1. Security Indicators and Warnings

2. Agenda Goals Study Design Results Discussion Redesign Conclusion
I am going to focus on the optional paper-Emperor’s new security indicators and commentary on that paper

3. Goals Role playing Knowledge of the focus of the study
Ethical replication of real attacks
Authors were concerned with how studies are designed and what can be done to create an “ecologically valid” study. A study where users behave as they would in the real-world

4. Study Design 3 categories of participants Set of tasks
Tweaks between groups 1 and 2
Participants: role playing, role playing w/ security language in tasks, own account no security language
Tasks: first removed https warning, 2nd removed sitekey image, displayed IE7 security warning page
Group 1
Role based
Group 2
Role based w/ security context clues
Group 3
Used own accounts

5. Results Statistical differences No one noticed absent https
Missing security image not noticed
Effect of warning page
Role playing effect
Results: no difference between security primed and role playing, statistical difference between real accounts and all others
Https: not new result
Security image: 92% users w/ own account still sent login info
Warning page: 36% users still sent login info, 66% role playing

6. Discussion Problems you see? Criticism Recruiting realistic sample
Setting of study
Psychology of research participants
Weaknesses of design: paper discusses security biasing might not have been strong enough.
Given results between groups 1 and 2 maybe more subjects should be run?
Criticism of design:
recuiting eliminates privacy fundamentalists
Using a university location to conduct the study gives users trust
most interesting: research participants WANT to complete the tasks given them
demand charactaristics- participants try to guess purpose of study and validate results
task focus – users take tasks seriously and might jeopardize their security to complete the study
obedience to authority- participants see researchers as an authority figure and try to do as they are told

7. Redesign In groups redesign experiment to eliminate these problems
Other ways to ethically create “ecologically valid” study?
Ways to avoid task based studies?

8. Conclusion Study shows some important results
Users do not act the same while role playing
Users can be easily convinced to disregard current security measures
Critique of study also provides insight
Need new methods for testing security
Creating right setting for survey is difficult
Papers referenced: S. Schechter, R. Dhamija, A. Ozment, and I. Fischer. The Emperor's New Security Indicators: An evaluation of website authentication and the effect of role playing on usability studies IEEE Symposium on Security and Privacy, May 20-27, 2007, Oakland California.
Andrew Patrick's Commentary on Research on New Security Indicators .