simple: users don't listen to anything that has technical language or icons that aren't as clear as possible and as large and central as possible (they won't look at the lock icon because a. there are plenty of meaningless icons there, b. it's too far away from the site itself and c. iirc, ie always shows a lock, sometimes locked, sometimes not. so you're asking your grandpa to notice a 4-pixel difference)

so we just teach them this:
when someone links to a place that asks for personal info, sensitive info such as your bank details, even if they just ask you to log in and ESPECIALLY when they ask for a password, never click their link.
rather, search google for the site (for example, if you're in bank A and got an email asking to renew your account, open google and type "bank A". it will most likely be the first result) .

it just has to be rephrased so it'll be shorter.

the first step is LESS indicators, not more. it's too tough for simple users to follow that many details.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/405/33748#33748