We may rely on computers, but we don’t notice what they’re telling us about online threats. Google recently had to redesign the security warnings in its Chrome web browser because most people were ignoring them. What’s even more worrying is that our brains may be hardwired to do so.
Like most browsers, when Chrome visits a web site it checks the site’s online proof of identity, called an SSL certificate. This certificate come from a third party authority, which performs a background check on the site before issuing it.
Checking PayPal’s certificate ensures that you’re visiting the right PayPal, rather than a fake version created by scammers. If something looks wrong, the browser warns the user about it.
Unfortunately, fewer than one in four Chrome users follow these warnings, found its development team, which published the results in a paper recently. Given that more than one in ten users surf the web with Chrome, that’s a frightening statistic.
The problem goes beyond mere SSL certificate warnings, say experts. Many people seem to ignore more or less everything that their computers warn them about.
“When you’re posting on an online social network, you need to make a decision about to whom your post will be visible,” explains Lujo Bauer, an associate research professor at Carnegie Mellon University’s Cylab security research centre. “It’s not a warning, but it’s a security-related configuration choice that you have to make at that moment.”
So, why is it so difficult for users to follow simple security and privacy messages? Maybe it’s because they’re not that simple.
Often, warnings describe what the problem is (“this site’s SSL certificate has expired!”) rather than what the consequences of continuing might be (“if you visit this site, it might infect your computer with malware that steals your bank details!”).
Lujo co-authored a paper on effective warning design that featured several key guidelines. They included describing the risk comprehensively, being concise, and offering meaningful choices about how to proceed.
Google’s team reached similar conclusions. They stripped out the technical terms (most users don’t know what a certificate is, they found), and reduced the reading level by simplifying the text. That included making the text as brief as possible, even if it meant sacrificing detail.
The Chrome developers also added illustrations to suggest danger, and started using background colours to represent different kinds and severity of threat.
Giving your browser an opinion
Perhaps the most significant design element that the team introduced was the use of ”opinionated design”. Instead of presenting evenly-balanced choices to the user, opinionated browsers can decide what the safest choice is and steer users towards it. They can highlight that choice by making the button bigger or bolder, perhaps, or even hiding unsafe choices behind one or more screens.
Making browsers more opinionated is an important design choice, says Andreas Gal, chief technology officer at Mozilla, which created the Firefox browser. “Even though we prefer that the user decides things, in some cases, it simply doesn’t make sense. It’s simply impossible to explain something as complex as cryptography to many users,” he says. “You start making specific recommendations or judgements for the user.”
This is an important weapon against one of the biggest challenges for security usability, said Raluca Budiu, senior researcher at usability consulting firm Nielsen Norman Group. She explains that the user makes a cost-benefit analysis when deciding whether to dismiss a warning.
“The immediate cost of heeding the warning is high, because I will not be able to achieve my immediate goal, which is to reach the site and complete the bill payment or the status update that I had in mind,” she says. “The immediate benefit is low and abstract. The chance of my information being stolen is smaller if I heed the warning, but that does not really change or improve in any way my current state.”
In short, users will prioritise immediate gain, and tend to dismiss consequences with no immediate visible effect.
Building an opinionated browser certainly helped Chrome’s design team. After testing the new warning design, users didn’t really understand the warnings much more, but they did follow them: the adherence rate climbed to 62%.
Still, that means that almost four in every ten Chrome users still fail to heed these warnings. Why? One of the most worrying answers is that we’re simply designed that way.
Hardwired not to notice
Anthony Vance, assistant professor of information systems at Utah’s Brigham Young University, works in the neurosecurity lab there. The lab spends its time exploring how the brain interacts with cybersecurity issues. His team put test subjects in a magnetic resonance imaging machine to see what happened inside their brains when faced with software security warnings.
“We used a variety of 40 different warnings – common ones of all kinds, like anti-virus warnings, software updates, and SSL warnings from browsers of all kinds,” says Vance. The results showed that the visual processing part of the brain stopped analysing the warnings after seeing them more than once.
