Patterns
- Active Warnings
- Attractive Options
- Complete Delete
- Conveying Threats & Consequences
- Create a Security Lexicon
- Create Keys When Needed
- Delayed Unrecoverable Action
- Detailed Notifications About Security
- Direct Access to UI Components
- Disable by Default
- Disable of Services
- Disclose Significant Deviations
- Distinguish Between Run and Open
- Distinguish Internal Senders
- Distinguish Security Levels
- Email-Based Identification and Authentication
- Explicit Item Delete
- Explicit User Audit
- Failing Safely
- General Notifications About Security
- Immediate Notifications
- Immediate Options
- Indirect Access to UI Components
- Informative Dialogues
- Install Before Execute
- Key Continuity Management
- Levels of Severity
- Leverage Existing Identification
- Localization of Specific Areas
- Migrate and Backup Keys
- Noticeable Contextual Indicators
- Providing Recommendations
- Quick Description of UI Components
- Redundant Notifications
- Reset to Installation
- Restricted Areas Notification
- Security Features Used by the System
- Security Features Used by the User
- Send S/MIME-Signed Email
- Separating Content
- Sequential Access to UI Components
- Suggestive Dialogues
- System’s Security Tasks
- The Absence of Indicators
- Track Received Keys
- Track Recipients
- Warn When Unsafe
Patterns are based on scientific sources.
Usable Security Pattern - Attractive Options
Luigi Lo Iacono, Peter Nehren
December 21, 2015
Attractive Options
| Name | Attractive Options |
| Sources | (Egelman, 2009) |
| Synonyms | None |
| Context | When displaying critical warnings, if multiple options are presented to the user, the recommended option should allow the user to complete the primary task. If only one option is presented (e.g. an acknowledgement), this becomes unnecessary because the user does not need to choose among several options. |
| Problem | Users may read the options presented to them by a critical warning, but may not choose the recommended option because they either did not understand the threat or did not believe the recommended option would help them complete their primary task. |
| Solution | This error may be prevented by creating recommended options that appear conducive to completing the primary task. Additionally, labels on warning options should underscore the threat model so that if the user does not read anything else, she still understands the danger of ignoring the warning. |
| Examples | The phishing warning recommends that users “search for the real website.” This text facilitates completion of the primary task by helping the user locate the website she was initially trying to visit, as well as underscoring the threat model: she is currently visiting a fraudulent website. Source: (Egelman, 2009) |
| Implementation | For critical warnings that contain multiple options, the recommended option should use wording that appears conducive to completing the primary task. This wording should also underscore the threat that the warning is attempting to guard against. |
| Consequences | If a user does not think that the recommended option will allow the completion of a primary task, she will not be motivated to obey the warning. Additionally, if the user does not read any other parts of the warning, she will still need to read the options in order to dismiss the warning. Therefore, the options should underscore the threat so that there is additional motivation to take the recommended option. |
| Dependencies | None |
| Relationships | [Active Warnings] [General Notifications About Security] [Failing Safely] [Immediate Options] [Providing Recommendations] |
| Principles | [Path of Least Resistance] [Identifiability] [Clarity] |
| Guidelines | [Warning Design Guidelines (Item 3)] |
| Check lists | None |
| Use cases | None |
| Tags | Attractive Options, Active Warnings, Failing Safely, Warnings, Notifications |
| Log history | [12/21/2015]: Added to repository |
References
Egelman, S., 2009. Trust me: Design patterns for constructing trustworthy trust indicators. ProQuest.