The Model Elements

In this section we describe the elements of the Model and how they correspond to the specific factors of the components of the HF-APAC Framework.

Models place values on some of the variables identified as important in a frame-work [195, 168]. The Model for Analysing HF-APAC considers and tests specific factors of some of the components of the HF-APAC Framework, described in Section 4.3.1 and summarised in Table 4.1.

The Model for Analysing HF-APAC is grounded in the prior research in infor-mation processing and decision making [132, 131, 95, 71, 177, 71, 217, 218], the most important were reviewed in Section 2.5.3. The review points to attention and elaboration as being the main information processing activities that underpin the users’ evaluation of deceptiveness.

The human information processing activities are structured into two main sepa-rate sub-processes: attention and elaboration [71]. Attention to phishing indicators, or a fake login prompt, is a necessary but not sufficient condition for detecting phish-ing deception. Users also need to elaborate on the indicators. Durphish-ing elaboration, users make conscious connections between the elements they observe and their prior knowledge. [217] The attention to the ceremony communication and the elabora-tion on discrepancies between what is observed and what is expected are important components in HF-APAC Framework and also important elements of the Model.

Communication via Input/Output

The model classifies authentication ceremonies with regard to a specific communi-cation type (i.e. tasks) that the user is required to perform. Many authenticommuni-cation ceremonies consist of either recall or recognise or their combination. Specific is-sues may arise from each communication type, most notable, the demand on users’

memory [193]. Other issues that may arise are described in Sections 4.3.1 and 3.3.3.

Hence, the types of communication and their combinations that the Model con-siders are:

ˆ Recall. Typically used in traditional username/password authentication.

ˆ Recognition. In a typical login procedure for recognition-based, graphical pass-words ceremonies, the user would see an image and must recognise it. Exam-ples are: Passfaces [174], Dynamic Security Skins [55], PhorceField [101].

ˆ Combination of recognition and recall. In the simplest form, it is provided as a combination of a security image and caption [228, 192].

The communication is an authentication ceremony login prompt webpage. It is conveyed to the user via input/output elements, directly corresponding to the communication and the input/output components of the HF-APAC Framework.

The login page may be spoofed. If used in phishing attacks it perhaps contains at least some false content which may or may not be noticed by the user. We assume that the security mechanisms for detecting phishing webpages are in place, but may or may not be noticed by a user. The ceremony relies on the human to perform authentication steps bound to the login webpage and to decide whether to proceed giving their credentials; essentially deciding if the webpage is legitimate or not.

Attention

Attention is the first stage in communication processing [178, 222] and in our model it is the attention given to either a recall or recognise authentication task. We assume that an attention switch has happened - as the user is prompted with a login page. The format and the size of the HPA will influence the switch, as described in Sections 4.3.1 and 3.3.3. Different authentication ceremonies will influence the length that attention is maintained, and appropriate factors are considered. Hence, the attention element in the Model comprises the attention switch and attention maintenance of the HF-APAC Framework (Section 4.3.1).

Capabilities

The HF-APAC Framework distinguishes the following capabilities that can affect the communication process in authentication ceremonies: memory, comprehension, knowledge or some other cognitive or physical skill (Table 4.1). The capabilities element of the Model considers the knowledge of the ceremony and web security factors. That is, users knowing what credentials are expected to be sent/received to/from a server and having a knowledge about web security. Users’ knowledge, or rather the lack of it, has been exploited by attackers [38, 57, 226].

Motivation

The motivation element considers risk perception and distraction from primary task as factors of the corresponding motivation component of the HF-APAC Framework.

Risk perception is assessed by the perceived importance of a particular website to the user and also how busy the user is with the primary task. (Section 4.3.1, [202])

Elaboration

Users need to make conscious connections between the communication they observe and their prior knowledge, i.e. they need to elaborate on the communication to detect phishing. Previous research in communication processing of phishing emails suggest that users who do not attend to the emails upon receipt would neglect to elaborate on the information received, increasing the likelihood of making a wrong decision. [218, 123, 223, 217, 100] The elaboration element considers the cognitive effort the user puts into assessing the authentication communication they observe and make connections between the presented communication and their prior knowl-edge and experience.

Behaviour

The specific human behaviour that the Model evaluates is whether the user per-forms an action incorrectly. In this case the action is to notice if the login prompt is spoofed; or to make an error and get phished. The model tests how users pro-cess communication messages in authentication ceremonies and determine if they are genuine or not. Specifically, how the number and combinations of recall and recognise communication types influences the user’s decision-making processes and consequently their decision outcomes, regarding submitting the credentials to the website.