Why Do Street-Smart People Do Stupid Things Online?

The systems we worry about securing include the people who use them. In everyday offline life, an average person's "security policy" consists of a few simple, intuitive rules. We believe that the majority of users continuously employ risk analysis heuristics to plan both their online and offline actions; the overwhelming problem of online security is that this analysis, in the online case, is based primarily on entirely wrong assumptions, intuitively derived from incorrect interpretation of GUI elements and processes. We propose a core user interface design principle for the designers to follow when considering and building trust-decision-related user interface features.