Introduction to URL Destination Perception and UI Design Challenges

Flashcards based on the lecture notes regarding the empirical study of URL structures, user comprehension, and the difficulties of preventing phishing through UI design.

URL Destination Problem

A design challenge where users are unable to accurately understand where a link leads based on the URL structure, often exploited in phishing attacks.

FBI Phishing Losses ($2017$)

A reported total of over $29,000,000$ in United States financial losses due to phishing in the year $2017$.

poll poll pollman

An entity that estimated phishing incidents cost over $2,000,000$ per incident in the UK.

Spear Phishing Attacks on Google and Facebook

Specific targeted attacks that resulted in losses of approximately $100,000,000$ for these major organizations.

Top level domain

The rightmost part of a URL, such as $.com$, which indicates the highest level in the hierarchical domain name system.

Domain

The portion of a URL that identifies the actual site owner, situated to the left of the top level domain, such as $\text{mobile}$ in the URL $\text{facebook.mobile.com}$.

Sub domain

A specific section of a larger domain, such as $\text{Facebook}$ in $\text{facebook.mobile.com}$, which is owned by the proprietor of the main domain.

Brand-first bias

A psychological tendency where $32.9\%$ of users assume a familiar brand name identifies the destination, regardless of its position in the URL structure.

incroom and suffering

Two browsers mentioned in the transcript as providing post-click supports through features like domain highlighting.

AMT and prolific

The two platforms used by researchers to recruit $50$ participants each for pre-studies on brand familiarity.

TrapBody and Pew Point

Examples of real organizations used in the study that participants were found to be very unfamiliar with.

Likert scale

A five-point response system used by researchers to measure users' perceptions of URL safety, providing a wider range of responses than simple yes/no questions.

Pure domain URLs

Simple structures like $\text{microsoft.com}$ used as a baseline in the empirical evaluation of URL rating accuracy.

Latent class analysis

An advanced statistical method used to group participants into categories like power users, desktop users, and mobile users by combining multiple measures of technical skills.

Generalized line of mixed model

A statistical tool used to analyze prediction accuracy while accounting for participant differences and interactions with different URL structures.

Proportional logistic regression

The specific statistical method employed to analyze ordered data from the five-point safety ratings.

Power users

The most technically experienced user group who achieved only a $25\%$ accuracy rate in reading URLs when the organization name was in the sub domain.

Desktop users

A user group categorized by technical experience that achieved a $20\%$ accuracy rate in the URL reading study.

Mobile users

The user group with the lowest technical experience scores, achieving a $15.9\%$ accuracy rate in predicting URL destinations.

URL shorteners

Services like bit.ly that create links where the true destination is entirely hidden until the actual redirect happens.

Type of squatting

A phishing method using deceptive characters, such as $\text{Google with 3 os}$ or Cyrillic symbols such as the Russian $\text{e}$, to imitate legitimate domains.

Certificate

Digital documentation that facilitates a TLS connection and can bind an organization's identity to a specific site.