You've been warned: an empirical study of the effectiveness of web browser phishing warnings

By Serge Egelman, Lorrie Faith Cranor, Jason I. Hong. 2008

725 citations recorded by the source corpus.

Subfields: Information Systems, Human-Computer Interaction

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Human-Computer Interaction

Citations in the corpus

PhishEye: Live Monitoring of Sandboxed Phishing Kits (2016, background): “Our study presents accurate measurements of the duration and effectiveness of this popular threat, and discusses many new and interesting aspects we observed by monitoring hundreds of phishing campaigns.”
Perspectives: Improving SSH-style Host Authentication with Multi-Path Probing (2008, background): “Analysis Parameters: As described in Section 4, the actual security and availability that a client will receive depends on its choice for the following policy parameters: n: Number of notary servers contacted by the client. q: Quorum threshold of client. r: Number of shadow servers (per notary) the ”
Emerging phishing trends and effectiveness of the anti-phishing landing page (2014, background): “Researchers have shown that browser blacklists are not efficient enough to detect the phishing URLs [14] [37].”
An Empirical Analysis of Phishing Blacklists (2009, background): “A recent laboratory study [10] showed that users only heed active phishing warnings and ignore passive warnings.”
The Effectiveness of Application Permissions (2011, background): “Other researchers have shown that browser warnings for phishing sites and invalid SSL certificates are ignored by most users [4, 16]; it is possible that even infrequent permission installation warnings will be ignored.”
A Usability Evaluation of Tor Launcher (2017, background): “Usable security research explores a variety of security concepts, such as email encryption [20, 43], authentication [10, 28, 38], security indicators [2, 11], and warnings [15, 37].”
A Framework for Reasoning About the Human in the Loop (2008, background): “…of attacks that interfere with the display of IE and Firefox anti-phishing warnings; however, the IE passive warning usually loads a few seconds after the page loads, and if users start filling out a web form they can inadvertently dismiss the passive warning before they notice it is there [12].”
Crying Wolf: An Empirical Study of SSL Warning Effectiveness (2009, background): “They concluded that many of the participants had become habituated to seeing similar-looking warnings when browsing legitimate websites, and are now likely to ignore all future similarly-designed warnings, regardless of the danger they represent [6].”
Teaching Johnny not to fall for phish (2010, background): “Passive indicators that do not interrupt the task are especially problematic; active indicators that block a phishing Web page have been shown to be signi.cantly more effective [Egelman et al. 2007].”
Phishing Detection: A Literature Survey (2013, background): “blocks the content) and should visually hint the user of risks even without reading its content (since most end-users do not read warning messages [23]).”
Scaling the Security Wall: Developing a Security Behavior Intentions Scale (SeBIS) (2015, background): “showed that when less-frequent high-risk warnings appear similar to frequent low-risk security warnings, users ignore both [12].”
Monitoring web browsing behavior with differential privacy (2014, background): “…sessions have been extensively used by servers as well as third-party researchers to perform data mining and understand important phenomena, such as: • watching the web trafﬁc for suspicious behavior or attacks [5, 12], • ensuring websites uptime, performance, and functionality are as expected.”
User Perceptions of Smart Home IoT Privacy (2018, background): “It is well-known that user-friendliness increases engagement with privacy settings and warnings in web andmobile application contexts [16, 17]; however, most smart home IoT devices do not have screens.”
PhishZoo: Detecting Phishing Websites by Looking at Them (2011, neutral): “however, these flags are often ignored or misunderstood by the users [3], [4].”
(Un)informed Consent: Studying GDPR Consent Notices in the Field (2019, background): “tion and behavior; examples include color [40] and position [9]. Studies investigating different notice designs were conducted, for example, for SSL [16], browser security [33], and phishing warnings [13]. Mathur et al. [28] classified commondark patterns in web services. In their classification sch”
Insights into User Behavior in Dealing with Internet Attacks (2012, background): “Each of the malicious scenarios exemplified different attack techniques in order to prevent the participants from building knowledge along the way and performing better in subsequent tests.”
An Anti-Phishing System Employing Diffused Information (2014, background): “[Egelman et al. 2008] map the C-HIP model onto the anti-phishing problem, and explore design choices that are more or less congruent to it.”
"...No one Can Hack My Mind": Comparing Expert and Non-Expert Security Practices (2015, neutral): “[14].”