“…I have my dad, sister, brother, and mom’s password”: unveiling users’ mental models of security and privacy-preserving tools

• Published in: Information and computer security Vol. 32; no. 3; pp. 282 - 303
• Main Authors: Dumaru, Prakriti, Shrestha, Ankit, Paudel, Rizu, Haverkamp, Cassity, McClain, Maryellen Brunson, Al-Ameen, Mahdi Nasrullah
• Format: Journal Article
• Language: English
• Published: Bingley Emerald Publishing Limited 11.06.2024; Emerald Group Publishing Limited
• Subjects: Cybersecurity; Data integrity; Internet; Privacy; User behavior; User interface; Virtual private networks; United States > US; Mental models; User study; Security tools
• ISSN: 2056-4961; 2056-4961; 2056-497X
• DOI: 10.1108/ICS-04-2023-0047

Purpose The purpose of this study is to understand user perceptions and misconceptions regarding security tools. Security and privacy-preserving tools (for brevity, the authors term them as “security tools” in this paper, unless otherwise specified) are designed to protect the security and privacy of people in the digital environment. However, inappropriate use of these tools can lead to unexpected consequences that are preventable. Hence, it is significant to examine why users do not understand the security tools. Design/methodology/approach The authors conducted a qualitative study with 40 participants in the USA to investigate the prevalent misconceptions of people regarding security tools, their perceptions of data access and the corresponding impact on their usage behavior and data protection strategies. Findings While security vulnerabilities are often rooted in people’s internet usage behavior, this study examined user’s mental models of the internet and unpacked how the misconceptions about security tools relate to those mental models. Originality/value Based on the findings, this study offers recommendations highlighting the design aspects of security tools that need careful attention from researchers and industry practitioners, to alleviate users’ misconceptions and provide them with accurate conceptual models toward the desired use of security tools.