The emperor's new security indicators an evaluation of website authentication and the effect of role playing on usability studies

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2007, Pages 51-65

  Schechter, Stuart E ^a   Dhamija, Rachna ^b   Ozment, Andy ^c   Fischer, Ian ^b  

^a MIT LINCOLN LABORATORY   (United States)

^b HARVARD UNIVERSITY   (United States)

^c UNIVERSITY OF CAMBRIDGE   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

AUTHENTICATION; FINANCIAL DATA PROCESSING; HTTP; IMAGE ANALYSIS; INTERFACES (COMPUTER); ONLINE SYSTEMS; WEBSITES;

SECURITY INDICATORS;

SECURITY SYSTEMS;

EID: 34548786769     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2007.35     Document Type: Conference Paper

References (25)

1. F. Arshad and R. Reeder. Symposium On Usable Privacy and Security Conference Report-When User Studies Attack: Evaluating Security by Intentionally Attacking Users, http://cups.cs.cmu.edu/soups/2005/ SOUPS_2005_Conference_Report.html, 2005.
2. Bank of America. SiteKey Frequently Asked Questions, http://www. bankofamerica.com/Onlinebanking/index.cfm?template= site.key. Downloaded and archived on November 1, 2006.
3. Bank of America. SiteKey: Online Banking Security. http://www. bankofamerica.com/privacy/sitekey/. Downloaded and archived on November 1, 2006.
4. M. B. Brewer. Research Design and Issues of Validity. In H. T. Reis and C. M. Judd, editors, Handbook of Research Methods in Social and Personality Psychology, pages 3-16. Cambridge University Press, Mar. 28 2000.
5. C. Corley. 'Phishing' Experiment Attracts National Debate about Ethics of Study, http://www.idsnews.com/news/story.aspx?id=29791, Apr. 28, 2005.
6. R. Dhamija, J. Tygar, and M. Hearst. Why Phishing Works. In Human Factors in Computing Systems (CHI 2006), Quebec, Canada, Apr. 22-27, 2006.
7. R. Franco. Better Website Identification and Extended Validation Certificates in IE7 and Other Browsers. http://blogs.msdn.com/ie/archive/2005/ 11/21/495507.aspx, Nov. 21, 2005.
8. S. L. Garfinkel and R. C. Miller. Johnny 2: A User Test of Key Continuity Management with S/MIME and Outlook Express. In Proceedings of the Symposium On Usable Privacy and Security (SOUPS), Pittsburgh, PA, USA, July 6-8 2005.
9. S. Hartman. IETF Internet-Draft: Requirements for Web Authentication Resistant to Phishing. http://www.ietf.org/internet-drafts/draft-hartman- webauth-phishing-02.txt, Oct. 21, 2006.
10. ING DIRECT USA. Privacy FAQs, https://home.ingdirect.com/privacy/privacy. security.asp?s=newsecurityfeature. Downloaded and archived on November 1, 2006.
11. T. Jagatic, N. Johnson, M. Jakobsson, and F. Menczer. Social Phishing. Communications of the ACM, To Appear.
12. Markus Jakobsson and Jacob Ratkiewicz. Designing ethical phishing experiments: a study of (ROT13) rOnl query features. In Proceedings of the 15th international conference on World Wide Web (WWW '06, pages 513-522, New York, NY, USA, 2006. ACM Press.
13. Proposed User Studies, Security User Studies Workshop, Symposium On Usable Privacy and Security. http://cups.cs.cmu.edu/soups/2006/user.study. proposals.pdf, July 2006.
14. G. Staikos. Web Browser Developers Work Together on Security. http://dot.kde.org/1132619164/, Nov. 2005.
15. United States Federal Financial Institutions Examination Council (FFIEC). Authentication in an Internet Banking Environment. http://www.ffiec.gov/pdf/ authentication.guidance.pdf, Oct. 2005.
16. Harvard University. Efficacy of Web Browser Warnings and Notices, Protocol Number F13264-102, Sept. 2006.
17. Massachusetts Institute of Technology. Efficacy of Web Browser Warnings and Notices, Protocol Number 0512001551, Sept. 2006.
18. T. Vanguard Group, Inc. Enhanced Logon FAQs. https://flagship.vanguard. com/VGApp/hnw/content/UtilityBar/SiteHelp/SiteHelp/SecurityLogonFAQsContent.jsp. Downloaded and archived on November 1, 2006.
19. W3C. Web Security Context - Working Group Charter. http://www.w3.org/ 2005/Security/wsc-charter, Sept. 7, 2006.
20. T. Whalen and K. Inkpen. Gathering Evidence: Use of Visual Security Cues in Web Browsing. In Graphics Interface 2005, 2005.
21. A. Whitten and J. D. Tygar. Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0. In Proceedings of the 8th USENIX Security Symposium, pages 169-184, Washington, DC, Aug. 23-26, 1999.
22. M. Wu, R. C. Miller, and S. Garfinkel. Do Security Toolbars Actually Prevent Phishing Attacks? In Human Factors in Computing Systems (CHI 2006), Quebec, Canada, Apr. 22-27, 2006.
23. Yahoo! Inc. What is a sign-in seal? - Yahoo! Account Security, http://help.yahoo.com/1/us/yahoo/security/phishing/phishing-110140.html,2006. Downloaded and archived on November 1, 2006.
24. Yahoo! Inc. Yahoo! Personalized Sign-In Seal, https://protect.login. yahoo.com/,2006.
25. J. Youll. Fraud Vulnerabilities in SiteKey Security at Bank of America. Technical report, Challenge/Response, LLC, July 18, 2006. http://cr-labs.com/ publications/SiteKey-20060718.pdf.