Slashdot Mirror

← Back to Stories (view on slashdot.org)

People Ignore Software Security Warnings Up To 90% of the Time, Says Study (phys.org)

Posted by BeauHD on from the check-for-viruses dept.

An anonymous reader quotes a report from Phys.Org: A new study from BYU, in collaboration with Google Chrome engineers, finds the status quo of warning messages appearing haphazardly -- while people are typing, watching a video, uploading files, etc. -- results in up to 90 percent of users disregarding them. Researchers found these times are less effective because of "dual task interference," a neural limitation where even simple tasks can't be simultaneously performed without significant performance loss. Or, in human terms, multitasking. For example, 74 percent of people in the study ignored security messages that popped up while they were on the way to close a web page window. Another 79 percent ignored the messages if they were watching a video. And a whopping 87 percent disregarded the messages while they were transferring information, in this case, a confirmation code. For example, Jenkins, Vance and BYU colleagues Bonnie Anderson and Brock Kirwan found that people pay the most attention to security messages when they pop up in lower dual task times such as: after watching a video, waiting for a page to load, or after interacting with a website. For part of the study, researchers had participants complete computer tasks while an fMRI scanner measured their brain activity. The experiment showed neural activity was substantially reduced when security messages interrupted a task, as compared to when a user responded to the security message itself. The BYU researchers used the functional MRI data as they collaborated with a team of Google Chrome security engineers to identify better times to display security messages during the browsing experience.

81 of 125 comments (clear)

  1. Do they really ignore them? by Anonymous Coward · · Score: 4, Interesting

    I get various security errors/warnings occasionally. Usually they are informing me that security that I did not care about is not present. For example, a warning about a self signed cert on a website that I wouldn't mind using over plain text: that still more secure than plain old http, so I click off the warning. If it is a site that I normally trust and give personal information to (like log in), I don't mind using it when the security is broken, but I won't hand over private data. Continuing despite a warning is not necessarily ignoring it.

    1. Re:Do they really ignore them? by Z00L00K · · Score: 2

      I agree - and when I get a security warning for my own stuff signed with a self-signed certificate I also happily skip it.

      The problem with security warnings is that they are too clunky.

      --
      If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    2. Re: Do they really ignore them? by Mortimer82 · · Score: 2

      Oh, so you're manually inspecting the self signed certificate every time you visit your website? If not, then how do you know nobody is intercepting your communication, making your self signed certificate as useless as having no encryption at all. What you should do is add your known self signed certificate to your local certificate store, which means that the warnings will stop, unless there is an actual attack or change in configuration which you absolutely do want to be warned about.

    3. Re:Do they really ignore them? by ruir · · Score: 3, Interesting

      It is far more serious than being clunky...many are unnecessarily intrusive. Why should a warning steal the keyboard focus, specially while I am using it? Why could it not be a floating warning only? If some non fatal errors where not seen by the user as a nuisance to be dealt with, maybe more "brain power" could go into processing them?

    4. Re: Do they really ignore them? by Wycliffe · · Score: 1

      Oh, so you're manually inspecting the self signed certificate every time you visit your website? If not, then how do you know nobody is intercepting your communication, making your self signed certificate as useless as having no encryption at all.

      99% of times when I get a signed certificate error, it's to a site where I don't care if it's encrypted. In the 1% of remaining cases, I do look at it and it's usually something like a slightly different domain owned by the same company, a company that forgot to renew their certificate, or some other mundane issue.

    5. Re:Do they really ignore them? by Mr+D+from+63 · · Score: 3, Insightful

      This says they ignore the warning 90% of the time, but the article says 90% of users ignore some warnings. Those are two different things. If you craft a study to show warnings that resemble the types of pop-ups crafted to look like warnings that we condition ourselves to ignore, the result is not surprising. If they are on a computer they are familiar with, and the warnings come from their known anti-virus software, the result would likely be different. Basically, people don't trust what they are unfamiliar with.

    6. Re: Do they really ignore them? by Wycliffe · · Score: 1

      So, you "don't care if it's encrypted", why do you care about the warning?

      I don't care about the warning. Most warnings are just an annoyance. There are plenty of sites that use encryption that really don't need to. If I'm connecting to a random untrusted site on the internet then what difference does it make that my connection to them is secure or even being intercepted by a second random untrusted site?

    7. Re: Do they really ignore them? by JustAnotherOldGuy · · Score: 1

      If not, then how do you know nobody is intercepting your communication, making your self signed certificate as useless as having no encryption at all.

      It's because I don't give a fuck if someone sees my ridiculously banal "communication" with some model railroading site or the data that goes back and forth while I research shit like piano hinges or crosscut saw blades.

      For more sensitive stuff, no, but for crap like that I just can't be bothered to give a fuck.

      --
      Just cruising through this digital world at 33 1/3 rpm...
    8. Re: Do they really ignore them? by Sloppy · · Score: 2

      Oh, so you're manually inspecting the self signed certificate every time you visit your website? If not, then how do you know nobody is intercepting your communication, making your self signed certificate as useless as having no encryption at all.

      No, and he didn't imply that. Here are several situations, in increasing order of security.

