Providing the same level of information through the in-vehicle interface can overwhelm automated vehicle occupants in simple scenarios or leave them underinformed in more demanding situations. This study investigates how human preference for in-vehicle feedback detail scales with scene complexity during pedestrian encounters. We measure scene complexity through driving decision diversity and validate its positive correlation with pedestrian crossing intent uncertainty in an initial experiment (N=68). Using a mock-up in-vehicle interface, the second experiment (N=88) evaluates user preferences for manually crafted feedback concepts simulating three levels of the system’s situational awareness. Results indicate that as intent uncertainty increases, users prefer more detailed feedback. While perception-only feedback suffices for simple encounters, in complex situations, information on system comprehension and projection aids better and easier understanding of driving decisions. These findings provide an empirical basis for scaling feedback to situational needs. As this study used manually generated feedback based on ground-truth data, the findings require further investigation considering real-world AI performance in automated vehicles.

Social networking services (SNSs), such as Instagram, are well known for their image-sharing capabilities. However, the concern of photo privacy arises, such as who may view the images of a user included in a post by someone else. While existing photo privacy settings provide some secure options for users to share their photos, their effectiveness hinges on users being aware of and understanding these settings; thus, awareness is vital to appropriate privacy concerns. The current study aimed to understand users’ awareness and behaviors regarding photo privacy settings on SNSs and the privacy paradox. We conducted two structured interviews containing open-ended and close-ended questions with undergraduate Instagram users and found they were generally aware of most of the privacy settings asked about, although some maintained multiple accounts for better privacy management. These results imply the need to further explore and design for the unmet needs of having only one Instagram account.

Artificial Intelligence (AI) is crucial to numerous functions required for driving automation systems, including the computer vision techniques used to detect the roadway environment and make real-time decisions. However, the images used as inputs to the AI system may be maliciously perturbed, or manipulated, causing the AI system to make an incorrect classification. In this study, we examined humans’ perception of the AI’s computer vision capability of classifying various road sign images, including the original images, images with two different types of malicious attacks, and images that are scrambled randomly at the pixel level. Our results showed that participants rated the AI agent to be less capable than themselves of classifying the road signs. However, they overestimated the AI’s computer vision capability for correctly classifying images with malicious attacks that should cause the AI system to misclassify the image. These findings suggest that people lack an accurate understanding of the vulnerabilities of AI computer vision technologies and tend to overtrust AI in driving automation systems.

This study investigated how time pressure and user ratings impacted consumer’s choice behavior and their eye fixation when shopping for online products. Participants were displayed various fictitious brands of the same types of product and were required to choose one that they would purchase. It was found that choices of a product and its associated eye fixations increased with user ratings. Compared to the time-pressure absence condition, the time-pressure presence condition had faster choice decisions and fewer eye fixations. There was also a significant interaction between user ratings and time pressure, for which products with a 5-star rating, not the lower ratings, was chosen more often in the time-pressure presence condition than in the time-pressure absence condition. Lastly, subjective reports showed that more individuals reported they had plenty of time to make their decisions in the time-pressure absence condition than in the time-pressure presence condition. Our results can inform retailers and webpage designers of potential design strategies in consideration of consumers’ behavior while shopping in different conditions of time pressure.

Antiphishing aid systems, among other automated systems, are not perfectly reliable. Automated systems can make errors, thereby resulting in false alarms or misses. An automated system's capabilities need to be communicated to the users to maintain proper user trust. System capabilities can be learned through an explicit description or from experience. Using a phishing-detection system as a testbed in this article, we systematically varied automation error type and the method of communicating system reliability in a factorial design and measured their effects on human performance and trust in the automation. Participants were asked to classify emails as legitimate or phishing with assistance from the phishing-detection system. The results from 510 participants suggest that learning through experience with feedback improved trust calibration for both objective and subjective trust measures in most conditions. Moreover, false alarms lowered trust more than misses for both unreliable and reliable systems, and false alarms turned out to be beneficial for proper trust calibration when using unreliable systems. Design implications of the results include using feedback whenever possible and choosing false alarms over misses for unreliable systems.

Mobile platforms, such as Android, warn users about the permissions an app requests and trust that the user will make the correct decision about whether or not to install the app. Unfortunately many users either ignore the warning or fail to understand the permissions and the risks they imply. As a step toward developing an indicator of risk that decomposes risk into several categories, or dimensions, we conducted two studies designed to assess the dimensions of risk deemed most important by experts and novices. In Study 1, semi-structured interviews were conducted with 19 security experts, who also performed a card sorting task in which they categorized permissions. The experts identified three major risk dimensions in the interviews (personal information privacy, monetary risk, and device availability/stability), and a forth dimension (data integrity) in the card sorting task. In Study 2, 350 typical Android users, recruited via Amazon Mechanical Turk, filled out a questionnaire in which they (a) answered questions concerning their mobile device usage, (b) rated how often they considered each of several types of information when installing apps, (c) indicated what they considered to be the biggest risk associated with installing an app on their mobile device, and (d) rated their concerns with regard to specific risk types and about apps having access to specific types of information. In general, the typical users' concerns were similar to those of the security experts. The results of the studies suggest that risk information should be organized into several risk types that can be better understood by users and that a mid-level risk summary should incorporate the dimensions of personal information privacy, monetary risk, device availability/stability risk and data integrity risk.

The popularity and advanced functionality of mobile devices has made them attractive targets for malicious and intrusive applications (apps). Although strong security measures are in place for most mobile systems, the area where these systems often fail is the reliance on the user to make decisions that impact the security of a device. As our prime example, Android relies on users to understand the permissions that an app is requesting and to base the installation decision on the list of permissions. Previous research has shown that this reliance on users is ineffective, as most users do not understand or consider the permission information. We propose a solution that leverages a method to assign a risk score to each app and display a summary of that information to users. Results from four experiments are reported in which we examine the effects of introducing summary risk information and how best to convey such information to a user. Our results show that the inclusion of risk-score information has significant positive effects in the selection process and can also lead to more curiosity about security-related information.

Malware has been a major security problem both in organizations and homes for more than a decade. One common feature of most malware attacks is that at a certain point early in the attack, an executable is dropped on the system which, when executed, enables the attacker to achieve their goals and maintain control of the compromised machine. In this paper we propose the concept of Personalized Application Whitelisting (PAW) to block all unsolicited foreign code from executing on a system. We introduce CodeShield, an approach to implement PAW on Windows hosts. CodeShield uses a simple and novel security model, and a new user interaction approach for obtaining security-critical decisions from users. We have implemented CodeShield, demonstrated its security effectiveness, and conducted a user study, having 38 participants run CodeShield on their laptops for 6 weeks. Results from the data demonstrate the usability and promises of our design.