Johnny Can Drag and Drop: Determining User Intent Through Traditional Interactions to Improve Desktop Security

摘要

In this paper, we identify the primary difficulties encountered when security systems include users in the decision-making process. We propose security system inquiry mechanisms, designed around file open dialogs and drag-and-drop interfaces, to increase the accuracy of information obtained from users while also maintaining a high level of user inclu-siveness in security decisions. We note that, although it has been previously shown that many users are inherently bad at making final security decisions, useful information regarding user intent can be accurately obtained by using our inquiry mechanisms. In particular, inquiry mechanisms that parallel the actions within applications the user actually intends to perform prompt the user in ways that are understandable and likely to receive accurate responses. We discuss how our system eliminates the traditional problems faced in security systems due to false positives and false negatives.