Slashdot Mirror
MRIs Show Our Brains Shutting Down When We See Security Prompts
antdude writes with this excerpt from Ars Technica: Magnetic Resonance Imaging (MRIs) show our brains shutting down when we see security prompts. The MRI images show a "precipitous drop" in visual processing after even one repeated exposure to a standard security warning and a "large overall drop" after 13 of them. Previously, such warning fatigue has been observed only indirectly, such as one study finding that only 14 percent of participants recognized content changes to confirmation dialog boxes or another that recorded users clicking through one-half of all SSL warnings in less than two seconds.
Did they test with dumb regular users who don't understand or don't know better, or did they test people who actually know what those security warnings mean and the real consequences of ignoring them?
Get free satoshi (Bitcoin) and Dogecoins
I want titties, but these stupid alerts keep popping up
I've witnessed this so many times as an IT tech that it's sickening. Even if we're standing there and try explaining it, our words just end up in "don't care" brain bin and they'll click on anything that makes the message go away the fastest. I've even had them click on "yes" then "Ok" on the install even when I was standing there and told them not to. It's like they're "listening" to their mother in law. Irritating as hell.
"Be particularly skeptical when presented with evidence confirming what you already believe." -
new medical research read it cancel or allow?
For those using other platforms, just a reminder that Windows turns the monitor black for a few seconds before showing a security warning or request...
Many just want to get through the day w/o serious thought, which is also why they pick 1111 for passwords.
One thing that infuriates me is everything HAS to go full screen and hide all in the name of anti skuemorphic design
http://saveie6.com/
There have been too many times where I have gone to a website I frequent and find their certificate has expired. A couple days later, there may be a sheepish apology from them.
Then there are warnings about reloading pages because whoever designed the website didn't handle the back button correctly.
Then there are the redirection warnings because of yet another shitty web design.
They start to get insensitive about those things. And some of the warnings come in such rapid succession -really? I've had to click away several warnings on top of one another until I just said, "Fuck it! These people are morons. Find someone else."
Oh, and if a web developer is going to use an advertising company that does crazy shit that kicks off warnings (you know who they are), please, please, go to business school and stop developing.
If I'm on an untrusted system I don't care if its warning me. Often a second warning provides no more information, and no more danger: you already trusted it, or you already are not trusting it. There is little benefit to changing this decision when getting yet another warning about the same thing.
I don't have a problem using untrusted systems or sites with broken certificates (or no certificate). I simply don't trust their authenticity: that doesn't mean I can't use them. The second warning in such a situation generally just tells you that the trust you already don't have would be a bad idea to have.
I think most people don't realize that a forged or expired certificate on a web site is still better than none (you still get https encryption, even if you don't get any authenticity checks). The over the top warnings about bad certs is just silly: I got no warning for my totally unauthenticated and unencrypted connection to /.
Obviously their brains will shut down since 99% of 'security' prompts are mere nuisances with no value whatsoever. The brain notices patterns like that pretty quick.
He is becoming accustomed to the horrors he is witnessing. So, we change horrors.
in BOFH speak, from a couple of decades ago.
What is old is new again?
The "Civilized World" jumped the shark ca. 1973.
Serisously though, most people tune out warnings because once read, its the same info. There is no point for the brain to waste time trying to correlate a message that is already understood and unchanging.
It takes one time to recognize the skull and crossbones on say bleach, so you just tune it out the next time. Your mind already got the message its deadly. Unfortunetly this is also what happens when people become careless and through cosh into the wind. (like the giant munition explosion a few years back in russia because someone lit up a smoke, or swiming in water known to have shark attacks. You mind knows the risk, its just a calculated gamble at that point).
Married men learn to ignore nagging.
Table-ized A.I.
Yes, because an unencrypted http connection is by definition so much more secure than a self signed https connection. /sarcasm
The browsers have to get with it.
Slashdotters see a new summary. Gonna fess up here i made it about half way through, got bored and posted.
Perhaps the security prompts should be flashing at 20 to 30 Hz and contain numerous, bright colors, rapidly moving shapes and loud noises. Shutdown on that, brains!
I was going to post something insightful, but I got a warning from my browser about sending data over an insecure channel to http://slashdot.org and my brain shut down.
The more important thing to research is License click-throughs. If it can be determined that the normal human reaction to a License agreement click-through is to punch right through without reading, it won't be hard in a court of law to declare them void. I make it a practice to NEVER read them. Most other people do too. So I can testify to that in court if ever necessary.
I like reading contracts, but even I got bored after a while and at best skim over them before signing or ticking acceptance boxes.
My company had a customer whose nightly backups were failing. Every time every user in the company (hundreds of them) logged in to the system, they were presented with a message pop-up warning that the backups had been failing. This went on for WEEKS before anyone bothered to notify the software vendor (who managed the backup system).
There seem to be a couple of principles at work here:
1. Not my job. Everybody at the company knew it wasn't their job to keep the backups working, so they ignored the warning.
2. In the way. Everybody had something they needed to do, so they simply clicked whatever they had to (the OK button) to get past the prompt and do their work.
It's like the license agreements on software installers. Everybody just clicks "I Agree" because they know they have to do so to get to the next screen, not necessarily because they actually agree.
This repetition suppression (as it's called) is normal in BOLD responses (the thing fMRI measures). It happens for every stimulus. It also happens when someone reads a word for the second time, and guess what: when reading it for the second time, processing is faster and less error prone. This is called the priming effect. It's hypothesized that it actually shows an accumulation of neural activity. So a "precipitous drop" is nothing to worry about: it's a symptom of the underlying processes, and moreover: it's the wrong thing to look at when you're concerned with traffic safety.
consequences.
This means, if i get a TLS-Warning, it's mostly safe to click it away. Usually its a browser to stupid to ship the CACert Certificate.
This is no problem, because the warning is not neccessary, as the site is secured and the access does not need to be encrypted anyway, because i just want to read something. Nevertheless, the browser panics.
Now i come across some confidential page, which wants me to enter my credit card number. Now i need to awake my brain "hey, maybe i do not want to ignore the warning this time".
We need no bigger warnings. Imagine a TLS-Warning with pictures showing somebody robbing your bank account. Okay, you will get used to it and click away the warning anyway. You know the consequences. But you know the ACTUAL consequences, too. And they are "last 1000 times nothing bad happened".
So the answer is: We need less warnings. Do not warn me, that my connection is insecure with CACert. Have a decent notice, that the CA is not trusted, but the connection is encrypted. Warn me, when it's on a bank. Maybe a bank could indicate in DNS, "hey, strong check please", while my homepage which should be encrypted without much authentication can indicate "hey, maybe you do not know my CA, encrypt anyway if somebody reads the request nothing bad will happen".
Really tired of us in the computer biz enabling people to do stupid things that we can prevent. SSL 3.0 is vulnerable, really sucks. Update it to disable/remove it. If it's disabled, make them swear to God that they really know what they are doing to get it back. Don't let them click through.
We went through this with the Format command. At first you would type in format a:. Unfortunately format defaulted to your current drive so if you typed in format, it clobbered C:. So they added a "are you sure". C: got clobbered. Then they had us type in the volume name, c: still got clobbered. Fool proof, only idiot resistant.