不知不觉中承担本可避免的风险。
In response to the threat of phishing, web browsers display warnings when users arrive at suspected phishing websites. Previous research has offered guidance to improve these warnings. We performed a laboratory study to investigate how the choice of background color in the warning and the text describing the recommended course of action impact a user’s decision to comply with the warning. We did not reveal to participants that the subject of the study was the warning, and then we observed as they responded to a simulated phishing attack. We found that both the text and background color had a significant effect on the amount of time participants spent viewing a warning, however, we observed no significant differences with regard to their decisions to ultimately obey that warning. Despite this null result, our exit survey data suggest that misunderstandings about the threat model led participants to believe that the warnings did not apply to them. Acting out of bounded rationality, participants made conscientious decisions to ignore the warnings. We conclude that when warnings do not correctly align users’ risk perceptions, users may unwittingly take avoidable risks.