I Think They're Trying to Tell Me Something: Advice Sources and Selection for Digital Security

Redmiles, Elissa M.; Malone, Amelia R.; Mazurek, Michelle L.

doi:10.1109/sp.2016.24

Cited by 65 publications

(47 citation statements)

References 37 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…He thought that he knew what had happened to his account, "I thought it had been hacked" but wanted to see if "any of my friends had experienced this, before doing something" (Figure 4 shows his incident timeline). In contrast, prior work on support sources for digital security or Internet use shows that people often get advice about digital security through both informal (family, friends) and formal sources (librarians, workplace IT staff, paid support staff) [41]- [44]. However, none of our participants sought information from a formal source and only three mentioned consulting a particular friend or family member because they were an expert.…”

Section: Incident-response Information Seekingcontrasting

confidence: 59%

“…However, none of our participants sought information from a formal source and only three mentioned consulting a particular friend or family member because they were an expert. Additionally, again in contrast to prior work [41], participants did not mention evaluating the information they received (either from people or from online sources) for quality. In the moment of incident response, users may be searching urgently for information, preoccupied with concern for their account rather than concern about the legitimacy of information they find: IN14 says, "I tried to find it online.…”

Section: Incident-response Information Seekingmentioning

confidence: 95%

“…Prior work has explored how best to design warning messages and phishing trainings to keep users away from dangers [1]- [11]. Other work has examined how people learn security behaviors from stories of negative experiences [12]- [14], and yet other work has theoretically explored users' mental models of warnings or security [15]- [19]. In these works, researchers typically simulate an attack in the lab, ask people to consider a theoretical scenario, or ask them to reflect on experiences that may have occurred in the distant past.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

"Should I Worry?" A Cross-Cultural Examination of Account Security Incident Response

Redmiles

2019

2019 IEEE Symposium on Security and Privacy (SP)

Self Cite

View full text Add to dashboard Cite

Digital security technology is able to identify and prevent many threats to users accounts. However, some threats remain that, to provide reliable security, require human intervention: e.g., through users paying attention to warning messages or completing secondary authentication procedures. While prior work has broadly explored people's mental models of digital security threats, we know little about users' precise, in-themoment response process to in-the-wild threats. In this work, we conduct a series of qualitative interviews (n=67) with users who had recently experienced suspicious login incidents on their real Facebook accounts in order to explore this process of account security incident response. We find a common process across participants from five countries -with differing online and offline cultures -allowing us to identify areas for future technical development to best support user security. We provide additional insights on the unique nature of incident-response information seeking, known attacker threat models, and lessons learned from a large, cross-cultural qualitative study of digital security.

show abstract

Section: Incident-response Information Seekingcontrasting

confidence: 59%

Section: Incident-response Information Seekingmentioning

confidence: 95%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

"Should I Worry?" A Cross-Cultural Examination of Account Security Incident Response

Redmiles

2019

2019 IEEE Symposium on Security and Privacy (SP)

Self Cite

View full text Add to dashboard Cite

show abstract

“…The independent variables were the notification, all covariates used in Study 1 (the respondent's age range, gender, education level, and technical background), whether the respondent had ever been notified that their information was exposed in a data breach and whether the respondent had experienced unauthorized access to an online account. These final two variables are proxies for prior experience with breaches [47,49]. All independent variables were treated as categorical.…”

Section: Analysis Methods and Metricsmentioning

confidence: 99%

"What was that site doing with my Facebook password?"

Golla

Wei

Hainline

et al. 2018

Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Password reuse is widespread, so a breach of one provider's password database threatens accounts on other providers. When companies find stolen credentials on the black market and notice potential password reuse, they may require a password reset and send affected users a notification. Through two user studies, we provide insight into such notifications. In Study 1, 180 respondents saw one of six representative notifications used by companies in situations potentially involving password reuse. Respondents answered questions about their reactions and understanding of the situation. Notifications differed in the concern they elicited and intended actions they inspired. Concerningly, less than a third of respondents reported intentions to change any passwords. In Study 2, 588 respondents saw one of 15 variations on a model notification synthesizing results from Study 1. While the variations' impact differed in small ways, respondents' intended actions across all notifications would leave them vulnerable to future password-reuse attacks. We discuss best practices for password-reuse notifications and how notifications alone appear insufficient in solving password reuse.

show abstract

“…Additionally, participants' advice sources and methods for managing their devices also hint at their ability (be it actual or perceived). Eight of our participants relied on family and/or friends to help them manage computer security; prior work has found that family or friends may be more heavily utilized advice sources among those users with lower skill or resources [25], [26].…”

Section: B Abilitiesmentioning

confidence: 99%

Security When it is Welcome: Exploring Device Purchase as an Opportune Moment for Security Behavior Change

Parkin¹,

Redmiles²,

Coventry³

et al. 2019

Proceedings 2019 Workshop on Usable Security

Self Cite

View full text Add to dashboard Cite

Many security experts bemoan that consumers behave insecurely. Yet, current approaches to improving behavior either fail to consider when people may be most receptive to an intervention, or only consider experiences of threat (e.g., getting hacked) when identifying opportune moments for behavior change. We instead explore how an exemplar, positive experience-buying a new device-can serve as a "security trigger moment". Through in-situ interviews with customers (n=85) and sales staff (n=21) across four branches of a major UK retailer, we characterise the potential for behavior change during device purchase. Further, rather than assuming that users are always ready for an intervention, we explore how the abilities and motivations of users and sales staff can influence the power of a security trigger moment to drive behavior change. Our work lays the foundation for identifying additional trigger moments and deploying targeted interventions when they are most welcome.

show abstract

I Think They're Trying to Tell Me Something: Advice Sources and Selection for Digital Security

Cited by 65 publications

References 37 publications

"Should I Worry?" A Cross-Cultural Examination of Account Security Incident Response

"Should I Worry?" A Cross-Cultural Examination of Account Security Incident Response

"What was that site doing with my Facebook password?"

Security When it is Welcome: Exploring Device Purchase as an Opportune Moment for Security Behavior Change

Contact Info

Product

Resources

About