Improving Security Decisions with Polymorphic and Audited Dialogs
July 20, 2007 by Richard Conlanhttp://cups.cs.cmu.edu/soups/2007/proceedings/p76_brustoloni.pdf
Users not only ignore dialogs, but will lie to them if doing so is necessary to achieve the desired behavior. This research employs polymorphic dialogs that change each time to keep the user from learning/giving automatic answers. Polymorphic dialogs deliberately vary the dialog such that the consequence of automatic answers becomes unpredictable and thus requires greater effort to give goal-directed false answers.
The study considered two examples of polymorphic dialogs. The first was to vary the order of dialog elements, and the second is to delay the user’s ability to confirm the dialog by keeping the confirmation buttons disabled for a short window. The study also explored the possibility of audited dialogs which warn the users that their answers may be audited or that answers will be forwarded to company auditors with threats of penalties, and include the capability for auditors to actually penalize the user. To explore these ideas with real users the study included three versions of Thunderbird - one running as normal, one extended with polymorphic dialogs, and one extended with polymorphic audited dialogs. Users were asked to role-play as an employee in two scenarios with varied order.
The results confirmed that there was a significant reduction in task completion time and better evaluation of risk with PDs (polymorphic dialogs), and even better results with PADs (polymorphic audited dialogs). They then compared the PD to the PAD groups and found that it appears that the auditing component had a significant impact. Users rated the dialogs 3.9/5 as easy to understand, but were divided on willingness to recommend the interface to a friend.
July 20th, 2007 at 11:46
There wasn’t time to ask this after the talk, but i really wanted to know how he thought this made users feel about using their computers. I can’t imagine there being anything but a significant negative impact on one’s relationship with a computing environment to be constantly warned of potential punishments for one’s actions.