Serge Egelman | 2024 Norm Hardy Prize Seminar

Internet users often neglect important security actions (e.g., installing security updates or changing pass-words) because they interrupt users’ main task at inopportune times. Commitment devices, such as reminders and promises, have been found to be effective at reducing procrastination in other domains. In a series of on-line experiments, we explored the effects of reminders and promises on users’ willingness to change a compromised password. We find that adding an option to delay the task increases the share of people willing to eventually change their password considerably. Critically, the option to delay yields this overall increase without reducing the share of people choosing to change their password immediately. Additionally, most participants who promised to change their password later, or asked to be reminded to do so, indeed followed through on their commitment, leading to a net positive effect. Reminding participants of their previous commitment further increased this effect. In this talk, we will discuss these findings, as well as earlier work in which we explored how security mitigations can better be tailored to better fit users’ decision-making processes.