Douglas Stebila

Reinforcing bad behaviour: the misuse of security indicators on popular websites

Proportion of sites which misuse security indicators.

Abstract

Before making a security or privacy decision, Internet users should evaluate several security indicators in their browser, such as the use of HTTPS (indicated via the lock icon), the domain name of the site, and information from extended validation certificates. However, studies have shown that human subjects infrequently employ these indicators, relying on other indicators that can be spoofed and convey no cryptographic assurances. We identify four simple security indicators that accurately represent security properties of the connection and then examine 125 popular websites to determine if the sites' designs result in correctly displayed security indicators during login. In the vast majority of cases, at least some security indicators are absent or suboptimal. This suggests users are becoming habituated to ignoring recommended security indicators.

Keywords: user education, security indicators, web browsers, HTTPS

Reference

Douglas Stebila. Reinforcing bad behaviour: the misuse of security indicators on popular websites. In Stephen Viller, Ben Kraal, editors, Proc. 22nd Australasian Conference on Computer-Human Interaction (OzCHI) 2010, pp. 248-251. ACM, November 2010. © ACM.

Download

Presentations

• 2011-04-26: Indiana University Bloomington School of Informatics. (PDF slides)
• 2010-11-25: OZCHI 2010. (PDF slides)

BibTeX

@inproceedings{OZCHI:Stebila10,
 	Author = {Douglas Stebila},
 	Booktitle = {Proc. 22nd Australasian Conf. on Computer-Human Interaction (OzCHI) 2010},
 	Doi = {10.1145/1952222.1952275},
 	Editor = {Stephen Viller and Ben Kraal},
 	Month = {November},
 	Pages = {248--251},
 	Publisher = {ACM},
 	Title = {Reinforcing bad behaviour: the misuse of security indicators on popular websites},
 	Year = {2010}
 }