      1) The connection is not encrypted or signed. No certs exist. Nobody knows who they're talking to. An active attacker on the network between the two parties, can proxy and impersonate each side. A passive attacker, someone who just gets copies of the traffic, while they can't impersonate, can at least read what everyone is saying. No warning.(?!)

      2) The connection is encrypted, but with unknown parties' public keys. Certs exist but are essentially worthless. An active attacker on the network between the two parties, can proxy and impersonate each side. A passive attacker, someone who just gets copies of the traffic, can't read anything. DANGER! DANGER! FREAK OUT!!

      3) The connection is encrypted, and if you believe certain faceless parties who are totally unaccountable to you and who you don't know anything about, you think you probably know the other side's identity. Active attackers can't do anything, unless they're active enough to coerce or trick the CA. Passive attackers can't read anything. No warning.

      4) The connection is encrypted just like above, but the CA pinky-swears that they really tried hard to make sure. Green URL bar.

      5) As case 3 or 4, but multiple CAs, which might be hard for a single attacker to simultaneously coerce or trick, have all signed the cert. We don't have this in our browsers yet; it's early 1990s level tech that we're still waiting for.

      6) As case 3 but the user has verified the identity through a different channel. No trusted introducer was needed. The cert need not be signed at all, or might be signed by the user himself. No warning, but also no green URL bar. (Yet, this is the very best-possible case, definitely more secure than any other.)

      See anything wrong here? Scenarios 1 and 2 have their warning severities reversed. (And there's also a UI defect at high degrees of security, too, but that's less important.) This trains the use to think of warnings as not necessarily meaning increased severity or risk. A user will adjust to this by ignoring warnings. This is bad communication, and it's making us all a little stupider.

      What you should do is add your known self signed certificate to your local certificate store, which means that the warnings will stop

      He's talking about a situation where it's not known. Adding it to the local store would be inappropriate. That would be an attempt to treat scenario 2 as scenario 6, just to get around a UI bug. It'd be much better to just fix the bug.

      --
      As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
    9. Re: Do they really ignore them? by Mortimer82 · · Score: 1
      You're not wrong, the way that the UI works and how users use it is a big issue. SSL only provides a way for you to absolutely determine you're talking to a particular party, or that a party who you already trust has supposedly vetted that the party you are talking to, is the party you think it is. And I agree the issue with the green bar is that it just means that things "seem legit", but unless users understand how to inspect certificates for themselves, it's not actually much use. As we can't realistically expect all users to be better informed, it would instead be better to improve the UI.

      However, what I was really addressing was this:

      For example, a warning about a self signed cert on a website that I wouldn't mind using over plain text: that still more secure than plain old http, so I click off the warning.

      I have bolded the part that is factually wrong, unless they are actually checking self-signed certificate thumbprints, the unverified certificate is no more secure (or at best, only negligibly more) than plain text HTTP.

    10. Re:Do they really ignore them? by EndlessNameless · · Score: 1

      The reduced neural activity (when warnings interrupted a task) indicates they are ignoring/dismissing the warning rather than assessing it and deeming it unreasonable.

      If they were giving it consideration like you do, there would be roughly equal activity regardless of whether it interrupted their activity.

      Along those lines, if that's what you normally do then you are not a typical user.

      --

      ---
      According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
    11. Re:Do they really ignore them? by k6mfw · · Score: 1

      Of course I ignore it, I forwarded the article to a friend and up pops a message, "Chrome has detected unusual behavior" (crap, I and friend ain't using Chrome!)

      --
      mfwright@batnet.com
    12. Re: Do they really ignore them? by david_thornley · · Score: 1

      If nothing else, a self-signed certificate presents a smaller attack surface, and it's a single point of verification if I do care about secure communications.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    13. Re:Do they really ignore them? by david_thornley · · Score: 1

      There's classes of warnings I deliberately ignore for considered reasons. If I think running something is safe, I just click through UAC warnings without further thought.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  2. Software Security Warnings: by Anonymous Coward · · Score: 5, Funny

    The "Check Engine Light" of the computer world.

    1. Re:Software Security Warnings: by Z00L00K · · Score: 5, Funny

      Yup - the engine is still there.

      --
      If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    2. Re:Software Security Warnings: by Tablizer · · Score: 1

      [Check Engine light]
      Yup - the engine is still there.

      Check your other engine also.

      --
      Table-ized A.I.
  3. That's an easy one. by EzInKy · · Score: 5, Funny

    There are just way too many of them and they are simply too hard for a normal user to evaluate whether the risk is truly severe or just another attempt of somebody to fleece them.

    Health care example:

    Monitor shows the patient is in asystole. On assessment the patient is alert, talking, and in no apparent distress. Diagnosis is it is the equipment, not the patient, who disturbed the night's routine. Outcome? You lecture the patient for exceeding the devices operating parameters and tell him/her to quit moving and perspiring so that the monitoring devices may correctly interpret typical human norms.

    --
    Time is what keeps everything from happening all at once.
    1. Re:That's an easy one. by DNS-and-BIND · · Score: 3, Interesting

      You laugh, but damn that is shockingly accurate. "Change your behavior so the software works right" used to be absurd, but today it is apparently the default response from support. Remember Apple's "you're holding it wrong" debacle?

