What Instills Trust? A Qualitative Study of Phishing

  • Markus Jakobsson
  • Alex Tsow
  • Ankur Shah
  • Eli Blevis
  • Youn-Kyung Lim
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4886)

Abstract

This paper reports the highlights of a user study which gauges reactions to a variety of common “trust indicators” – such as logos, third party endorsements, and padlock icons – over a selection of authentic and phishing stimuli. In the course of the think-aloud protocol, participants revealed different sensitivities to email messages and web pages. Our principal result is the analysis of what makes phishing emails and web pages appear authentic. This is not only of interest from a pure scientific point of view, but can also guide the design of legitimate material to avoid unnecessary risks. A second result of ours are observations of what makes legitimate content appear dubious to consumers. This is a result with obvious applications to online advertising.

Keywords

authenticity design email experiment phishing psychology stimuli think-aloud user interface design web pages 

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Camtasia Studio Screen Recorder for Demos, Presentations and Training, Camtasia Studio 4, TechSmith Corportation (2006), http://www.techsmith.com/camtasia.asp
  2. 2.
    Dhamija, R., Tygar, J.D., Hearst, M.: Why phishing works. In: CHI 2006. Proceedings of the SIGCHI conference on Human Factors in computing systems, pp. 581–590. ACM Press, New York (2006)Google Scholar
  3. 3.
    Downs, J.S., Holbrook, M.B., Cranor, L.F.: Decision strategies and susceptibility to phishing. In: SOUPS 2006. Proceedings of the second symposium on Usable privacy and security, pp. 79–90. ACM Press, New York (2006)Google Scholar
  4. 4.
    Friedman, B., Hurley, D., Howe, D.C., Felten, E., Nissenbaum, H.: Users’ conceptions of web security: A comparative study. In: CHI 2002. extended abstracts on Human factors in computing systems, pp. 746–747. ACM Press, New York (2002)Google Scholar
  5. 5.
    Griffith, V., Jakobsson, M.: Messin’ with Texas, Deriving Mother’s Maiden Names Using Public Records. In: Ioannidis, J., Keromytis, A.D., Yung, M. (eds.) ACNS 2005. LNCS, vol. 3531, Springer, Heidelberg (2005)Google Scholar
  6. 6.
    Jakobsson, M., Ratkiewicz, J.: Designing Ethical Phishing Experiments: A Study of (ROT13) rOnl Query Features. In: WWW 2006 (2006)Google Scholar
  7. 7.
    Whalen, T., Inkpen, K.M.: Gathering evidence: Use of visual security cues in web browsers. In: Graphics Interface 2005. ACM International Conference Proceeding Series, vol. 112. pp. 137–144. Canadian Human-Computer Communications Society, Waterloo (2005)Google Scholar
  8. 8.
    Likert, Rensis.: A technique for the measurement of attitudes. Archives of Psychology 140 (June 1932)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2007

Authors and Affiliations

  • Markus Jakobsson
    • 1
  • Alex Tsow
    • 2
  • Ankur Shah
    • 2
  • Eli Blevis
    • 2
  • Youn-Kyung Lim
    • 2
  1. 1.Bloomington and RavenWhite Inc.Indiana UniversityUSA
  2. 2.Indiana UniversityBloomington

Personalised recommendations