This is a concept that he calls “habituation” – in short, people stop paying attention to warnings, the more they see them, and Vance says there’s a biological reason for it. “The first time that your brain experiences a stimulus, it devotes attention to it, but then for subsequent exposures, it relies on memory, and the response is far less,” he says.
When you walk into your room for the hundredth time, you’re not really looking at your wallpaper Vance explains. Instead, your brain is painting a picture of it for you from memory. This leaves your brain free to focus on other things.
That’s fine for wallpaper that doesn’t change, but it’s problematic for computer warnings which may change frequently and present different information. “Some people think that users are lazy and inattentive,” says Vance, “but this is simply fundamental to our own biology.”
Bauer’s design guidelines suggest consistency in warnings to make them more understandable for the user. Paradoxically, Vance’s research suggests the opposite. He tried to make polymorphic warnings, which are inconsistent, to keep the brain engaged.
Switching colours, adding images randomly and including animated graphics are all ways to stop the brain relying on memory and persuading it to pay attention, he said. One of the most successful polymorphic warnings in his test even jiggled slightly.
Who needs users, anyway?
There are other solutions, according to Sigbørn Vik, who works in the security group at browser developer Opera. In some cases, developers can make habituation work positively for them.
“What does work is using habituation positively,” he said. “That means getting users to expect a certain pattern.” That could be checking for certain ambient indicators that suggest a site is valid – and noticing when they’re not displayed.
Others suggest just cutting the user out of the equation altogether. Melih Abdulhayoglu is founder and chief executive of Comodo, a company that both issues digital certificates and also sells anti-virus software. “The technology must solve the problem by making the decision on behalf of the user, and not interrupting them,” he said.
Like many anti-virus systems, Comodo’s software uses blacklists to filter out known bad software. It also checks for software signed with digital certificates to help determine if it’s known and trusted. If it can’t classify software as good or bad, it runs it in a container, designed to limit the effect of the software on the system. That stops the software having to interrupt the user with prompts, he concluded.
Deciding for the user isn’t possible 100% of the time, though, across every application, says Candid Wueest, principal threat researcher at Symantec. His company also tries to make as many decisions for the user as possible, but there may be some decisions where it might be necessary to ask the user about it, he warned.
“It might be something the user actually wants to do, like changing the user’s home page in the browser,” Wueest said, arguing that both spyware and legitimate software sometimes tries to do this, as do users, manually.
Browser vendors must be particularly careful here. There will also always be an expert that wants to override a browser warning for good reason, and if a browser is too prohibitive, users may simply use a competitor’s software instead.
“We want people to be safe by default when using Chrome, but we also want to give people control over their browsing experience,” the Chrome development team told the Guardian in a statement. Users can still override warnings in the browser.
Smaller screens and more complex choices
This is a big enough problem on desktop browsers, but the stakes increase as devices get smaller, and choices become more complex. “Now with gadgets that collect lots of data, we have to make decisions about who to share it with,” said Bauer.
Android applications often ask users to give them permissions for everything from contact info through to control of their phone, for example. How many of us take notice, and how many simply click ”ok” so that we can get on with the task in hand?
Mozilla has tried to mitigate this problem by making mobile apps ask for permissions when they’re about to carry out a task, rather than when they’re installed. Gal calls this ”pay as you go security”.
All of these approaches may get us closer to waking users up, but nothing trumps good old-fashioned education, says David Emm, principal security researcher at security software vendor Kaspersky Lab. Browser vendors can redesign warnings all they want, he said, “but if this is done in isolation and if there’s no wider learning context for it, this will always be much less effective”.
What we need is a drip-fed online safety education, akin to the drink-driving road safety campaigns of the past, Emm warns. He believes that drumming online safety into people repeatedly is a vital component.
We all remember the road safety slogans of the past. “Think once. Think twice. Think bike,” was one. “Clunk click with every trip” graced our TV screens for years. But somehow, “use caution when visiting sites with apparent SSL certificate disparities” doesn’t roll off the tongue. Anyone got any better ideas?