      --
      Shutting down free speech with violence isn't fighting fascism. It IS fascism!
    2. Re:That's an easy one. by Wycliffe · · Score: 2

      There are just way too many of them and they are simply too hard for a normal user to evaluate whether the risk is truly severe or just another attempt of somebody to fleece them.

      This. Most users just click thru popups. The almost always just click "OK". If you want them to actually read the message then maybe "OK" should default to turning off the computer. Even adults do this but for kids it's even worse. Adults will typically pause if there is a dollar sign somewhere. Kids will happily click along and click buy on inapp purchases, etc... if it means they can get back to their game.

    3. Re:That's an easy one. by nine-times · · Score: 1

      There are just way too many of them

      And some of them are fake. There are a lot of ads and malware that mimic a security alert in some way, which only trains users to ignore them faster.

      Also, not only do users not know how to evaluate the risk, they don't know how to fix the problem. If an alert pops up and says, "You may have a virus", the user can't tell if that's a scam, a false alarm, or a real problem. Regardless of whether it's real, false, or fraudulent, they don't have any idea what to do about it.

    4. Re:That's an easy one. by Coren22 · · Score: 1

      Yeah, because responding with sarcasm to your customer's legitimate issues with a poorly designed product is the right response.

      http://www.dslreports.com/show...

      Also, clearly, the Apple response wasn't sarcasm at least in writing, and it was a silly response too.

      --
      APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
    5. Re:That's an easy one. by david_thornley · · Score: 1

      "You're holding it wrong" has nothing to do with "change your behavior so the software works right". The reference was to holding the iPhone so that the hardware worked right. As far as I could tell, while the design was dumb, the issue was not as serious as the press made it out to be, and it is true that some other phones will have problems if you hold them in certain ways.

      When I got into the field, more than forty years ago, software was normally written on spec for specific organizations. Where I worked, the accounting software was written around the accounting practices. Since then, there's been the shrink-wrap revolution, so I can buy an accounting package that works for far less than I can have one written to my specs, but to use the shrink-wrap one I have to change my behavior.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  4. It's because 90% of security warnings are rubbish by El+Cubano · · Score: 5, Insightful

    In my experience, 90% of security warnings are rubbish. For example, I recall when UAC came to Windows Vista. I don't ever recall clicking deny/cancel/no (or whatever it was) with the possible exception of a situation like "oops, I meant to click the executable right next to that one."

    Same deal with Java applets. My bank uses a Java applet for depositing checks. I get a warning from the browser every single time, despite selecting the "always trust applets from this publisher" (or something like that option).

    Of course, there are lots of software packages with instructions like "Step 1: Disable your antivirus." or, worse, "Step 1: If you get any security warning dialogs just click to accept them."

    In fact, I've never encountered a single person who can actually point to an occasion where a security dialog alerted them to a real threat that was then neutralized. Even worse, one of the more common warnings (the untrusted SSL certificate/issuer) has confused people even more into thinking that "red address bar means not secure and green lock means secure", when in fact your browser's trust of the certificate's issuer has exactly zero impact on how secure the connection is. We've been conditioned to treat all these warnings as noise. Incidentally, people ignore speed limit signs at least 90% of the time for exactly the same reason: we've been taught that they're meaningless.

  5. 90% Of Security Warnings Are Bullshit. by EzInKy · · Score: 2

    Running wrong OS, get a security warning. Running on the wrong hardware, get a security warning. It's no wonder most users see security warnings as overblown BS.

    --
    Time is what keeps everything from happening all at once.
  6. Re:how about false security pop ups? by EzInKy · · Score: 1

    Because Microsoft started it all.

    --
    Time is what keeps everything from happening all at once.
  7. It's because you can't right now. by thedarb · · Score: 3, Insightful

    You have your documents up, half written, spread sheets with data you need for on-call, a long running backup in a window you forgot to run in Screen or tmux, and any other number of things that mean you can't reboot right now. Especially if it's going to be a reboot that says "don't turn off your computer, we're messing with shit for 30 minutes." We have boss' breathing down our necks for productivity, there's no time to reboot and wait.

    Besides, it might make me lose my place when browsing imgur. Fuck that! :)

    --
    This sig intentionally left blank.
  8. "Hey, watch this!" by PopeRatzo · · Score: 4, Informative

    People ignore all sorts of warnings. It's how we do. There are still people smoking when every single pack of cigarettes they buy has a big sign that says, "These motherfuckers will kill you dead, dummy, and in a really horrible way". What was the last time anyone "closed cover before striking"? A Texas man sees a sign that says, "No Swimming - Alligators." He immediately says, "Man, fuck that alligator", jumps in the water and is instantly eaten by an alligator.

    http://www.unilad.co.uk/video/...

    Chinese-made fireworks have a big-ass label (in English) that says, "Set on ground, light fuse and GET AWAY". Did that stop this guy from putting one in his pants and then blowing himself up? No sir, it did not. Because for human beings, warnings are really just dares.

    https://youtu.be/8Yagjf5B2tw

    --
    You are welcome on my lawn.
    1. Re:"Hey, watch this!" by PolygamousRanchKid+ · · Score: 1

      Ask any IT security folks what the biggest threat is to security.

      They'll tell you, "The loose nut behind the keyboard!".

