Influence of Risk/Safety Information Framing on Android App-Installation Decisions

Abstract

We conducted three experiments with participants recruited on Amazon’s Mechanical Turk to examine the influence on app-installation decisions of summary risk information derived from the app permissions. This information can be framed negatively as amount of risk or positively as amount of safety, which was varied in all the experiments. In Experiments 1 and 2, the participants performed tasks in which they selected two Android apps from a list of six; in Experiment 3, the tasks were to reject two apps from the list. This summary information influenced the participants to choose less risky alternatives, particularly when it was framed in terms of safety and the app had high user ratings. Participants in the safety condition reported that they attended more to the summary score than did those in the risk condition. They also showed better comprehension of what the score was conveying, regardless of whether the task was to select or reject. The results imply that development of a valid risk/safety index for apps has the potential to improve users’ app-installation decisions, especially if that information is framed as amount of safety.

Keywords

compatibility effects cyber cybersecurity information security privacy risk communication security usability

Get full access to this article

View all access options for this article.

References

Barnes

M. J.

McDermott

P. L.

Hutchins

Rothrock

(2011). Framing, loss aversion, and visualization of risk for a dynamic simulation environment. Journal of Cognitive Engineering and Decision Making, 5, 294-308.

Bergum

B. O.

Bergum

J. A.

(1981). Population stereotypes: An attempt to measure and define. Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 25, 662-665.

Brainerd

C. J.

Reyna

V. F.

(2002). Fuzzy-trace theory: Dual processes in memory, reasoning, and cognitive neuroscience. Advances in Child Development and Behavior, 28, 41-100.

Brandt

M. J.

IJzerman

Dijksterhuis

Farach

F. J.

Geller

Giner-Sorolla

… van’t Veer

(2014). The replication recipe: What makes for a convincing replication? Journal of Experimental Social Psychology, 50, 217-224.

Brust-Renck

P. G.

Royer

C. E.

Reyna

V. F.

(2013). Communicating numerical risk: Human factors that aid understanding in health care. Reviews of Human Factors and Ergonomics, 8, 235-276.

Chernev

(2009). Choosing versus rejecting: The impact of goal-task compatibility on decision confidence. Social Cognition, 27, 249-260.

Chin

Felt

A. P.

Sekar

Wagner

(2012). Measuring user confidence in smartphone security and privacy. In Proceedings of the Eighth Symposium on Usable Privacy and Security (pp. 1-16). New York: ACM.

Cisco Systems, Inc. (2014, Jan 16). Cisco 2014 annual security report. Retrieved February 18, 2014, from https://www.cisco.com/web/offer/gist_ty2_asset/Cisco_2014_ASR.pdf.

eMarketer. (2014). Worldwide smartphone usage to grow 25% in 2014. Retrieved from http://www.emarketer.com/Article/Worldwide-Smartphone-Usage-Grow-25-2014/1010920

10.

Felt

A. P.

Greenwood

Wagner

(2011). The effectiveness of application permissions. In Proceedings of the 2nd USENIX conference on Web application development (pp. 75-86). Berkeley, CA: USENIX Association.

11.

Felt

A. P.

Egelman

Haney

Chin

Wagner

(2012). Android permissions: User attention, comprehension, and behavior. In Proceedings of the Eighth Symposium on Usable Privacy and Security (pp. 1-14). New York: ACM.

12.

Frings

(2012). The effects of sleep debt on risk perception, risk attraction and betting behavior during a blackjack style gambling task. Journal of Gambling Studies, 28, 393-403.

13.

Gambara

Piñon

(2005). A meta-analytic review of framing effect: Risky, attribute and goal framing. Psicothema, 17, 325-331.

14.

Garcia-Retamero

Dhami

M. K.

(2013). On avoiding framing effects in experienced decision makers. The Quarterly Journal of Experimental Psychology, 66, 829-842.

15.

Gates

Chen

Proctor

R. W.

(2014). Effective risk communication for Android Apps. IEEE Transactions on Dependable and Secure Computing, 11, 252-265.

16.

Gates

Peng

Sarma

Potharaju

Nita-Rotaru

Mollay

(2014). Generating summary risk scores for mobile applications. IEEE Transactions on Dependable and Secure Computing, 11, 238-251.

17.

Huber

O. W.

Bär

A. S.

(2014). Framing of decisions: Effect on active and passive risk avoidance. Journal of Behavioral Decision Making, 27, 444-453.

18.

Hung

Tangpong

(2010). General risk propensity in multifaceted business decisions: Scale development. Journal of Managerial Issues, 22, 88-106.

19.

Johnson

J. G.

Raab

(2003). Take the first: Option-generation and resulting choices. Organizational Behavior and Human Decision Processes, 91, 215-229.

20.

