How to make PC security alerts better? Make them twirl, jiggle
Have you ever ignored a security alert on your PC? You’re not the only one.
The warnings are designed to save us from malware infections and hacking risks, but often we’ll neglect them. It could be because we’re too busy or we’ve seen them too many times, and we’ve become conditioned to dismiss them — even the most serious ones, according to Anthony Vance, a professor at Brigham Young University.
Vance has been studying the problem and he’s found that introducing certain small but noticeable changes can make the alerts more useful — and harder to ignore.
“Our security UI (user interface) needs to be designed to be compatible with the way our brains work,” he said at the USENIX Enigma 2017 conference on Tuesday. “Not against it.”
Alert messages tend to appear on a PC or browser in the same, consistent manner. But what if you change the alert’s appearance over time? Say, make it twirl or jiggle when it pops up, or change its color?
Vance experimented with these “polymorphic” or changeable alerts and found that users did tend to pay more attention them over typical static alerts. He conducted his study by tracking users’ eye movements and brain activity.
“It seems silly,” he said. “But when we applied this in the experiment, we looked at the results and found a dramatic difference.”
He proposes that vendors keep this in mind when developing security alert messages for their products.
Vance has previously presented research showing that users will often disregard warning messages over their computers when multi-tasking. For instance, over 70 percent of users will ignore the alerts if they pop up when they’re watching a video.
Anthony Vance, a professor at Brigham Young University, speaks at the USENIX Enigma 2017 conference.
To find a possible solution, his research has found that users tend to pay attention to the warning when the alert arrives after a task. “The timing of the warning really does make a difference,” he said.
That means vendors are better off developing alerts that appear after a user has stopped watching a video, completed a download or finished loading a page. “These are good times to present the message, because the user is less engaged,” he said.
Vance is also studying how all alerts – both security and non-security – often look and appear in the same design style, usually in a box, with the same fonts and colors.
“You see two different dialogue messages. One is a security message, the other isn’t. And yet they look very similar,” Vance said. The danger with this design choice is that users will more likely ignore the rare system alerts when they appear.
“What this implies is we should design security messages to have a different visual appearance,” he said. “Or even a different mode of interaction than simply what I call a ‘click to dismiss.'”
However, Vance isn’t advocating developers overload their users with too many notifications either.
“Do we have to ramp up the visual novelty to the point it’s a burden on the user? That’s obviously not good either,” he said. “But I think our research shows even variations that are subtle have a big difference.”