      Hmm . . . maybe MTV could film a series titled, "Computer Jackass" . . . ? All the IT support folks that I've talked to privately have hilariously stories of people doing . . . well, stuff that they should have enough common sense not to do:

      "I couldn't find the shutdown button, so I just pulled the power plug."

      --
      Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
    2. Re:"Hey, watch this!" by Entrope · · Score: 1

      Computers would be so secure if people just didn't try to use them!

      It's silly to blame security problems on the fact that people are involved. Developers and admins blame users when those developers and admins can't be bothered to design (or deploy) practices and procedures that address the blind spots and habits that users pick up when they use a system.

    3. Re:"Hey, watch this!" by nine-times · · Score: 1

      A Texas man sees a sign that says, "No Swimming - Alligators." He immediately says, "Man, fuck that alligator", jumps in the water and is instantly eaten by an alligator.

      Surprising that it wasn't a Florida man.

    4. Re:"Hey, watch this!" by EndlessNameless · · Score: 1

      Developers and admins blame users when those developers and admins can't be bothered to design (or deploy) practices and procedures that address the blind spots and habits that users pick up when they use a system.

      For a few years, this was exactly my job.

      The end result is always users bitching to management, and then management has to decide between what their favorite employees say and what IT says. In the absence of an intelligible business need for security, the users win.

      I have seen IT security guys win most often in the finance, healthcare, and defense industries. Outside of those three, no one else cares.

      So don't blame developers or admins. Developers put the security infrastructure there, and admins configured/deployed it. And the users throw fits.

      Security is like preventive maintenance---there is a cost associated with it, and the benefits are not entirely tangible. Doing it is smart, but not everyone makes smart decisions. Or has the discipline to follow through once they make them.

      --

      ---
      According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
  9. Software ignores customer security all of time by Bob_Who · · Score: 2

    Warnings. Its a gimmick in social engineering, really. If we ignore our own security ever, then we can't blame the software for selling us short. It's more of a marketing gimmick and liability issue for the software vendors. They can't possibly save us from ourselves. They can manage to let us fool ourselves if that's our preferred frame of mind. Honestly, we always knew we are not in control, but like a fatal car crash, we just figured it only happened to somebody else. Welcome to denial, its all the rave - everybody is doing it.

  10. Calling Captain Morgan by Tablizer · · Score: 1

    We all have a little Hillary in us ;-)

    --
    Table-ized A.I.
  11. Re:how about false security pop ups? by NotAPK · · Score: 2

    A good example is the way keys are generated automatically for Windows Remote Desktop.

    The system regenerates these automatically every 6 months. There is no way to manage this process (as far as I can tell, links welcome!) so as a user I get semi-regular warnings while connecting to regular hosts that the connection is not secure. At that point I have no way of knowing if the keys simply expired or I am being subjected to a MITM attack... :( What to do?

  12. [ OK ] by swell · · Score: 1

    This program has successfully erased your bootable hard drive. Erase another?
    [ OK ]

    Why do I have to click 'OK' to every disastrous pop-up warning on my screen?

    It's NOT OK!

    I'm not allowed to click GODDAMMIT or WTF, I have to click OK or forever look at the stupid dialog box. This box appears only at times of greatest inconvenience and always cheerfully asks for an 'OK'. I'm not usually feeling cheerful after these fatal crashes and I'm reluctant to say OK. Whoever designed the OK dialog for unpleasant events should die a thousand horrible deaths at the hands of a crazed Slobbovian machinist, pig farmer and torturing apprentice.

    --
    ...omphaloskepsis often...
    1. Re:[ OK ] by johannesg · · Score: 1

      Maybe it is because not everybody enjoys profanity as much as you do? Could you think of anything that could be on that button and still be culturally neutral, recognisable, and not offensive?

    2. Re:[ OK ] by Anne+Thwacks · · Score: 1
      I remember, long ago, a German Shareware product, which had a dialogue box like this

      %<----------

      Something really bad has happened

      [ ] OK

      [ ] Oh, Shit

      %<-----------

      I always clicked the second button. I don't suppose it made a lot of difference to what happened, but it definitely demonstrated great UI design skills.

      Is the lameness filter there to demonstrate lameness?

      --
      Sent from my ASR33 using ASCII
  13. Re:It's because 90% of security warnings are rubbi by NotAPK · · Score: 2

    I use Sandboxie a lot for software evaluation purposes. However, when I right click an executable and want to choose "Run Sandboxed" that entry is right next to the "Run as Administrator" menu item. Late at night it's easy to click the wrong one, with potentially disastrous* consequences! The UAC prompt saved me a couple of times.

    Since then I've found moving to virtual machines with snapshots has been an easier and safer way for testing unknown software.

    *Time vs time. Everything is backed up and best practices are always followed. But it's always a question of how much time is available to recover.

  14. Another reason people ignore stuff. by MrKrillls · · Score: 1

    Browsing the net, endless meaningless things pop up with absolutely no relevance to the user. We get really good at clicking unwanted junk off the screen. Result, what's the first instinct? Lunge to get rid of that distraction. No matter how locked down one's browser is, some message frequently interferes, and we become very well trained to set the distraction aside. Every once in a long while, the distraction has value. Or, had, before I killed it and then wondered if maybe I was a bit hasty.

