Bartsch, Steffen

Lipford, Heather Richter

Northrop, Erik

Volkamer, Melanie

English

KITopen

Poster: Content and Context for Browser WarningsAchieving Security using Cartoons and HumorErik E. NorthropUNC CharlotteWoodward Hall 3009201 University City Blvd.Charlotte, N.C. 28213United StatesErikNorthrop@uncc.eduHeather Richter LipfordThe University of NorthCarolina at CharlotteWoodward Hall 305E9201 University City Blvd.Charlotte, N.C. 28213United StatesHeather.Lipford@uncc.eduSteffen BartschCASED, TU DarmstadtHochschulstraße, 1064289 Darmstadt, Germanysteffen.bartsch@cased.deMelanie VolkamerCASED, TU DarmstadtHochschulstraße, 1064289 Darmstadt, Germanymelanie.volkamer@cased.de1. INTRODUCTIONChanging user behavior is paramount to providing a com-plete security package containing a balance of technical andhuman intervention strategies. One problem in achievingthis are the notoriously insecure browsing practices exhib-ited by users. For example, users are known to circumventsecurity mechanisms in order to achieve a goal.Another problem are habitual actions taken by the userwhen confronted with a popup notification or warning mes-sage. These notifications and warning messages are issuedfrom a variety of sources like mobile devices, new mail noti-fications on the desktop and software update notifications,just to name a few. Browser warnings are also included inthis list and arguably may could contain the most relevantnotifications and warnings that are designed to protect theuser. This constant barrage of notifications and warningshas habituated some users into ignoring them to return totheir task; this is a critical point of failure.Popup notifications and warnings are essential to a rel-atively unobtrusive user experience and until another con-vention is adopted, users and popup warnings shall continueforward in a deplorable marriage. One solution then, is toprovide the user with a popup notification that is interest-ing, creative, and funny in the form of a cartoon. Usingcartoons to make text more enjoyable is common practicefor test publishers and they can even be found in scholarlyand educational publications [7].Cartoons can provide the user with visual and direct mes-sages in a humorous way [7]. One component of cartoonsare humor, which has been studied in education and learn-ing since at least 1961 [10]. Schmidt states the positive in-fluence humor has on memory and goes on to report ”thathumorous sentences were recalled better than non-humoroussentences” [8].Providing a novel approach to enable more conscious de-cisions based on new warnings, we propose the following:1. Cartoons and Humor used to convey security informa-tion can be used to change user behavior.2. Using Cartoons and Humor to convey browser securitywarnings will reduce the habituation effect.3. Cartoons and Humor can teach users about securebrowser behavior.4. Cartoons and Humor can teach users about secure be-havior better than standard warnings.2. MOTIVATIONWork by Bartsch et al. show that users are more receptiveto contextualized browser warnings than standard warnings[4]. Exploring what it means to ”contextualize” somethingfrom the user’s perspective, we posit that a psychologicaland emotional connection is made when this occurs there-fore making it more appealing to the user. It was the ideaof contextualizing information to the user that sparked in-terest in humor and security but before arriving at the finaldecision, two other avenues were first hypothesized.First, we hypothesized that by adding social networks tothe intervention strategy warning information could be per-sonalized, would originate from a known source, and leveragesocial network resources (advice from friends and known ex-perts, and crowd intelligence) to provide information backto the user. For example, a security warning following thisscheme would present statistics on how many other peoplein the user’s social network also encountered a given warningthe action they used to mitigate the situation.Second, we hypothesized that reporting statistics in areadable, clear, and concise way would give the user a clearpicture of their security status, history, and mitigation strate-gies taken to avoid becoming a victim. Such a dashboardwould take two forms. First, as a browser plugin similarto Ghostery [2] or DoNotTrackMe [1]. Another approachwould resemble the Google Privacy Dashboard 1. In thelast example, given liberal space restrictions we would dis-play social network information (mentioned previously), se-curity history, and other information that would help the1Any user with a Google + account has access to this by sim-ply visiting https://www.google.com/settings/dashboard1user understand and learn about their security position. Us-ing the dashboard approach, the goal is to inform, educate,and empower the user using their own data plus data fromtheir social network aggregated and presented in a meaning-ful way.Recognizing the limitations of using social networks anddashboards plus the high potential of using humor and car-toons to provide security warnings, we decided that cartoonsand humor would provide the greatest value to the user.3. HUMOR & LEARNINGEducators have taken notice that using cartoons