Hi, I’m Youngwook Do from Georgia Tech.
Today, I’m going to talk about Spidey Sense, designing novel haptics to improve awareness of cybersecurity warnings.
This work was done along with my brilliant collaborator Linh Hoang, Jung Wook Park, and my advisors, Gregory Abowd, and Sauvik Das.
The importance of security warnings has increased significantly as Internet technologies have advanced.
The Internet technologies have allowed users to be connected to the Internet
and to work on their daily tasks anytime and anywhere with their laptop or smart devices.
But also at the same time, this internet technology lets a malicious actor from outside be available
to access other people’s data without their knowledge by hacking the system through phishing, sniffing data, etc.
Of course, such a malicious act can be prevented by building a strong security system.
However, some decisions must eventually be made by users.
which means if a user makes even one bad security decision, it might lead to putting their systems and data at risk.
For such cases, security warnings have been designed to help users to avoid taking risky actions.
There are cases where the risk of harm is considered severe and requires immediate user action to attenuate harm.
For such cases, we consider cybersecurity warnings to be “critical” and “in-the-moment”.
However, they often fail to capture people’s attention and motivate their actions. Why does it happen?
First, the channels used to communicate cybersecurity warnings are overloaded.
For example, on a web browser, since a lot of different information got delivered visually,
people may disregard an important security warning.
Second, unlike threats in the physical world, cyber threats are communicated rationally but not viscerally
people might be able to see that they are navigating to a website with an expired SSL certificate
the way they might see a red light on a pedestrian crossing.
but they may not feel that they shouldn’t proceed to that website when they see the warning
the way they would if a friend grabbed their wrist before they attempted to jaywalk.
What if we could differentiate urgent cybersecurity warnings from other notifications through a dedicated channel?
What if we could communicate threats in a way users can viscerally “feel” the presence of a potential threat
like Spidey Sense in the Spider Man movie?
Is it possible? How can we design such a security warning system?
So, now we introduce Spidey Sense, a deployable wrist-worn device that produces a novel, squeezing haptic effect.
In terms of the lexicon described in the “design space for effective privacy notices” paper,
Spidey Sense is a just-in-time, haptic, non-blocking notification delivered through a secondary channel, like a smartwatch.
For the Spidey Sense design, we found that squeezing haptics on a wrist shows a good opportunity. Why?
what is needed for our target design is a mechanism of delivering cybersecurity warnings
that helps bridge the gap between the presence of a cyber threat and the physical perception of that threat
while differentiating the communication channel.
We found that haptics can help bridge that gap.
The sense of physical touch is one of the most emotionally charged channels
Researchers have studied this domain to examine how effectively different haptics can elicit, enhance, or influence
the emotional state of a human, by means of the sense of touch
While we were exploring different haptic modalities,
we learned prior work identified that people protectively grasp another person’s wrist when they feel scared or surprised.
We drew the inspiration of squeezing haptics from this idea.
Our key insight is that by developing a simple switchable smartwatch wristband that can produce a noticeable haptic effect
we should be able to improve the perception of cybersecurity warnings in both practical and deployable manners.
As shown here, we found that the mechanical and electrical components used to produce a squeezing sensation
can be easily fit into a smartwatch wristband and it can be easily switchable.
Spidey Sense can produce a vast design space of squeezes,
but how do we know what types of squeezes are most suitable for communicating cybersecurity warnings?
Our goal in this study is to systematically explore the squeeze notification design space
and find one that is well suited to our target scenarios.
To do so, we ran a “Gen-Rank-Verify” study that we adopted and modified “Find-Fix-Verify” study structure.
Before participants are asked to complete a task, we primed participants
to get in the mindset of our target scenarios using grounding videos.
Since we ran the study in the lab settings and participants were not situated in real scenarios,
it was important to clearly describe what are the Spidey Sense’s target scenarios.
We chose two videos because we wanted to give multiple examples so that the ideas are not limited to just one scenario.
For the laptop use-case, we showed a 5min clip of the Black Mirror episode “Shut Up and Dance”
which depicts the consequences of installing untrusted software on the main character’s laptop.
For the smartphone use-case, we found a news report from the CBC
illustrating the ramification of unclear permission-granting for Android apps.
The intention of the news report was to alert the general public
of the importance of being vigilant about the permission grant to smartphone apps.
We found these videos helpful for viewers to engage in scenes that approximate real-life situations
After watching the grounding videos, participants were asked to design a squeeze notification
that would best capture their attention if they were in a situation analogous to the ones depicted in our grounding videos
In the “Gen” study phase, to design the squeezing pattern,
participants used the GUI design tool that we created and played with three parameters:
pressure over time, periodic behavior, and repetition.
They were asked to explore and try different patterns for 10 minutes, and finalize the design.
At the end, we were able to gain 8 different patterns that 8 participants created individually.
With the 8 squeeze patterns,
we needed to assess which of these would be best suited to the task of alerting people to our target scenarios.
In the “Rank” stage, we recruited participants to independently rank the 8 different squeeze notifications
that they believed would capture their attention if they found themselves in a scene depicted in the grounding videos.
We arranged the eight squeeze notifications in random order
and had participants make seven pairwise comparisons in a tournament setup.
The reason that we adopted the pairwise comparison is that
it is easier to compare two haptic notifications at once than comparing eight at the same time.
Another reason is that it is challenging to have each participant do every possible pairwise comparison.
For the pairwise comparisons in a tournament setup, participants used the GUI tool that we created.
As a result, Pattern 1 created by the participant 1 in the “Gen” study phase obtained the most pairwise victories.
The winning pattern number 1 is an infinitely repeating pattern that has 4 large pressure peaks
followed by rapid decreases in pressure, and a more irregular, smaller pressure peak at the end
While the tournament setup helped us find the best squeezing pattern among the eight patterns,
we next wanted to evaluate if this “relative best” pattern was actually “appropriate” for our target scenarios on an absolute scale.
Participants were asked to rate the appropriateness of each haptic feedback on the 5-point Likert scale.
The results show that participants found Spidey Sense to be significantly more appropriate
for in-the-moment, critical cybersecurity warnings than the vibrotactile feedback
While we have yet to run studies to examine the system’s usability and effectiveness “in the wild”,
Spidey Sense is an instantiation of a broader class of affective haptics that motivates end-user responses to security warnings.
We believe that Spidey Sense can help catalyze a new direction of cybersecurity research across various applications
including smart lock alert, misinformation alert, and etc.
In summary, we implemented and evaluated a novel haptic notification system, Spidey Sense
designed to improve people’s awareness of in-the-moment, critical cybersecurity warnings.
That’s all for my talk. Thank you so much.