The Emperor's New Security Indicators

We evaluate website authentication measures that are designed to protect users from man-in-the-middle, ‘phishing’, and other site forgery attacks. We asked 67 bank customers to conduct common online banking tasks. Each time they logged in, we presented increasingly alarming clues that their connection was insecure. First, we removed HTTPS indicators. Next, we removed the participant’s site-authentication image—the customer-selected image that many websites now expect their users to verify before entering their passwords. Finally, we replaced the bank’s password-entry page with a warning page. After each clue, we determined whether participants entered their passwords or withheld them. We also investigate how a study’s design affects participant behavior: we asked some participants to play a role and others to use their own accounts and passwords. We also presented some participants with security-focused instructions. We confirm prior findings that users ignore HTTPS indi...

• Type: Conference
• Year: 2007
• Where: SP
• Authors: Stuart E. Schechter, Rachna Dhamija, Andy Ozment, Ian Fischer
• Keywords: Affects Participants, HTTPS Indicators, Passwords, Security Privacy, SP 2007