Īnderson, R., Moore, T.: The economics of information security. In: Proceedings of the Seventh Symposium on Usable Privacy and Security - SOUPS 2011, p. Maurer, M.-E., De Luca, A., Kempe, S.: Using data type based security alert dialogs to raise online security awareness. Kim, S., Wogalter, M.S.: Habituation, dishabituation, and recovery effects in visual warnings. In: Campos, P., Graham, N., Jorge, J., Nunes, N., Palanque, P., Winckler, M. īravo-Lillo, C., Cranor, L.F., Downs, J., Komanduri, S., Sleeper, M.: Improving computer security dialogs. īravo-Lillo, C., Cranor, L.F., Downs, J., Komanduri, S.: Bridging the gap in computer security warnings: a mental model approach. In: Proceedings of the 32nd Annual ACM Conference on Human Factors in Computing Systems, CHI 2014, pp.

Zhang, B., Wu, M., Kang, H., Go, E., Sundar, S.S.: Effects of security warnings and instant gratification cues on attitudes toward mobile websites. Sunshine, J., Egelman, S., Almuhimedi, H., Atri, N., Cranor, L.F.: Crying wolf: an empirical study of SSL warning effectivenes. Lawrence Erlbaum Associates, Mahwah (2006) In: Proceedings of the 1st Conference on Usability, Psychology, and Security, pp. Ĭranor, L.F.: A framework for reasoning about the human in the loop.

Laughery, K.R., Wogalter, M.S.: Designing effective warnings. In: Proceedings of the 3rd ACM Conference on Electronic Commerce, Tampa, Florida (2001)īerendt, B., Günther, O., Spiekermann, S.: Privacy in E-commerce: stated preferences vs. Spiekermann, S., Grossklags, J., Berendt, B.: E-privacy in 2nd generation E-commerce: privacy preferences versus actual behavior. 77–106 (2005)ĭhami, S.: The Foundations of Behavioral Economic Analysis. ĭijksterhuis, A., Aarts, H., Smith, P.K.: The power of the subliminal: on subliminal persuasion and other potential applications. Van den Bussche, E., Van den Noortgate, W., Reynvoet, B.: Mechanisms of masked priming: a meta-analysis. Thorpe, S.J., Fize, D., Marlot, C.: Speed of processing in the human visual system (1996). Kihlstrom, J.: The congnitive unconscious. ĭehaene, S., Changeux, J.P., Naccache, L., Sackur, J., Sergent, C.: Conscious, preconscious, and subliminal processing: a testable taxonomy. Zimmermann, M.: the nervous system in the context of information theory. Herley, C.: So long, and no thanks for the externalities: the rational rejection of security advice by users.

In: Proceedings of the 2011 Workshop on New Security Paradigms Workshop - NSPW 2011, p. In: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (2008)īöhme, R., Grossklags, J.: The security cost of cheap user interaction. Įgelman, S., Cranor, L.F., Hong, J.: You’ve been warned: an empirical study of the effectiveness of web browser phishing warnings. In: Proceedings of the Ninth Symposium on Usable Privacy and Security, SOUPS 2013, pp. 257–272 (2013)īravo-Lillo, C., et al.: Your attention please: designing security-decision UIs to make genuine risks harder to ignore. In: Proceedings of the 22nd USENIX Security Symposium, pp. Īkhawe, D., Felt, A.P.: Alice in warning land: a large-scale field study of browser security warning effectiveness. In: 2012 7th International Conference on Risks and Security of Internet and Systems (CRiSIS), pp. Can’t work? Why it’s time to rethink security warnings. Krol, K., Moroz, M., Sasse, M.A.: Don’t work. Wu, M., Miller, R.C., Garfinkel, S.L.: Do security toolbars actually prevent phishing attacks? In: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, Montréal, Québec, Canada (2006) In: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, CHI 2006, p. Keywordsĭhamija, R., Tygar, J.D., Hearst, M.: Why phishing works. When participants input their personal information, we displayed a subliminal warning message, “Privacy.” The experimental results showed that participants in the subliminal warning condition disclosed less information than those in a no-warning control condition. Thus, we first address: Do the subliminal warnings change users’ security/privacy behavior? As a proof of concept, we implemented a restaurant table reservation app. To the best of our knowledge, this is the first research attempt to use nonconscious processing for cybersecurity, but the application contexts are very different from typical cognitive science studies. Our novel idea is to harvest the power of nonconscious processing. Cognitive science reveals that perception, evaluation, and motivation can happen without conscious awareness. The human visual perception system, however, has a bandwidth of 10 M bit/s. Human conscious attention has a bandwidth of only 40 bit/s. A fundamental problem is that existing warnings compete for conscious attention.

Does subliminal perception work