Kelley

P. G.

Consolvo

Cranor

L. F.

Jung

Sadeh

Wetherall

(2012). A conundrum of permissions: Installing applications on an android smartphone. In Financial cryptography and data security (pp. 68-79). Berlin: Springer.

21.

Kelley

P. G.

Cranor

L. F.

Sadeh

(2013). Privacy as part of the app decision-making process. In Proceedings of the 2013 ACM annual conference on Human Factors in Computing Systems (pp. 3393-3402). New York: ACM.

22.

Krug

(2000). Don’t make me think: A common sense guide to Web usability. Berkeley, CA: New Riders.

23.

Lai

Y. L.

Hui

K. L.

(2006). Internet opt-in and opt-out: Investigating the roles of frames, defaults and privacy concerns. In Proceedings of the 2006 ACM SIGMIS CPR conference on computer personnel research: Forty four years of computer personnel research: achievements, challenges & the future (pp. 253-263). New York: ACM.

24.

Lin

Amini

Hong

J. I.

Sadeh

Lindqvist

Zhang

(2012). Expectation and purpose: Understanding users’ mental models of mobile app privacy through crowdsourcing. In Proceedings of the 2012 ACM Conference on Ubiquitous Computing (pp. 501-510). New York: ACM.

25.

Livingstone

Haddon

Görzig

Ólafsson

(2011). Risks and safety on the internet: The UK report. London: EU Kids Online.

26.

Luce

R. D.

(1986). Response times: Their role in inferring elementary mental organization. New York: Oxford University Press.

27.

Mansfield-Devine

(2012). Paranoid Android: Just how insecure is the most popular mobile platform? Network Security, 2012(9), 5-10.

28.

Mayhorn

C. B.

Fisk

A. D.

Whittle

J. D.

(2002). Decisions, decisions: Analysis of age, cohort, and time of testing on framing of risky decision options. Human Factors, 44, 515-521.

29.

McLaughlin

Mayhorn

C. B.

(2014). Designing effective risk communications for older adults. Safety Science, 61, 59-65.

30.

Meloy

M. G.

Russo

J. E.

(2004). Binary choice under instructions to select versus reject. Organizational Behavior and Human Decision Processes, 93, 114-128.

31.

Nagpal

Krishnamurthy

(2008). Attribute conflict in consumer decision making: The role of task compatibility. Journal of Consumer Research, 34, 696-705.

32.

O’Toole

(2014, February). Mobile apps overtake PC Internet usage in U.S. CNN Money. Retrieved from http://money.cnn.com/2014/02/28/technology/mobile/mobile-apps-internet/.

33.

Peng

Gates

Sarma

Potharaju

Nita-Rotaru

Molloy

(2012). Using probabilistic generative models for ranking risks of Android apps. In Proceedings of the 2012 ACM conference on computer and communications security (pp. 241-252). New York: ACM.

34.

Reyna

V. F.

(2008). A theory of medical decision making and health: Fuzzy trace theory. Medical Decision Making, 28, 850-865.

35.

Reyna

V. F.

Brainerd

C. J.

(1995). Fuzzy-trace theory: An interim synthesis. Learning and Individual Differences, 7, 1-75.

36.

Rubaltelli

Dickert

Slovic

(2012). Response mode, compatibility, and dual-processes in the evaluation of simple gambles: An eye-tracking investigation. Judgment & Decision Making, 7, 427-440.

37.

Schwartz

(2011). Deceiving and informing: The risky business of risk perception. Medical Decision Making, 31, 378-379.

38.

Shabtai

Fledel

Kanonov

Elovici

Dolev

Glezer

(2010). Google android: A comprehensive security assessment. IEEE Security & Privacy, 8(2), 35-44.

39.

Shafir

(1993). Choosing versus rejecting: Why some options are both better and worse than others. Memory & Cognition, 21, 546-556.

40.

Shafir

(1995). Compatibility in cognition and decision. In Busemeyer

Hastie

Medin

D. L.

(Eds.), The psychology of learning and motivation (Vol. 32, pp. 247-274). San Diego, CA: Academic Press.

41.

Slovic

Griffin

Tversky

(1990). Compatibility effects in judgment and choice. In Hogarth

R. M.

(Ed.), Insights in decision making: A tribute to Hillel J. Einhorn (pp. 5-27). Chicago: University of Chicago Press.

42.

Toch

Wang

Cranor

(2012). Personalization and privacy: A survey of privacy risks and remedies in personalization-based systems. User Modeling and User-Adapted Interaction, 22, 203-220.

43.

Tversky

Kahneman

(1981). The framing of decisions and the psychology of choice. Science, 211, 453-458.

44.

Tversky

Kahneman

(1986). Rational choice and the framing of decisions. Journal of Business, 59, S251-S278.

45.

Tversky

Sattath

Slovic

(1988). Contingent weighting in judgment and choice. Psychological Review, 95, 371-384.