Introduction to URL Destination Perception and UI Design Challenges

Challenges and Pessimism in URL Destination Security

• There is a high level of pessimism regarding the ability of User Interface (UI) design to resolve the current URL destination problem.

• While classes often focus on identifying design challenges to address these issues, the problem remains persistent and severe.

• History indicates that this challenge has not seen significant improvement in over $20$ years, unlike other areas of computing.

• The fundamental issue is that users struggle to understand where a URL is going due to various factors, some of which are structural and others behavioral.

Economic Impact and Motivation for URL Research

• Phishing remains an unsolved and extremely costly problem for individuals and organizations.

• The FBI reported over $29,000,000$ in United States losses related to phishing in the year $2017$ alone.

• The Ponemon Institute estimated that the cost per phishing incident in the United Kingdom exceeds $2,000,000$.

• Even large-scale corporations like Google and Facebook have been defrauded of approximately $100,000,000$ through single spear-phishing attacks.

• Automated filters are the first line of defense but are imperfect; they regularly miss malicious links, block legitimate ones, and are particularly weak against targeted spear-phishing.

• When automated security measures fail, the user becomes the final line of defense, making user comprehension of URLs critical.

Traditional Security Advice and Embedded Assumptions

• Common security advice typically includes:

  • Do not click on dangerous links.

  • Hover over the link to check the URL.

  • Manually type the URL into the browser.

• These tips rely on the quiet assumption that everyday users can read and interpret a URL accurately enough to make a safe decision.

• However, phishing features deliberately abuse URL structures to deceive users. For example, the brand names in "facebook.profile.com" and "profile.facebook.com" are identical, but only one is an official Facebook site.

Fundamentals of URL Structure

• A URL operates similarly to a postal address where the hierarchy of importance moves from right to left.

• The most important part of the address is on the right-hand side, becoming more specific as it moves to the left.

• Components of a URL (using "facebook.mobile.com" as an example):

  • $TLD$ (Top Level Domain): The ".com" portion.

  • Domain: The "mobile" portion; this identifies the actual owner of the site.

  • Subdomain: The "facebook" portion; a section of the site owned by whoever controls the domain (in this case, mobile.com).

• URL shorteners (e.g., bit.ly) exacerbate reading difficulties because the real destination is hidden until the redirect occurs.

Methodology of the Empirical Evaluation

• The researchers conducted a large-scale online survey with nearly $2,000$ participants to test URL reading accuracy under ideal conditions.

• Pre-study 1 (Brand Familiarity): $50$ participants from Amazon Mechanical Turk ($AMT$) and $50$ from Prolific were recruited. The goal was to select brands that were either extremely familiar (e.g., PayPal, Facebook) or very unfamiliar (e.g., TrapBody, Pew Point) to reduce the influence of brand trust.

• Pre-study 2 (Question Wording): Researchers compared "How safe do you think it is to click this link?" versus "Would you click this link?" They selected the former, utilizing a $5$ point Likert scale as it provided a wider range of responses for analysis.

• Experimental Controls:

  • All URLs used $HTTPS$ to prevent users from judging safety based purely on the protocol.

  • All URLs used the ".com" extension to avoid bias from unusual domain extensions.

  • Real organizations were used so users could verify them online if desired.

• URL Categories Tested ($23$ total URLs):

  • Pure domain URLs (e.g., microsoft.com) as a baseline.

  • Single subdomain URLs.

  • Short URLs.

  • Complex URLs designed to be deceptive.

Quantitative Findings and Predicted Accuracy

• Results indicate that users have extreme difficulty identifying URL destinations even when the structure is simple.

• The Brand-First Bias: $32.9\%$ of users assumed a familiar brand name appearing anywhere in the URL indicated the destination, while only $8.3\%$ correctly and consistently focused on the actual domain.

• Subdomain Performance:

  • Participants correctly answered an average of $6.4$ out of $12$ questions regarding subdomains.

  • When the organization name was in the domain, accuracy was high ($5.2$ out of $6$).

  • When the organization name was in the subdomain, accuracy dropped significantly ($1.2$ out of $6$).

• Complex URL Example: For the URL "facebook.com and google.com":

  • $30.1\%$ thought the destination was not listed.

  • $28.3\%$ selected Facebook as the destination.

  • Only $14.7\%$ correctly identified Google as the destination.

The Impact of Technology Experience

• The study categorized users into three groups based on technical skill via latent class analysis:

  • Power Users: The most technically experienced.

  • Desktop Users: Moderately experienced.

  • Mobile Users: Least technically experienced.

• While power users were more accurate than mobile users, the absolute performance was still low:

  • Power users reached only $25\%$ accuracy when a brand name was in the subdomain.

  • Desktop users reached $20\%$.

  • Mobile users reached $15.9\%$.

• Findings suggest that URL reading is not a skill that people naturally develop even with high levels of technology experience.

Perceived Safety and Mental Models

• Users rated URLs as safer when they believed the link led to a named, familiar organization.

• Single subdomain URLs received a median safety score of $4$ out of $5$.

• Shortened URLs received a median score of $2$ out of $5$, indicating users are somewhat aware that short links are unpredictable.

• The primary issue is a false sense of safety triggered by familiar brands, distracting users from the actual technical destination.

Theoretical and Practical Implications

• Challenge to Tradition: The study challenges the long-standing security assumption that users can identify suspicious URLs by sight.

• Mental Model Correction: Security training should move away from "Don't click" toward correcting mental models, specifically the difference between a domain and a subdomain.

• Interface Responsibility: The responsibility should not rest solely on the user. The study suggests developing new security interfaces that clearly indicate who controls the site content rather than requiring users to parse complex strings.

Questions & Discussion

• Question regarding Power User Definition: There was some debate regarding how the paper defined a "Power User." Typical definitions might imply someone with a PhD or an engineering background, but in the study, even these users were "hopeless" at the task. It was clarified that power users are those in computing-related fields or with significantly more technical exposure, yet they still struggled with deceptive syntax.

• Layers of the URL Comprehension Problem:

  • Comprehension/Parsing: Users do not understand the hierarchical nature of URL elements.

  • Attention: In many tasks, users never look at the URL at all. They prioritize aesthetics and functional feel (e.g., whether buttons work) over the address bar.

  • Typosquating and Homographs: Users often miss minor spelling errors (e.g., "google" with three o's) or the use of Cyrillic/Russian characters that look identical to Latin characters.

  • Identity and Legitimacy: Identifying the server is one task; identifying the entity behind the server and their intent (malicious vs. benevolent) is another.

• History of UI Interventions (Extended Validation Certificates):

  • Previously, browsers used Extended Validation ($EV$) certificates to show a green bar and the organization's name next to the URL.

  • This required background checks to verify the business was registered and legitimate.

  • Problems emerged when it was discovered that a malicious actor could register a company name in a different state (e.g., "Microsoft Inc." in Nevada) to get a legitimate certificate for a deceptive domain.

  • Google dropped this feature in $2019$ because it had virtually no effect on user behavior; the text was meaningless to users who hadn't been taught what it signified.

• Modern Browser Approaches: Browser developers have experimented with hiding the full URL. Safari previously hid everything except the domain name, only showing the full string when the user clicked on it. Current iterations of Google and Safari do little to visually foreground the domain over the subdomain, with some suggestions proposed to "demote" deceptive subdomains by using lower contrast colors.