So long, and no thanks for the externalities: the rational rejection of security advice by users

By Cormac Herley. New Security Paradigms Workshop, 2009

673 citations recorded by the source corpus.

Subfields: Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/2f8fe860cc8f3d60e0174f87d0099657e10155af

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Signal Processing

Citations in the corpus

"...No one Can Hack My Mind": Comparing Expert and Non-Expert Security Practices (2015, background): “Herley has commented at length on the overall state of security advice, arguing that users may often fail to follow it for rational reasons [19], and that there are currently so many security-related demands on users that adding more would be counterproductive [20].”
How Does Your Password Measure Up? The Effect of Strength Meters on Password Creation (2012, background): “Furthermore, strict policies can frustrate users, inhibit their productivity, and lead users to write their passwords down [1, 14, 16, 21, 32].”
Nudges for Privacy and Security (2017, background): “While insecure behavior may not always be the result of over-conﬁdence and can also follow well-reasoned decisions [Herley 2009; Vila et al. 2003], cybersecurity and privacy attacks do affect users who underestimate the risks.”
Testing metrics for password creation policies by attacking large sets of revealed passwords (2010, background): “... creation rules? Is an eight character password on average stronger than a seven character password, and if so, by how much? Even in the NIST SP800-63 publication when attempting to gauge how much entropy is added to a system due to various creation policies, the authors themselves state, “Unfort”
Insights into User Behavior in Dealing with Internet Attacks (2012, methodology): “In our recruitment strategy, we focused on having a balanced number of participants with technical and non-technical backgrounds in order for us to make meaningful comparisons between the performances of these groups.”
A Research Agenda Acknowledging the Persistence of Passwords (2012, background): “In the absence of a silver bullet the messy work of trade-offs cannot be escaped.”
The Plight of the Targeted Attacker in a World of Scale (2010, background): “Herley [23] argues that users are correct to ignore most of the security advice they receive: faced with costs which exceed their budgets and beneﬁts that are not evidence-based they have little alternative but to capitulate and hope for the best.”
The true cost of unusable password policies: password use in the wild (2010, background): “Frequent change and non-re-use of passwords across sites are the common password policy recommendations to mitigate such risks, but these measures are arguably of marginal benefit [12].”