Do users pay attention to software security warnings?

According to a recent study from researchers at Brigham Young University, computer users ignore security warnings up to 90 percent of the time. With help from Google Chrome engineers, the researchers also discovered that 74 percent of users ignored security warnings that popped up when they were in the process of closing a Web page window. Another 79 percent ignored security warnings if they were watching a video, and 87 percent ignored warnings if they were in the process of transferring a confirmation code.

A functional MRI scanner attached to the study participants showed that the problem was that of concentration. People can’t multitask well. Neural activity showed reduced levels when security messages interrupted what the user was doing. For security professionals, this data presents a user interface and design opportunity.

"But you can mitigate this problem simply by finessing the timing of the warnings," Jeff Jenkins, lead author of the study appearing in Information Systems Research, told Phys.org. "Waiting to display a warning to when people are not busy doing something else increases their security behavior substantially."