    --
    Don't step on the baby.
    1. Re:Another reason people ignore stuff. by jeti · · Score: 1

      I really hate warnings about self-signed certificates or unsigned embedded content. Browsers make these sites look less secure than unsigned ones.

  15. Re:how about false security pop ups? by Anonymous Coward · · Score: 1

    From "Genuine Advantage" during the XP days, to UAC of Vista/Win7/Win8/Win10.

  16. Windows 7 and above has a MAJOR problem with this by Anonymous Coward · · Score: 1

    And even worse the cretins at Microsoft took out the functionality from Windows 7 and above that allowed you to stop popups staling focus.

    Every single week at work I end up clicking an unknown button on a prompt because I'll be in the middle of typing something and a dialogue will pop up, steal focus, and whatever keystrokes I'm doing at the time ends up clicking a button on a prompt I don't even get a chance to read as by the time I notice it's stolen focus I've already typed ahead causing me to inadvertently send keystrokes to the prompt.

    This regularly causes me to lose work as the prompts will cause my machine to reboot right in the middle of doing something important etc. etc.

    Under XP you could make a registry change which would totally block focus being stolen by anything. Under Windows 7 and above they deliberately took out this functionality.

    I would *very* much like to meet the arsesholes at Microsoft who removed this feature and shake them warmly by the throat. After which I would put on my size 12 hobnail boots and kick their fucking heads right off their bodies..

    They're total cretins.

  17. Trainer to be so by Rande · · Score: 2

    The slightly less than average user can't (easily) tell the difference between a valid security message and a browser popup claiming that something dire will happen unless they click on this message and run this program, so they ignore them all.
    Just last night I had to tell my mother that the browser complaining about being out of date and to upgrade was probably valid.

    Also in the same call, had to try and reassure her that smart meters weren't going to burst into flame and/or make her sick with the power of wireless electromagnetic radiation. ...and she still decided not to get one because of all the random people on the internet claiming they were evil. "But this guy is a M.D. from England! He's got to know all about it right?"

    1. Re:Trainer to be so by pr0fessor · · Score: 1

      Makes you think somewhere out there is a doctor that graduated at the bottom of his class.

  18. Re:It's because 90% of security warnings are rubbi by Z00L00K · · Score: 1

    Here they only lower the speed limit, but they rarely enforce it so people drive as they see fit.

    The few that follows the speed limit causes some "interesting" driving.

    --
    If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
  19. This is great news! by perfectn · · Score: 2

    This means all we need to do is to give the user 10 warnings and statistically they'll pay attention.

  20. Re:It's because 90% of security warnings are rubbi by Anonymous Coward · · Score: 1

    Take your "browser's trust of the certificate's issuer has exactly zero impact on how secure the connection is". That feels pretty true to you, right? Except, if the browser doesn't trust the certificate issuer the connection isn't "secure" in any meaningful way.

    Imagine if your local bank has a great new scheme they'll keep your valuables 100% secure. They have a steel bank vault, with armed guards and you can keep your stuff in it entirely free of charge. Brilliant right? And it's also really convenient, you can just drop by any time, drop stuff off or pick it up. So can anybody else. Wait a minute though, how "secure" is this facility? Well it's 100% secure. Except, it ignores who owns the stuff. If you drop off a gold bar, and then somebody else walks in and takes it, eh, no problem, we've securely held on to the gold bar until someone collected it. Oh! Is that not what you wanted? But you were so sure you only cared about keeping things "secure" and not making them "secure" against anything.

    Without verifying the other party's identity a "secure" connection is worthless because you have no idea who you're "securely" communicating with, and so absolutely anybody can intercept or alter everything and you're none the wiser.

  21. Developers are at fault by mvdwege · · Score: 5, Insightful

    This is all the developers' fault. They are so fucking lazy that they think throwing up a dialog is a solution to the problem. After all, if the user clicks on it, they assented, right?

    Microsoft is by far the worst offender, but they are not alone. And this abdication of responsibility by programmers has trained the users to just blindly click away warnings. And they are right: 99% of the time they are bullshit, a symptom of a problem the developers should have fixed.

    --
    "I know I will be modded down for this": where's the option '-1, Asking for it'?
    1. Re:Developers are at fault by dinfinity · · Score: 1

      99% of the time they are bullshit

      So are seatbelts.

      But perhaps you can enlighten us with examples of 'problems the developers should have fixed'?

    2. Re:Developers are at fault by mvdwege · · Score: 1

      How about not executing files from the Internet, instead of throwing up a 'this may be dangerous, are you sure' dialog?

      For fuck's sake, where have you been the past thirty years?

      --
      "I know I will be modded down for this": where's the option '-1, Asking for it'?
    3. Re:Developers are at fault by pla · · Score: 1

      You have it both 100% correct, but completely wrong.

      Yes, as a dev, I choose to pop up a mostly useless dialog asking the user how to proceed when something seems amiss. I know for a fact that the users almost never actually read them, because when I get a call and ask them what the error said, they invariable need to go try to reproduce the error - And I make a point of writing human-readable error messages like "Your file vanished after I saved it, Dave", nothing like "Error 102, sprongle interface not loaded at 0xDEADBEEF".

      But in the example I gave - Do I not tell the user that their file, which the OS reported as successfully written to disk, somehow magically no longer exists? Sure, I could blindly try again a few times (and when safe, I would)... But if it keeps happening?

