Half Of People Click Anything Sent To Them (arstechnica.com)

Want to know why phishing continues to be one of the most common security issue? Half of the people will click on anything without thinking twice ArsTechnica reports: A study by researchers at a university in Germany found that about half of the subjects in a recent experiment clicked on links from strangers in e-mails and Facebook messages -- even though most of them claimed to be aware of the risks. The researchers at the Friedrich-Alexander University (FAU) of Erlangen-Nuremberg, Germany, led by FAU Computer Science Department Chair Dr Zinaida Benenson, revealed the initial results of the study at this month's Black Hat security conference. Simulated "spear phishing" attacks were sent to 1,700 test subjects -- university students -- from fake accounts. The e-mail and Facebook accounts were set up with the ten most common names in the age group of the targets. The Facebook profiles had varying levels of publicly accessible profile and timeline data -- some with public photos and profile photos, and others with minimal data. The messages claimed the links were to photos taken at a New Year's Eve party held a week before the study. Two sets of messages were sent out: in the first, the targets were addressed by their first name; in the second, they were not addressed by name, but more general information about the event allegedly photographed was given. Links sent resolved to a webpage with the message "access denied," but the site logged the clicks by each student.

Comments

This is what happens

[Anonymous Coward]

This is what happens when browser makers hide the status bar, hide the location url/protocol and generally dumb down the location parts of the UI.

Removing those essential browsing elements are like removing streets signs because everyone has a GPS, bring back the status/url bars and educate people to know what their function is.

Re:This is what happens

[amicusNYCL]

Yeah you're exactly right, the half of the population who click on anything would totally not do that if only they could see the protocol. Because that's what was keeping everyone safe for so many years back in the halcyon days of innocence when everyone used IE6 and malware was non-existent.

I don't think the URL field has been dumbed down at all, it hides things that you don't generally need to see (there's still an indicator if the page is secured or not, instead of expecting random people to know the difference between "http://" and "https://"), and it emphasizes things that are more important, like making the root domain stand out and writing the rest in a lighter shade. That actually helps people who got sent to facebook.com.pwned.net figure out which site they're actually on, it doesn't make anyone stupider. I can look at the URL and obviously tell that I'm on a subdomain of slashdot.org, because the root domain is written darker.

And the status bar? Really, grandma? Can you name a single browser that does not show the URL of a link that you're pointing to when you point at it? Why have an area of the UI dedicated to showing that, which isn't being used if you're not hovering over a link? If you're thinking of some other purpose of the status bar that we've lost without a replacement, just what sage advice do you think it was dispensing that we need to bring back?

Color me surprised

[Feral Nerd]

Half Of People Click Anything Sent To Them

Actually 49.5% of people click anything sent to them, another 49.5% double click anything sent to them. The remaining 1% are nerds who know better.

People actually click on email links?

[hackel]

I actually get really frustrated because 99% of all email links cannot be clicked because of embedded tracking information. It makes pretty much any email newsletter/update/etc. completely useless. I spend far too much time going to a website and finding something I want to look at, all because I refuse to click on a link that contains tracking information. I can't believe so many people, especially students, are dumb enough to do this. And yet, I can believe it. It's just sad.

Imagine the stupidity of the average person

[penguinoid]

Imagine the stupidity of the average person -- then realize that half of them are dumber than that.

Re:Imagine the stupidity of the average person

[Pfhorrest]

Some are even dumb enough to think that "average" only means "mean", and that a median isn't a kind of average...

Re:Imagine the stupidity of the average person

[hambone142]

The majority of people believe in an invisible friend in the sky.

About half, eh?

[Dunbal]

Those are the people we put on the "B" Ark.

Re:Sheep are among us

[Princeofcups]

High school students are told that Pavlov taught dogs how to drool with a bell, because it sounds nice. In reality Pavlov drilled holes into dogs' stomachs and stuck a catheter in there through their abdominal walls, and measured the pH and enzyme content of gastric secretions when he rang the bell. Needless to say the dogs died after the experiment.

It can be exhilarating to know that common knowledge is wrong, and you know the truth, but in thin case, you are the one who is wrong. Pavlov did research on the digestive system, which used catheters as you described. However, when it came to his conditioning research, drooling was the quantitative result that was recorded. And he did use a bell, as well as other stimuli.

Click?

[darkain]

If by "click", you mean having an automated tool running inside of a VM scan URLs inside of emails to determine their contents before allowing the email to pass through to my inbox? Then sure!

In other words, their definition of a "click" is honestly far too loose.

Also, of the percent that "didn't click", how many of those messages were properly caught by spam filtration systems?

Really, this isn't a study about click through rates at all, more like someone having a predetermined subject they want to publish, and build a "test" around it to make it look a certain way.