to teachis novel and effective. Evidence of this can be found atCarnegie Mellon University where Iliano Cervesato createda class centered on a comic book [3]. The course titled Dis-covering Logic, offered for first-year computer science stu-dents [6], was taught using the bestselling graphic novel ti-tled Logicomix [3].Others too have also noticed the value of humor in edu-cation. For example, a work by Srikwan et al. focuses oncreating cartoons aimed at teaching the user to be more se-cure [9]. Calman, in a paper titled A study of storytelling,humor and learning in medicine, states, ”the physiologicaleffects of laughter are considerable. Both story telling andhumor are important for learning and are complementary tothe more formal learning from text books and lectures” [5].In a paper titled, Humorous cartoons in college textbooks:Student perceptions and learning, Özdoğru and McMorrisreport ”the effects of humorous cartoons on students per-ceptions and learning of psychological concepts with senseof humor as a moderator” [7]. In one example, they statethe positive experience by students when learning statisticsthat integrated humor into the instruction; these studentsshowed higher achievement and lower anxiety as a result [7].4. PLANNED WORKCurrently, we are making selections for appropriate car-toons to use in security interventions. This is a multi-stepprocess by which design principals for e-learning, cognitivescience, psychology, learning science, and proven work byothers are used as a guide. After making final selections, wewill pilot our recommended set of cartoons to a small usergroup in Germany and the United States to ensure our mes-sage is clearly communicated and abides by cultural norms.Because of the subjective nature of cartoons, we are striv-ing for clarity in the message we communicate. So followingthe pilot, selected cartoons will be modified as necessary andtested again. At this point, we will have four separate usergroups (two in Germany and two in the United States) plusan expert group assess the cartoons before initiating the userstudy.Our other study materials will also filter through the sameprocess to ensure adherence with e-learning, cognitive sci-ence, psychology, learning science, design principals, andacceptance to cultural norms. It is only after a rigorousapproach and validation period that we plan to launch theuser study.A convenient side effect of this work is the ability to studycultural differences and perceptions between a Germany andAmerican population. To achieve this, the user study willbe conducted simultaneously in Germany and the UnitedStates. The study population shall include users who haveno domain knowledge in Usable Security and Privacy or anyrelated field. In short, our target audience is the averageuser.The user study will consist of a pre-survey followed by aninteraction period with the prototype then closing with apost-survey. We are providing the user with a set of tasksthey must complete while using the prototype and this al-lows us to capture data points and interaction behavior.Specifics related to the prototype and survey materials willbe provided at a later point in greater detail.5. LIMITATIONSWe expect cultural challenges specifically about designingcartoons that are receptive, humorous, and convey a clearmessage across cultures. To this effect, we also face un-known barriers to providing humor possibly stemming fromreligious and language barriers. We recognize this as one ofthe interesting details found when working with in a diverseculture.Further work and investigation into the psychology of hu-mor, cognitive science, and learning science will be con-ducted for this study. These areas are a cornerstone onwhich our work is based so proper acknowledgement andapplication of this material is paramount.We further acknowledge that other contributing factorsmay be discovered in the process of conducting the pilotstudy and subsequent formative evaluations leading to theuser study.6. REFERENCES[1] DoNotTrackMe. pages 1–1, June 2013.[2] Ghostery. pages 1–1, June 2013.[3] Logic Thru Comics - Carnegie Mellon UniversityCMU.pages1 −−1, June2013.[4] S. Bartsch, M. Volkamer, H. Theuerling, andF. Karayumak. Contextualized Web warnings, andhow they cause distrust. pages 1–18, Apr. 2013.[5] K. Calman. A study of storytelling, humour andlearning in medicine. Clinical Medicine, 1(3):227–229,May 2001.[6] A. Doxiadis and C. H. Papadimitriou. Logicomix.pages 1–351, Nov. 2010.[7] A. A. Özdoğru and R. F. McMorris. Humorouscartoons in college textbooks: Student perceptionsand learning. pages 1–21, Feb. 2013.[8] S. R. Schmidt. Effects of Humor on Sentence Memory.The Journal of Experimental Psychology: Learning,Memory, and Cognition, 20(4):953–967, Sept. 1994.[9] S. Srikwan and M. Jakobsson. Using Cartoons toTeach Internet Security. pages 1–23, July 2007.[10] A. Ziv. Teaching and Learning with Humor.2

Poster: Content and Context for Browser Warnings - Achieving Security using Cartoons and Humor

https://publikationen.bibliothek.kit.edu/1000081908/16416353

Poster: Content and Context for Browser Warnings - Achieving Security using Cartoons and Humor

Abstract

Similar works

Full text

Available Versions

KITopen