I'm in the CHI papers session on Security.

The first paper is 'Why phishing works.'  Interesting point: both security designers and phishers use user interface techniques to accomplish their goals. Three basic categories of reasons why phishing works:

• lack of knowledge ( e.g. about URLs, security indicators)
• visual deception (e.g. 'vv' istead of 'w', overlaying windows,embedding fake address and status bar in page )
• bounded atention (i.e. inattention to secuirty indicators) 

In their study of whether people can correctly identify real and phishing sites, participant knowledge and use of security indicators was the best indicator of success in correctly identifying the sites. Though in walking through the examples, the reasons why people made mistakes were all over the place.

Interesting suggestion: that product teams 'spoof' their own design in the testing of their web sites, to see how easy it is to convincingly phish your site.

Another interesting design point: address bar prints the URL in small type that's hard to read; can you re-size the text to make it bigger and more readable?

Second paper: Secrecy, Flagging and Paranoia: Adoption Criteria in encrypted E-mail. There is an argument that people should encrypt all of their email. Conventional wisdom is that people don't encrypt email because it's too hard. Their user study showed that in fact people often don't encrypt email because there is a social meaning (in fact, a negative stigma) associated with encryption that they don't want to convey. People will use it for financial information, and for protecting secret planning information. But recipients think that if it's encrypted it must be important -- so encrypting all email would send the wrong message (no pun intended). This was a pretty limited study and it's unclear how much it can be generalized, but it's an interesting thought.

Third paper:  Do Security Toolbars Actually Prevent Phishing Attacks? There are many browser toolbars that try to help identify phishing sites. The categories of toolbars:

• neutral info: domain name, date registered, country registered
• System-decision: propose whether the site is OK or potentially fraudulent
• SSL-verification: presents a logo if it's a verified site.

Recurring point: security is almost never the user's primary task and we don't want to make it the primary task, but we do want the user to be motivated and engaged to make good decisions. Their results are that secuirty toolbars are not as effective as one would hope in preventing phishing attacks. The study reinforces the notion that users don't understnad or know how to parse URL's. Interestingly, anecdotal comments suggest that false-positives in spam filters cause people to expect anti-phishing spoolbars to be wrong some percentage of the time. In other words: often the phishing web site looks more credible than the toolbar. Also, since security is a separate, secondary task, people's desire and focus on getting the primary task done overrides the focus on the secondary task. This is a bizarre dilemma: we don't want to make security the primary task, but then users will often override security in favor of the primary task and open themselves up to phishing attacks.