Contextualized Web Warnings, and How They Cause Distrust

Abstract

Abstract. Current warnings in Web browsers are difficult to understand for lay users. We address this problem through more concrete warning content by contextualizing the warning -for example, taking the user's current intention into account in order to name concrete consequences. To explore the practical value of contextualization and potential obstacles, we conduct a behavioral study with 36 participants who we either confront with contextualized or with standard warning content while they solve Web browsing tasks. We also collect exploratory data in a posterior card-sorting exercise and interview. We deduce a higher understanding of the risks of proceeding from the exploratory data. Moreover, we identify conflicting effects from contextualization, including distrust in the content, and formulate recommendations for effective contextualized warning content.

Mental Models – General Introduction and Review of Their Application to Human-Centred Security

“…How do we predict user behaviour based on our understanding of their mental models? There is some research proposing different approaches, such as Blythe and Camp in [13] who model Wash's folk models [105] in software agents according to Gentner and Stevens [48] in a type similar to STRIPS [42] or in terms of causalities [10] or in terms of a graph [16]. Clearly more research is needed to consolidate the findings and generate guidelines for informing design.…”

How do non experts think about cyber attack consequences?

“…Participants then labeled each group to reflect the essence of that perceived similarity. Several studies have used similar techniques to understand how users think about various cybersecurity topics (Asgharpour et al , 2007; Bartsch et al , 2013; Jeong and Chiasson, 2020).…”

“…Nonexperts often do not fully understand warning messages (Bartsch et al , 2013; Bauer et al , 2013; Egelman et al , 2008; Kauer et al , 2012; Modic and Anderson, 2014). This is especially true when warning messages use technical terms (Bauer et al , 2013).…”

“…Researchers have offered warning message design recommendations that address the issues noted in Sections 1.1.1–1.1.3. Specifically, it is recommended that warning messages use nontechnical language (Bauer et al , 2013), describe how the cyberattack will affect the user personally (Bartsch et al , 2013; Kauer et al , 2012) and do so in a way that aligns with how the user thinks about cyberattacks (Bartsch et al , 2013). Doing so should increase the likelihood that nonexperts understand the warning message, understand the costs associated with noncompliance relative to the perceived costs of compliance and trust the warning message, which should increase compliance.…”

“…Unfortunately, we do not currently understand that very well. To date, only one study has examined how nonexperts think about cyberattack consequences (Bartsch et al , 2013) and that study concerned consequences of only one type of attack, i.e. what would happen if an attacker accessed information the participant had stored on a website.…”