The Emperor's New Security Indicators

By Stuart E. Schechter, Rachna Dhamija, Andy Ozment, Ian S. Fischer. IEEE Symposium on Security and Privacy, 2007

516 citations recorded by the source corpus.

Subfields: Information Systems, Sociology and Political Science

View Paper: https://www.semanticscholar.org/paper/2ba16a91a0fa1cdd06dec7b0df8f7808e7d9833e

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Sociology and Political Science

Citations in the corpus

Perspectives: Improving SSH-style Host Authentication with Multi-Path Probing (2008, background): “As we discuss in Section 8, because users often ignore browser security warnings [21, 10], a MitM attacker can fool a user by injecting a bogus self-signed certificate in the place of a PKI-signed certificate.”
Crying Wolf: An Empirical Study of SSL Warning Effectiveness (2009, methodology): “tested the usability of security indicators by removing SSL indicators from a banking website and observed that all 63 participants still provided their passwords [17].”
A Usability Evaluation of Tor Launcher (2017, background): “Usable security research explores a variety of security concepts, such as email encryption [20, 43], authentication [10, 28, 38], security indicators [2, 11], and warnings [15, 37].”
You've been warned: an empirical study of the effectiveness of web browser phishing warnings (2008, background): “We believe that the coincidental nature of this attack was the reason why many more participants fell for our attacks than what has been found in similar studies [8, 7, 19, 14, 20].”
Nudges for Privacy and Security (2017, background): “In the area of security, it has been shown that users often ignore security warnings, even in the context of sensitive websites, such as banking or health [Schechter et al. 2007; Sharek et al. 2008].”
The Plight of the Targeted Attacker in a World of Scale (2010, background): “For example, a growing body of measurement studies make clear that users choose weak passwords and re-use them liberally [21], choose easily guessed backup authentication questions [43], are oblivious to security cues [41], ignore certificate error warnings [26] and cannot tell legitimate web-sites ”
An Anti-Phishing System Employing Diffused Information (2014, background): “Furthermore, even those users who have set up an RAA system often disregard the absence of a token [Schechter et al. 2007].”
PhishZoo: Detecting Phishing Websites by Looking at Them (2011, background): “however, these flags are often ignored or misunderstood by the users [3], [4].”
Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness (2013, background): “For example, a growing body of measurement studies make clear that ...[users] are oblivious to security cues [26], ignore certificate error warnings [30] and cannot tell legitimate web-sites from phishing imitations [11].”