    4. Re:Developers are at fault by dinfinity · · Score: 1

      That is a counterexample.

      What you propose would be superannoying, namely having to take an extra step to go to the downloads folder and then run the file. At that point the OS doesn't even know that it was a file just downloaded from the internet which would make showing a warning dialog at that point even more annoying as it would have to do so for every executable, always.

      Also, please keep your ad hominems to yourself.

    5. Re:Developers are at fault by cellocgw · · Score: 1

      What you propose would be superannoying, namely having to take an extra step to go to the downloads folder and then run the file. At that point the OS doesn't even know that it was a file just downloaded from the internet which would make showing a warning dialog at that point even more annoying as it would have to do so for every executable, always.

      The OSs I'm familiar with can in many cases retain a "this was downloaded" tag of some sort. Certainly there's a warning message in OSX the first time you run a new app; I dunno how WIndows7 tags files downloaded from some places (Sharepoint) but not others (Outlook), but I do get warnings about "This Word document came from THE INTERNET [wtf that means]..." .

      --
      https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
    6. Re:Developers are at fault by mvdwege · · Score: 1

      If you are too stupid to know what an expression means, you should not use it. The rest of your post is of the same level, so fuck off, idiot.

      --
      "I know I will be modded down for this": where's the option '-1, Asking for it'?
    7. Re:Developers are at fault by dinfinity · · Score: 1

      I can see you're much better at swearing than at reasoning or even basic civility.

      You waste my time.
      Goodbye.

  22. 10% margin for error by Gumbercules!! · · Score: 1

    "People Ignore Software Security Warnings Up To 90% of the Time*"
    - *Study has a 10% margin for error...

    (I'm joking but.. you know).

  23. Re:It's because 90% of security warnings are rubbi by WaffleMonster · · Score: 1

    Even worse, one of the more common warnings (the untrusted SSL certificate/issuer) has confused people even more into thinking that "red address bar means not secure and green lock means secure", when in fact your browser's trust of the certificate's issuer has exactly zero impact on how secure the connection is.

    So umm... how else would one... you know....um...ah... be able to tell how secure the connection actually is? Are they supposed to guess? Check to see if the evil bit is set? What do you recommend?

  24. There and gone by garryknight · · Score: 1

    I've lost count of the number of times something popped up while I'm typing, just as I'm about to press the Enter or ESC keys, leaving me wondering what I just broke or signed up to.

    In Windows 10, non-critical messages are signaled in the status bar. A flashing icon could be less destructive than an easily-dismissed dialog.

    --
    Garry Knight
  25. Missing some context by MistrX · · Score: 2

    What was the security warning about? And what was required of me?
    To me this is kind of the important part in combination with this: "when security messages interrupted a task". As I have learned from my parents, you don't go haphazardly interrupting people with some kind of nonsense. If you do, you can expect to be ignored or be told off. If a security warning is about to inform me that a scheduled scan will start in an hour, or a patch will be downloaded. I'll ignore it. It doesn't require my attention at this time and I was busy with something. It interrupted me with nonsense so it's annoying me and I clicked it away. Another point of contention is if the message requires me to do something like restarting the system. If I'm in the process of doing something that needs up time (be it from watching a video, to copying files), I will complete that task first. Task prioritization is key here and interrupting me is again, annoying. Even if it does want me to do something.

    So yeah, I get where these figures come from. Not at all astounding to me.

  26. Re:It's because 90% of security warnings are rubbi by buck-yar · · Score: 2

    The 85% of cars would be driving faster, but since you can't literally drive through the car in front of you, you can only go as fast as the car in front of you.

    The only way to correctly figure the 85th percentile would be to only measure car's speed that had no car around being impeded by another car. Counting two cars at the same mph (as the rubber counter does) is bad data as clearly the person following behind would be driving faster as they caught up to the person.

  27. Re:It's because 90% of security warnings are rubbi by packrat0x · · Score: 1

    Completely off-topic, but shockingly insightful.

    --
    227-3517
  28. Re:It's because 90% of security warnings are rubbi by AmiMoJo · · Score: 2

    UAC was actually designed to be bad. Microsoft wanted to change developer's behaviour, stop them making every app install a background task that starts at boot, dumping files all over the place and generally behaving badly. But at the same time they didn't want to break backwards compatibility, so UAC was invented.

    UAC annoys the user. Developers try to avoid creating UAC prompts that annoy their customers. By the time Windows 7 rolls around, most apps are better behaved. Unfortunately, people are also de-sensitized to UAC warnings.

    --
    const int one = 65536; (Silvermoon, Texture.cs)
    SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  29. Re:It's because 90% of security warnings are rubbi by danbert8 · · Score: 1

    I'm a civil engineer and I call bullshit. That's how engineering studies recommend speed limits that are then completely ignored by government officials who insist on keeping a stupidly low speed limit "for the children" and for revenue generation.

    --
    Yes it's an anecdote! Were you expecting original research in a Slashdot comment?
  30. Too many unnecessary warnings by BinBoy · · Score: 1

    Notice the world hasn't ended despite people ignoring security warnings. They were unnecessary. People tend to ignore spam.

