Sunny Consolvo

Improving SSL Warnings: Comprehension and Adherence

Browsers warn users when the privacy of an SSL/TLS connection might be at risk. An ideal SSL warning would empower users to make informed decisions and, failing that, guide confused users to safety. Unfortunately, users struggle to understand and often disregard real SSL warnings. We report on the task of designing a new SSL warning, with the goal of improving comprehension and adherence. We designed a new SSL warning based on recommendations from warning literature and tested our proposal with microsurveys and a field experiment. We ultimately failed at our goal of a well-understood warning. However, nearly 30% more total users chose to remain safe after seeing our warning. We attribute this success to opinionated design, which promotes safety with visual cues. Subsequently, our proposal was released as the new Google Chrome SSL warning. We raise questions about warning comprehension advice and recommend that other warning designers use opinionated design.

Online microsurveys for user experience research

This case study presents a critical analysis of microsurveys as a method for conducting user experience research. We focus specifically on Google Consumer Surveys (GCS) and analyze a combination of log data and GCSs run by the authors to investigate how they are used, who the respondents are, and the quality of the data. We find that such microsurveys can be a great way to quickly and cheaply gather large amounts of survey data, but that there are pitfalls that user experience researchers should be aware of when using the method.

Mobile User Research: A Practical Guide

This book will give you a practical overview of several methods and approaches for designing mobile technologies and conducting mobile user research, including how to understand behavior and evaluate how such technologies are being (or may be) used out in the world. Each chapter includes case studies from our own work and highlights advantages, limitations, and very practical steps that should be taken to increase the validity of the studies you conduct and the data you collect. This book is intended as a practical guide for conducting mobile research focused on the user and their experience. We hope that the depth and breadth of case studies presented, as well as specific best practices, will help you to design the best technologies possible and choose appropriate methods to gather ethical, reliable, and generalizable data to explore the use of mobile technologies out in the world.

An Experience Sampling Study of User Reactions to Browser Warnings in the Field

Web browser warnings should help protect people from malware, phishing, and network attacks. Adhering to warnings keeps people safer online. Recent improvements in warning design have raised adherence rates, but they could still be higher. And prior work suggests many people still do not understand them. Thus, two challenges remain: increasing both comprehension and adherence rates. To dig deeper into user decision making and comprehension of warnings, we performed an experience sampling study of web browser security warnings, which involved surveying over 6,000 Chrome and Firefox users in situ to gather reasons for adhering or not to real warnings. We find these reasons are many and vary with context. Contrary to older prior work, we do not find a single dominant failure in modern warning design---like habituation---that prevents effective decisions. We conclude that further improvements to warnings will require solving a range of smaller contextual misunderstandings.

Attitudes toward vehicle-based sensing and recording

Vehicles increasingly include features that rely on hi-tech sensors and recording; however, little is known of public attitudes toward such recording. We use two studies, an online survey (n=349) and an interview-based study (n=15), to examine perceptions of vehicle-based sensing and recording. We focus on: 1) how vehicle-based recording and sensing may differ from perceptions of current recording; 2) factors that impact comfort with vehicle-based recording for hypothetical drivers versus bystanders; and 3) perceptions of potential privacy-preserving techniques. We find that vehicle-based recording challenges current mental models of recording awareness. Comfort tends to depend on perceived benefits, which can vary by stakeholder type. Perceived privacy in spaces near cars can also impact comfort and reflect mental models of private spaces as well as the range of potentially sensitive activities people perform in and near cars. Privacy-preserving techniques may increase perceived comfort but may require addressing trust and usability issues.

Helping You Protect You

Guest editors M. Angela Sasse and Charles C. Palmer speak with security practitioners about what companies are doing to keep customers secure, and what users can do to stay safe.

152 Simple Steps to Stay Safe Online: Security Advice for Non-Tech-Savvy Users

Users often don’t follow expert advice for staying secure online, but the reasons for users’ noncompliance are only partly understood. More than 200 security experts were asked for the top three pieces of advice they would give non-tech-savvy users. The results suggest that, although individual experts give thoughtful, reasonable answers, the expert community as a whole lacks consensus.

Exploring the benefits and uses of web analytics tools for non-transactional websites

Website owners use web analytics tools to better understand their visitors for a range of purposes. However, there is limited understanding of how owners of non-transactional websites use and benefit from web analytics. Through semi-structured interviews (n=18) with non-transactional web analytics users we explore these uses and benefits. Participants tend to use web analytics to improve site design, by optimizing site structure, content, or technical specifications. However, participants also use web analytics to understand their audiences without a directed purpose, often for curiosity or entertainment. The design of web analytics tools should account for this full range of functionality.

Privacy and Security [Guest editors' introduction]

Privacy and security issues might very well be the greatest barrier to creating a ubiquitously connected world. The articles in this special issue show that addressing such concerns will require not only efficient algorithms and secure protocols but also usable interfaces and socially compatible designs. Furthermore, researchers with a strong interdisciplinary interest will need to look for the non-obvious solutions.

Security and Privacy Experiences and Practices of Survivors of Intimate Partner Abuse

Recognizing how intimate partner abuse’s three phases—physical control, escape from abuser, and life apart—affect survivors’ technology use can help technology creators better understand and support this population’s digital security and privacy needs.