Mon 4 Jun 2012
Security and Human Behaviour 2012 – Session 1 Deception
Posted by a-cubed under Academia , Security , Social Legal and Ethical Aspects of High TechComments Off on Security and Human Behaviour 2012 – Session 1 Deception
Jeff Hancock, Cornell
Detecting Deceptive Language and Promoting (more) Honest Behaviour
Detection of the difference between purchased reviews of hotels by people who had not stayed there and real reviews by those who had. Automatic detection could identify 90% of the fake reviews – only works for differentiating between those who had stayed there and those who had not.
Lab studies on identifying lying: psychological distancing leads to verbal immediacy, cognitive complexity leads to a different discourse structure, anxiety and guilt lead to emotional leakage. However, various types of situation lead to differences in how the models can be applied.
How to promote more honest behaviour.
Promoting honest behaviour. Triggering a feeling of a face triggers social constraints on lying.
Current research will include graphics to see what can improve honesty.
Tyler Moor, Wellesley College
Why user intent affects how we combat online wickedness
Online crime is mainly fought by private actors rather than state agencies.
Sometimes crime is difficult to distinguish from undesirable behaviour.
What is the distinction between bad behaviour and criminal behaviour?
Distinguishing between phishing and malware installation (which can lead to keylogging and loss of authentication details). Phishing is attacked by the banks. Malware installers are attacked by the search engine.
Transparent redirection by cracked sites depending on the referrer information from Google search pages.
Need to identify the intent of the user.
Robert Trivers, Rutgers
The Folly of Fools: the logic of self-deception.
Lying to others is indivisible from self-deception.
Psychologists tend to study only deception. Philosophers worry too much about self-deception. You need both to understand deception.
Choice of language as well as physiological reactions give clues to deliberate deception. Self-deception could be deliberately practised in order to avoid deception clues.
Interesting data on self-deception: we do believe our deceptive positive self-image.
Self-deception is offensive (aimed at deceiving others), rather than what the psychologists claim: that self-deception is defensive, aimed at making ourselves happier.
We need more evidence on detecting deception in real situations.
80% of accidentsd happen with the pilot instead of the co-pilot in actual charge. Co-pilots are hesitant to correct errors from their more senior colleagues, particularly if they do not have a pre-existing strong relationship.
When considering deception, you must always keep self-deception in mind.
Joseph Bonneau, Cambridge
Guessing human-chosen secrets
What’s easier to guess? Older or younger users’ passwords? Passwords or random 9-digit numbers. PIN or Mother’s Maiden Name?
Showed the cartoon of Jesus having 2512 as his PIN to his father, whose birthday is Christmas Day, and his father promptly went and changed his PIN.
Released files of stolen passwords allowed statistical analysis of password choices.
Gathering data within Yahoo via an encrypted hash to allow for statistical analysis without knowledge of the actual passwords.
Changing user behaviour (such as changing passwords occasionally) is better than just stressing the risk.
Language makes something of a difference, but at most a factor of two in difficulty.
Stuart Schecter, Microsoft
Better Passwords
P@ssword was a “strong” password accroding to Yahoo’s algorithm. P@$$word1 was a “strong password according to Google’s algorithm.
Ban popular passwords!
Important internal passwords for high value propositions (MS, Google) need better approaches.