  31. Some of this sounds perfectly rational by Chrondeath · · Score: 1

    Ignoring messages (read: popups) "when going to close a web page"? Of course I'm going to ignore those--I don't think I've ever seen a legitimate security warning when I was trying to close a page, but I have seen a lot of sleazy attempts to prevent me from leaving someone's web site. What action is it that I'm performing by closing the web page that I might be making a mistake with? What alternative path is being suggested to me there, just leave the page up forever?

    In the other direction, paying attention to warnings "after interacting with a web site" makes sense--if the site is lying to me about its identity or doing sleazy things with javascript, telling me about that lets me know that I should probably trust it less and at least think twice about providing sensitive information to it or downloading executables from it.

  32. Don't care != multitasking is hard. by pla · · Score: 1

    This has nothing to do with "dual task interference", it comes from "I just want the damned thing to work".

    So my browser tells me something-something-Flash-something, do I really want to watch that YouTube video? That question has only one possible answer: "Kittens". No one, ever, not even the most paranoid of security researchers, has ever intentionally said "no, never mind, I don't really need to see kittens, thanks for the warning, Firefox!".

    The real problem here (if any) comes from too damned much crying wolf. People ignore warnings because we see dozens of them every day, and 99.9% of them mean absolutely nothing (and the remaining 0.01% just mean that if the NSA has already infiltrated your ISP, they can use what you want to do to maybe get a bit more access to your home PC).

    Even antivirus software has this problem - Yes, I know that netcat can be a "hacking" tool; it's also really fucking useful.

  33. Why is our society so stupid? by alternative_right · · Score: 2

    Another completely obvious fact which somehow industry has overlooked.

    How would this be?

    Well, let's see: each person's career depends on making his boss feel good and not rocking the boat. So the programmer does what he is told, chuckling about how stupid it is every day. His boss does what the committee says is right, shrugging off his frustration. The committee does whatever it can achieve agreement on among its members, while being "safe" because committees are ruled by fear. Its members are doing what they think the CEO wants, and he does what he thinks the shareholder wants, which generally means whatever is easy and inoffensive.

    In this way, we all play "follow the leader" and end up approving stupid ideas because each person is afraid to push back against accepted "knowledge."

    Enjoy your dysfunctional GUIs, badly-conceived products, stupid movie sequels and other committee output.

    --
    Alternative Right.
  34. Research results will be used by advertisers by billrp · · Score: 1

    TFA has results for when it's the best time to throw up a security alert - but these times can also be used by advertisers to display ads

  35. Don't use "Up to x%" by Maritz · · Score: 1

    Because logically it also means at little as 0%. It means fuck all. Let's stop encouraging advertisers to talk this shit. ;) Sex Panther is the one exception.

    --
    I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
  36. Why even bother? by kheldan · · Score: 1

    In 2016 it's essentially impossible to 'secure' a computer anyway, even if it's not connected to the Internet and never was in the first place. Malware, spyware, trojans, rootkits, virii, zero-day exploits are everywhere, including methods of electromagnetically or even accoustically observing a computer in operation from a distance and determining what's being done on it -- and of course if you connect to the Internet, having every single packet sniffed, sifted, and sorted to produce a personal profile of the user, for marketing and government spying purposes. The only 'computer' that's even relatively safe would be one that is completely and totally read-only, retaining nothing but what's in the ROMs when you shut it off. The 'Age of Information' has been twisted and subverted into a dystopian 'Age of Surveillance and Spying' that only seems to really benefit nosy governments, greedy marketers, and criminal organizations.

    Go outside. Leave your phone and other so-called 'Internet of Things' gadgets at home. Get some exercise. Stay away from places with cameras and other surveillance. Talk to real, living people instead of using so-called 'social media'. Buy a real paper book, not e-books. Go home at night and actually sleep, instead of staying up to all hours watching TV or staring at a computer screen.

    --
    Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
    1. Re:Why even bother? by kheldan · · Score: 1
      Quick, everyone, hire a teenage public school-educated Millennial while they still know everything!

      He thinks his computer is 'secure'
      laughinggirls.jpg

      --
      Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
  37. Re:Some OS's don't ignore virus's though... by Coren22 · · Score: 1

    What does the OS and virus possess? And why should we worry about it?

    --
    APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
  38. Re:how about false security pop ups? by EndlessNameless · · Score: 1

    If you have network-level authentication enabled, RDP requires a certificate.

    If you have an enterprise CA that the machine can autoenroll with, it will request one. If not, it will generate a self-signed cert with a 6-month expiration period.

    You would have to hit TechNet and read several articles to get it squared away. There are articles that address setting up a primary/intermediate CA infrastructure, configuring autoenrollment, and using Group Policy to configure RDP.

    This is for enterprise, of course. You can manually create a certificate that lasts for 100 years on one-off hosts, trust it on the other end, and you're good to go.

    The regeneration only occurs because a valid certificate is required but not available---if you put one there that lasts longer, the system will continue to use it until it expires.

    --

    ---
    According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
  39. Re:how about false security pop ups? by NotAPK · · Score: 1

    Thanks, you've inspired me to look into it in more detail, cheers.

