Risk
7/15/2013
01:45 PM
50%
50%

Chrome Users More Likely To Ignore Security Warnings

Security messages affect user behavior -- as long as they're well-designed, according to study of Chrome and Firefox users.

9 Android Apps To Improve Security, Privacy
9 Android Apps To Improve Security, Privacy
(click image for larger view)
Chrome browser users: Are you feeling invulnerable?

That question seems pertinent after a new study that compared people's reactions to 25 million security warning messages found a curious difference between users of two different types of browsers. Specifically, users continued through 25% of Google Chrome's malware and phishing warnings, but only 10% of equivalent warnings from Mozilla Firefox. Similarly, users clicked through Chrome's SSL warning a whopping 70% of the time, versus only 33% for Firefox.

Those findings were detailed in "Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness,", a research paper written by Devdatta Akhawe, a computer science graduate student at the University of California, Berkeley, who recently collaborated on a study to assess the value of bug bounty programs; and Adrienne Porter Felt, who earned her Ph.D. from Berkeley last year and is now a Google research scientist at Google, focusing on Chrome security and privacy problems. Their research is due to be presented at next month's USENIX Security Symposium in Washington.

[ Amazon 1Button extension for Chrome reports user activity back to Amazon. Read more at Jay-Z App, Amazon Extension Slammed On Privacy. ]

The researchers said they gathered their data via Mozilla Firefox and Google Chrome's in-browser telemetry -- which users can enable to share anonymous performance data with the respective browser manufacturers -- which allowed them to observe over 25 million warning impressions in situ. The researchers emphasized, however, that at no time did they have access to personally identifiable information.

The discovery that users react to Chrome and Firefox's warning messages in different ways is good and bad news. The upside is that "security warnings can be effective in practice," the researchers note, and that "the user experience of a warning can have a significant impact on user behavior." That seems to refute the notion that many users simply dismiss warnings and can't be relied on to parse security-related details and come to a safe browsing decision. Or as noted by the authors of Securing Java, in a quotation cited by the "Warningland" report's authors: "Given a choice between dancing pigs and security, the user will pick dancing pigs every time."

But not all warning messages are created equal, as demonstrated by the fact that 70% of Google's SSL warnings were ignored by users, versus only 33% for Firefox users. Either that, or Google Chrome junkies are a bunch of self-selecting danger monkeys.

In fact, the researchers traced some high click-through rates to more advanced users -- namely, users of pre-release or Linux versions of Chrome. "Technically advanced users might feel more confident in the security of their computers, be more curious about blocked websites, or feel patronized by warnings," said the researchers, who recommended further studies of this group of users to help design warnings better tailored to their expectations.

Based on the study results, the researchers said, "The user experience of warnings can have an enormous impact on user behavior, justifying efforts to build usable warnings." They also noted that Google has also begun testing ways to make more Chrome users heed its SSL warnings. "Such a high click-through rate is undesirable: either users are not heeding valid warnings, or the browser is annoying users with invalid warnings and possibly causing warning fatigue."

Another interesting finding was that increasing the number of clicks required to bypass warning messages didn't appear to have any effect. In fact, despite having to click an "advanced" link followed by a "proceed" button, Chrome users still bypassed more warning messages than Firefox users, who had to click only a single, simpler warning. "We find this result surprising," said the researchers. "Common wisdom in e-commerce holds that extra clicks decrease click-through rates -- hence, one-click shopping. Google Chrome's warning designers introduced the extra step in the malware/phishing warning because they expected it to serve as a strong deterrent."

One likely explanation for Chrome's security warning not being as effective is that after a user decides to bypass the warning, up to a certain difficulty level, they simply won't be stopped. Furthermore, few users clicked on Chrome's "more information" link, suggesting that user attention is a finite resource, the researchers said. Accordingly, unless user experience designers get their browser safety messages right, don't expect most users to pay attention.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8370
Published: 2015-01-29
VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allow host OS users to gain host OS privileges or cause a denial of service (arbitrary write to a file) by modifying a configuration file.

CVE-2015-0236
Published: 2015-01-29
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

CVE-2015-1043
Published: 2015-01-29
The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS users to cause a guest OS denial of service via unspecified vectors.

CVE-2015-1044
Published: 2015-01-29
vmware-authd (aka the Authorization process) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allows attackers to cause a host OS denial of service via unspecified vectors.

CVE-2015-1422
Published: 2015-01-29
Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) j...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.