It all blurs together: How the effects of habituation generalize across system notifications and security warnings

Abstract

Habituation to security warnings—the diminished response to a warning with repeated exposures—is a well-recognized problem in information security. However, the scope of this problem may actually be much greater than previously thought because of the neurobiological phenomenon of generalization. Whereas habituation describes a diminished response with repetitions of the same stimulus, generalization occurs when habituation to one stimulus carries over to other novel stimuli that are similar in appearance. Because software user interface guidelines call for visual consistency, many notifications and warnings share a similar appearance. Unfortunately, generalization suggests that users may already be deeply habituated to a warning they have never seen before because of exposure to other notifications. In this work-in-progress study, we propose an eye tracking and fMRI experiment to examine how habituation to frequent software notifications generalizes to infrequent security warnings, and how security warnings can be designed to resist the effects of generalization.