![Page 1: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/1.jpg)
Studying the Effectiveness of Security Images in Internet Banking
1
Joel Lee and Lujo Bauer
![Page 2: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/2.jpg)
What Are Security Images?
• Personal image chosen by the user
• Displayed at logon when user enters user ID
• Usually comes with a security caption
• Lets users know that they are accessing the actual bank site and not a phished site
2
![Page 3: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/3.jpg)
PNC Bank Security Image
3
![Page 4: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/4.jpg)
Bank of America Security Image
4
![Page 5: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/5.jpg)
Dollar Bank Security Image
5
![Page 6: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/6.jpg)
6
![Page 7: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/7.jpg)
Related Work #1
Schechter et al., IEEE S&P 2007
• Lab study of security images; 59 participants
• Role playing / security priming / own bank account
• Replaced security images with a maintenance notice
• Almost all participants entered password when security image was missing
• Concerns:
• Classroom environment
• All participants students
• Required to complete tasks
7
![Page 8: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/8.jpg)
Related Work #2
Herzberg & Margulies, ESORICS 2011
• Online submission system for a computer science course; ~400 student participants
• Interactive custom image
• Spoofed email with link to a spoofed login page
• 60% detected spoofed page and refused to log in
• Concerns:• Expert participant pool
• Participants explicitly primed and incentivized for detecting attacks
• Phished email may have alerted participants
8
![Page 9: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/9.jpg)
Our Research Goals
• How effective are security images?
• What features influence their effectiveness?
• Changes to appearance
• Changes to interaction
• Changes to customization
• How does methodology influence effectiveness?
• Changes to payment amount (motivation)
• Changes to study duration (habituation)
9
![Page 10: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/10.jpg)
Study Methodology
• Mockup of an internet banking website
• Security images varied by size, appearance, customizability
• Users recruited on Amazon’s Mechanical Turk to test new banking site
• Registered for account with user ID, password, and security image
10
![Page 11: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/11.jpg)
Study Methodology
11
![Page 12: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/12.jpg)
Study Methodology
12
![Page 13: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/13.jpg)
Study Methodology
• Mockup of an internet banking website
• Security images varied by size, appearance, customizability
• Users recruited on Amazon’s Mechanical Turk to test new banking site
• Registered for account with user ID, password, and security image
• 24 hours later, money deposited into account, users asked to return to report deposit amount
13
![Page 14: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/14.jpg)
Study Methodology
14
![Page 15: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/15.jpg)
Study Methodology
• Mockup of an internet banking website
• Security images varied by size, appearance, customizability
• Users recruited on Amazon’s Mechanical Turk to test new banking site
• Registered for account with user ID, password, and security image
• 24 hours later, money deposited into account, users asked to return to report deposit amount
• Remove image, observe whether users log in
15
x5
![Page 16: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/16.jpg)
Attack Scenario
16
![Page 17: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/17.jpg)
Study Methodology
• Exit survey to get demographics and feedback on security images
• Paid $0.50 for registering for an account, $3.50 for reporting 5 deposit amounts
17
![Page 18: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/18.jpg)
Conditions (I)
1 – ControlControl
2 – Large image (9 times larger)
3 – Blinking image
Appearance Features
Before password can be entered, mustI
4 – I click on image
5 – I type in a random word in image
6 – I type in the caption
InteractionFeatures
18
![Page 19: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/19.jpg)
Conditions (II)
7 – User-provided security image and caption
Customization Feature
8 – Upload a security image + blinking + require click (combine Cond. 3, 4, 7)
Customization + Appearance +
Interaction Feature
9 – No security captionNo Security Caption
10 – Report 2 deposit amounts (not 5)
11 – 2x participant compensation
12 – Prime participants to notice images
Changes to Study Methodology
19
![Page 20: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/20.jpg)
Cond. 1 – Control Condition
20
![Page 21: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/21.jpg)
Cond. 2 (Appearance) – 9x Larger Image
21
![Page 22: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/22.jpg)
Cond. 4 (Interaction) – Click on Image
22
![Page 23: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/23.jpg)
Cond. 5 (Interaction) – Random Word
23
![Page 24: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/24.jpg)
Cond. 5 (Interaction) – Random Word
24
![Page 25: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/25.jpg)
Results
• 482 participants completed the entire study
• Compared all 11 conditions with control condition
• Participants distributed across ages 18 – 65 and up
• 37.6% high school, 51.4% college degree, 10.6% graduate degree
25
![Page 26: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/26.jpg)
0% 20% 40% 60% 80% 100%
1
2
3
4
5
6
7
8
9
10
11
12
% logged in without security images
control
large
blinking
interactive
copy random word
copy caption
custom image
multi-feature
no caption
2 logins
more pay
more sec priming
Results
26
![Page 27: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/27.jpg)
Results
27
![Page 28: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/28.jpg)
0% 20% 40% 60% 80% 100%
Strongly Disagree Disagree Neutral Agree Strongly Agree
control
large
blinking
interactive
copy random word
copy caption
custom image
multi-feature
no caption
2 logins
more pay
more sec priming
% found the security image as part of the login process annoying
Results
28
![Page 29: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/29.jpg)
Limitations
• Fake internet banking accounts
• Habituation
• Money as motivating factor
• Under maintenance image vs other attack vectors
• No SSL certificate on our website
• Significant results around p=0.05 threshold
29
![Page 30: Studying the Effectiveness of Security Images in Internet ... · •Mockup of an internet banking website •Security images varied by size, appearance, customizability •Users recruited](https://reader030.vdocuments.site/reader030/viewer/2022041104/5f04b7f07e708231d40f5c4f/html5/thumbnails/30.jpg)
Conclusions
• 75% of participants entered password in the absence of a security image in the control condition
• Appearance, customization, interactivity features have little impact
• Blinking image results in significantly greater effectiveness
• Performing additional task to log in leads to greater annoyance but does not effectiveness
• Habituation, level of motivation, and security priming have minimal effect
Joel Lee and Lujo Bauer