Forcing Johnny to login safely: Long-term user study of forcing and training login mechanisms

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 6879 LNCS, Issue , 2011, Pages 452-471

  Herzberg, Amir ^a   Margulies, Ronen ^a  

^a BAR ILAN UNIVERSITY   (Israel)

Author keywords

[No Author keywords available]

Indexed keywords

ARTIFICIAL INTELLIGENCE; COMPUTER CRIME;

DETECTION RATES; FORCINGS; LOG-IN PAGE; LONG-TERM USER STUDIES; PHISHING ATTACKS; RESISTANCE RATE; TRAINING FUNCTION;

COMPUTERS;

EID: 80053013660     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-23822-2_25     Document Type: Conference Paper

References (21)

1. Aaron, G., Rasmussen, R.: Global Phishing Survey: Trends and Domain Name Use in 2H2009. Anti-Phishing Working Group (May 2010), http://www.antiphishing. org/reports/APWG-GlobalPhishingSurvey-2H2009.pdf
2. Adida, B.: Beamauth: two-factor web authentication with a bookmark. In: CCS 2007: Proceedings of the 14th ACM Conference on Computer and Communications Security, pp. 48-57. ACM, New York (2007)
3. Sitekey Bank of America, http://www.bankofamerica.com/privacy/index.cfm? template=sitekey
4. Cialdini, R.: Influence: Science and Practice, 5th edn. Allyn and Bacon, Boston (2008)
5. Dhamija, R., Tygar, J.D.: Why phishing works. In: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pp. 581-590. ACM Press, New York (2006)
6. Dvorkin, A.: Evaluation of the Tools for User Protection against Web Site and Electronic Mail Based Attacks. Master's thesis, Bar-Ilan University (December 2008)
7. Egelman, S., Cranor, L.F., Hong, J.: You've been warned: an empirical study of the effectiveness of web browser phishing warnings. In: CHI 2008: Proceeding of the Twenty-sixth Annual SIGCHI Conference on Human Factors in Computing Systems, pp. 1065-1074. ACM, New York (2008)
8. Herzberg, A.: Why Johnny can't surf (safely)? Attacks and defenses for web users. Computers & Security (2008)
9. Herzberg, A., Jbara, A.: Security and identification indicators for browsers against spoofing and phishing attacks. ACM Trans. Internet Techn. 8(4) (2008)
10. Herzberg, A., Margulies, R.: Long-term user study of forcing and training login mechanisms against phishing. Tech. rep., Bar Ilan University (March 2011), http://submit2.cs.biu.ac.il/WAPP/WAPP-primary.pdf
11. Karlof, C., Tygar, J.D., Wagner, D.: Conditioned-safe ceremonies and a user study of an application to web authentication. In: SOUPS 2009: Proceedings of the 5th Symposium on Usable Privacy and Security (2009)
12. Schechter, S., Dhamija, R., Ozment, A., Fischer, I.: The emperor's new security indicators. In: SP 2007: Proceedings of the 2007 IEEE Symposium on Security and Privacy, pp. 51-65. IEEE Computer Society, Washington, DC, USA (2007)
13. Schechter, S., Egelman, S., Reeder, R.W.: It's not what you know, but who you know: a social approach to last-resort authentication. In: CHI 2009: Proceedings of the 27th International Conference on Human Factors in Computing Systems, pp. 1983-1992. ACM, New York (2009)
14. Sotirakopoulos, A., Hawkey, K., Beznosov, K.: "i did it because i trusted you": Challenges with the study environment biasing participant behaviours. In: SOUPS User Workshop (2010)
15. Wu, M., Miller, R.C., Garfinkel, S.L.: Do security toolbars actually prevent phishing attacks? In: CHI 2006: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pp. 601-610. ACM, New York (2006)
16. Better website identification and extended validation certificates in ie7 and other browsers (November 2005), published in Microsoft Developer Network's IEBlog http://blogs.msdn.com/b/ie/archive/2005/11/21/495507.aspx
17. Yahoo: What is a sign-in seal?, http://security.yahoo.com/article.html? aid=2006102507
18. Yee, K.-P., Sitaker, K.: Passpet: convenient password management and phishing protection. In: SOUPS 2006: Proceedings of the Second Symposium on Usable Privacy and Security, pp. 32-43. ACM, New York (2006)
19. Gartner survey shows phishing attacks escalated in 2007 more than $3 billion lost to these attacks (2007), http://www.gartner.com/it/page. jsp?id=565125
20. Gartner says number of phishing attacks on u.s. consumers increased 40 percent in 2008 (2008), http://www.gartner.com/it/page.jsp?id=565125
21. Mcafee siteadvisor (2009), http://www.siteadvisor.com/