  40. Re:It's because 90% of security warnings are rubbi by RavenLrD20k · · Score: 1

    My municipality only seems to have tubes long enough to span one lane. I suppose it's a budget cutting measure, but I've only ever seen them do the traffic speed/volume checks where the roads only have one lane in each direction. Could also be that the areas with more than one lane (each dir) have speed limits too high for the tubes to stay put (55-65mph).

  41. Re:It's because 90% of security warnings are rubbi by EndlessNameless · · Score: 1

    For example, I recall when UAC came to Windows Vista.

    The UAC prompt isn't a warning in the typical sense. It is a request for elevated privileges. The system must receive a response to determine whether or not the process is granted those privileges. The warning text is supposed to discourage users, but the prompt is necessary because the process will not be granted those privileges in the absence of user consent.

    I get a warning from the browser every single time, despite selecting the "always trust applets from this publisher" (or something like that option).

    Agree here. Either the browser is stupid, or the publisher is stupidly using different certificates every time.

    Of course, there are lots of software packages with instructions like

    They are working around false positives. Antivirus vendors are pretty much the undisputed kings of crying wolf.

    In fact, I've never encountered a single person who can actually point to an occasion where a security dialog alerted them to a real threat that was then neutralized.

    The malware developers generally try to avoid generating unexpected warnings, so I wouldn't be surprised if most alerts are merely noise.

    I've personally declined to log into my banks' web sites when they had SSL certificate issues, but I don't know if it was caused by configuration issues on their end or a MITM. I didn't exposed my credentials, so I never bothered to follow up.

    --

    ---
    According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
  42. Re:It's because 90% of security warnings are rubbi by EndlessNameless · · Score: 1

    When Windows 7 came out, the first thing a gamer did was to disable UAC.

    Maybe the dim-witted ones.

    Most games trigger UAC because they want to write to the Program Files directory, either to change their config files or to store saves. Installing them to any other directory avoids this problem.

    Some really legacy games require admin rights because they make system calls that are privileged, write to the HKLM registry hive (instead of the user hive), or write to the Windows directory. Very very few fall into this category, and they can be tweaked by configuring them to always run with those privileges. There is an option in the Windows UI to do that.

    In any case, disabling UAC is basically never necessary to get games working if you understand how it works.

    --

    ---
    According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
  43. Uh, there are other reasons... by poofmeisterp · · Score: 1

    For instance, I freeze certain apps on my phone and unfreeze them only when I want to use them (games, etc) because updates cause the Wool and Placation Affect (call it WPA if you want):

    Wool = pulling the wool over consumers' eyes with the new "SECURITY ALERT OMG OMG" version update that suddenly may 1) not have a security issue and adds other "features" like ads, lockouts of old free features, new pay-teaser features, etc, or 2) has a real security issue but bundles 1)'s items in.

    Placation = Tries to add a piece of something into the software to make the consumer feel better about now having to pay for a feature, being bombarded with more ads, etc.

    Then there's the Google Update Effect (GUE) - Put out updates, but don't say a damn thing. Following Microsoft's behavior, disgustingly. Update to the "Google" App (and all of the others under Google, actually) say "Bug fixes and performance improvements", or BFPI. There is absolutely no list of what those bug fixes or performance enhancements were. Actually, all of Google's apps do the same thing sans "Maps", which usually has some new feature they can make some money off of while costing the consumer nothing but "WOW, I wanna do that!" Disclaimer: yesterday's Google App update says "We're excited to introduce the 2016 Doodle Fruit Games! For a limited time only, play free games in the Google app. Just tap the homepage Doodle to play. Ready, set, fruit!....", and then mentions getting the latest on the olympic games, blah blah. It's the first time I've seen that app say anything other than BFPI.

    Microsoft, as mentioned above, bundles crap into their "security updates" that the user can very strongly not want or actually refuse to accept, IF THEY KNEW ABOUT IT. MS doesn't mention that part, just the "Hey, security!! Install now, Slow McSlowerton!"

    It's a bit deeper than "timing", "interference", and other assumed things mentioned in the article. Yes, there are intelligent people that actually analyze what they're getting themselves into and don't just click "GO! AWESOME, I WANT IT!" willy-nilly.

    P.S. There is a game - Words With Friends on 'droid and the web. It's a Scrabble knock-off. It updates its program features and interface behavior in the background, live, while playing the game. It releases actual release-class updates to be installed when they want to bundle ads in to work around ad-blocking components or circumvent user findings to work around their crap.

  44. Is it really a warning or a shakedown to sell? by k6mfw · · Score: 1

    Seems to me all these are all "computer security has expired! click here to update [and pay money]."

    However, multiple warnings lead to "alarm fatigue" i.e. part of a situation that caused a B1 in flight test to crash. Lots of warning lights for low/moderate stuff, crew acknowledge the alarms and proceed on. Then comes CG warning but they didn't pay much attention to it, until the aircraft tilts and stalls. from http://www.nasa.gov/connect/eb...

    --
    mfwright@batnet.com
  45. Not every warning services the user by allo · · Score: 1

    TLS certificate not trusted.

    Most the time this is IMPORTANT.
    But too often, it just tells me "somebody did not setup the right CA certificates for you".

    And try to root your nexus phone. On every boot you get a "This device is inscure, read more at goo.gl/blablub" warning, because i have an unlocked bootloader.
    Fuck you, i choose to have one. Please notice me, when something actually replaced something without my command.