The Horror Browser

I was thinking about security usability (as usual) when I stumbled across Nayan Ramachandran's article about what makes a horror game scary. Hmm, some of these scare tactics sound familiar. For your entertainment if not edification, I present the horror browser.

On your first visit to a site you have never visited before, the browser darkens and plays the sound of a door creaking slowly open.

Suddenly, a zombie jumps out of the window to inform you that there is a problem with the site's SSL certificate. You are jaded, so you click through, finding the popup more and more irritating and less scary each time you see it.

Sometimes, when you submit a non-SSL form, an animated gremlin runs off the screen with your data.

Whenever you send cookies, you can hear your browser breathing, and the occasional choked sob indicates it encountered a web bug.

The browser makes periodic eerie noises whenever one of its plugins is vulnerable. Will your machine be infected?

Whenever you encounter an HTTP redirect to an explicit IP address, the browser shows sinister-looking spinning things in an attempt to distract and confuse you.

It's been weeks, and you and your vulnerable plugin are doing just fine, when you hear the eerie noises again, only this time, you see the flicker of a monster running across the browser window. As the monster closes the mini-blinds over the page you were viewing, you realize your home page has been hijacked.

You get email from your bank. Your webmail application shows a harmless looking child who says your account will be cancelled if you don't re-enter your personal information. Just as you enter your social security number, you realize: it's not your bank at all. Too late!

On the one hand, this is pretty silly, both for itself and because most of the Web is not out to get you. On the other hand, users make security decisions based on how secure they feel, not how secure the situation actually is. So, tying the language of fear to risky online security decisions (provided the browser actually knows which decisions are risky) could help users make better decisions in these cases. As Matthew Gallant comments,

Enemy aesthetics should repulse the player before the actual "threat" can be evaluated; ideally the player should feel a sense of "I don't want that thing near me" before it gets close to enough to prove harmful.

Sleep well, don't let the zombies get you, and send me some screenshots if you see the gremlins.

--Brenda