Warnings (Usable Security and Privacy)

Main ideas / lessons

• Warnings are common security/privacy interfaces used to protect users from risks such as:

  • Browser phishing warnings
  • Untrusted site / SSL certificate warnings
  • Wireless security warnings when connected to an untrusted network
  • Downloads/opens from the internet where malware/viruses may be detected
  • Cases where a firewall or antivirus is missing, not running, or out of date
  • Login alerts, including messages that indicate login from a new machine
  • Pattern-based warnings, such as alerts when passwords appear to have been used on other sites

• A key concern is whether the receiver notices and understands the warning, not just whether the warning exists. The lecture emphasizes that communication can fail if users don’t grasp what to do (example: a well-intended developer message that users effectively interpret as “click to continue” after repeated warning exposure).

The 3 goals of warnings

1. Help users determine whether they are actually at risk
2. Stop users from doing something dangerous when the situation is risky
3. Avoid unnecessary interruption when the situation is not risky

Types of warnings

• Active warnings

  • Require immediate user interaction
  • Best used when:
    • The threat is high or fairly certain
    • It’s safe/possible to interrupt the user

• Passive warnings

  • Do not interrupt
  • Require no user action
  • Best used when:
    • The threat is less certain or lower risk
    • The default behavior should continue unless the user acts otherwise

Chip model: human communication / information processing view (receiver-focused)

The lecture frames warning effectiveness around the receiver’s processing, not only the sender’s intent. The receiver’s success depends on:

1. Notice

   • Do they see the indicators?
   • Can they shift attention to the warning and keep attending to it?

2. Comprehend

   • Do they understand what the indicators mean?
   • Do they believe them (e.g., think the message is legitimate)?
   • What are their attitudes/beliefs about the warning?

3. Motivation to act

   • Are they motivated to take the recommended action if needed?

4. Perform

   • Will they actually carry out the action?

Problems that can undermine warnings (explicitly listed)

1. False positives are too common → users learn to ignore warnings
2. Warnings don’t improve comprehension/judgment of risk
3. Warnings aren’t action-oriented → they need a call to action (even passive warnings are generally recommended to include some form of direction)
4. Users aren’t equipped to make good decisions (e.g., they lack understanding or tools)

Habituation / pop-up fatigue, and mitigation ideas

• Repeated exposure to warnings can lead to habituation (reduced emotional/physiological response), causing users to pay less attention over time.
• Even well-designed warnings can still experience habituation, but salient features can slow it.
• Proposed solutions to reduce habituation / improve engagement:
  • Use attractors to automate parts of messages using visual cues
  • Highlight and reveal content progressively
  • Require additional user interactions, such as:
    • Swiping
    • Typing into a field
• Goal of these changes: increase engagement with the warning.

Speakers / sources featured

• Dr. Cori Faklaris (University of North Carolina at Charlotte) — lecturer
• Wolg… Walter (2006 paper) — cited for habituation findings
  • (The subtitle appears as “Wolgalter”; likely referring to an author name in the habituation literature.)