Exploring User Strategies in Determining Trustworthiness of Websites
Total Page:16
File Type:pdf, Size:1020Kb
EXPLORING USER STRATEGIES IN DETERMINING TRUSTWORTHINESS OF WEBSITES by Manisha Arora Submitted in partial fulfilment of the requirements for the degree of Master of Computer Science at Dalhousie University Halifax, Nova Scotia February 2017 © Copyright by Manisha Arora, 2017 DEDICATION PAGE I would like to dedicate this thesis to “my husband, Dinesh Tagra who motivated and inspired me to face all the challenges in life and always been on my side whenever I needed him”. ii TABLE OF CONTENTS LIST OF TABLES ........................................................................................................... vi LIST OF FIGURES ....................................................................................................... vii ABSTRACT .................................................................................................................... viii LIST OF ABBREVIATIONS USED ............................................................................ ix ACKNOWLEDGEMENTS .............................................................................................. x CHAPTER 1 INTRODUCTION ............................................................................ 1 1.1 TYPES OF PHISHING ATTACKS .............................................................................. 1 1.2 GAPS IN EXISTING RESEARCH ............................................................................. 4 1.3 CONTRIBUTION ...................................................................................................... 5 1.4 OVERVIEW OF THE THESIS .................................................................................... 7 CHAPTER 2 Background and Literature Review ....................................... 9 2.1 EFFECTIVENESS OF BROWSER SECURITY CUES .................................................. 9 2.2 USER BEHAVIOR AND CHARACTERISTICS .......................................................... 14 2.3 SPEAR PHISHING ................................................................................................. 21 2.4 USER EXPERTISE ................................................................................................. 24 2.5 SUMMARY ............................................................................................................. 27 CHAPTER 3 METHODOLOGY .......................................................................... 29 3.1 RESEARCH OBJECTIVE .................................................................................. 29 3.2 RESEARCH QUESTIONS ................................................................................. 30 3.3 STUDY OUTLINE ........................................................................................... 30 3.3.1 Study Protocol .............................................................................. 31 3.3.2 Study Procedure / experimental set up .............................. 34 3.3.3 Study Instruments ...................................................................... 38 3.3.4 Study Instrument Refinement ................................................ 40 3.3.5 Data Collection ............................................................................. 40 3.3.6 Data Analysis ................................................................................ 42 3.3.7 Recruitment ................................................................................... 42 3.3.8 Participants .................................................................................... 43 iii CHAPTER 4 RESULTS AND ANALYSIS ........................................................ 47 4.1 DECISION ON WEBSITES .................................................................................... 47 4.1.1 Technical Expertise ..................................................................... 47 4.1.2 Gender ............................................................................................. 50 4.1.3 Successfulness of Websites ..................................................... 53 4.2 DECISION ON E-MAILS ........................................................................................ 55 4.3 STRATEGIES USED BY PARTICIPANTS IN WEBSITES ......................................... 56 4.3.1 Website Content and Look & Feel ......................................... 58 4.3.2 Exploring website functionality .............................................. 60 4.3.3 Familiarity with the Website.................................................... 61 4.3.4 Attention to URL........................................................................... 62 4.3.5 Attention to SSL Indicators ..................................................... 65 4.3.6 Popups ............................................................................................. 66 4.3.7 Account Information ................................................................... 67 4.3.8 Antivirus warning......................................................................... 68 4.3.9 Other strategies ........................................................................... 68 4.4 STRATEGIES USED BY PARTICIPANTS IN EMAILS .............................................. 70 4.5 VISITING WEBSITES VIA E-MAILS ..................................................................... 72 4.6 POST- SESSION QUESTIONNAIRE AND INTERVIEW .......................................... 73 CHAPTER 5 DISCUSSION AND IMPLICATIONS FOR DESIGN ........... 99 5.1 DISCUSSION .................................................................................................. 99 5.1.1 Lack of Security Awareness..................................................... 99 5.1.2 Differences between Technical and Non-Technical Participants ................................................................................................ 99 5.1.3 Familiarity ..................................................................................... 100 5.1.4 Differences based on Gender................................................ 100 5.1.5 Using own laptop ....................................................................... 101 5.1.6 Using Browsers of Participants choice ............................... 102 5.1.7 Changes in chrome SSL indicators ..................................... 102 5.2 RECOMMENDATIONS .......................................................................................... 103 5.2.1 Box of Security information on Website ........................... 103 iv 5.2.2 Hover Help ................................................................................... 104 5.2.3 Using Color Scheme for URL ................................................. 104 5.2.4 Security Cues per Browser ................................................. 105 5.2.5 User Education ........................................................................ 105 CHAPTER 6 LIMITATIONS AND CHALLENGES ...................................... 106 6.1 USE OF EYE TRACKER ....................................................................................... 106 6.2 HOSTING WEBSITES .......................................................................................... 106 6.3 PARTICIPANTS .................................................................................................... 107 6.4 NOT USING PARTICIPANTS E-MAIL ACCOUNTS ............................................... 107 6.5 NO CREDENTIALS ............................................................................................... 107 6.6 LAB ENVIRONMENT ............................................................................................ 108 6.7 STUDY CONTEXT ................................................................................................ 108 CHAPTER 7 CONCLUSION AND FUTURE WORK ................................... 109 7.1 CONCLUSION ...................................................................................................... 109 7.2 FUTURE WORK ................................................................................................... 110 REFERENCES .............................................................................................................. 111 APPENDICES............................................................................................................... 115 APPENDIX A – LETTER OF APPROVAL ...................................................................... 115 APPENDIX B – AMENDMENT APPROVAL ................................................................... 116 APPENDIX C – RECRUITMENT SCRIPT ..................................................................... 117 APPENDIX D – INFORMED CONSENT ....................................................................... 118 APPENDIX E: SCREENING QUESTIONNAIRE ............................................................ 122 APPENDIX F: POST-OBSERVATION QUESTIONNAIRE ............................................ 125 APPENDIX G: SEMI-STRUCTURED INTERVIEW GUIDE ........................................... 127 APPENDIX H: CODING SHEETS ................................................................................ 128 v LIST OF TABLES Table 1 List of Phishing and Legitimate Websites Shown during the study .................... 35 Table 2 List of e-mails shown during study...................................................................... 37 Table 3 Participant's Demographics ................................................................................. 43 Table 4 Technical Proficiency of our participants ............................................................ 44 Table 5 General