Increasing Security Sensitivity With Social Proof

TLDR

Higher awareness and use of security tools remain a major challenge in computer security, and social proof—displaying friends’ usage of security features—has emerged as a promising but underexplored strategy. This study investigates whether presenting users with social proof can increase exploration and adoption of key Facebook security features. We exposed 50,000 Facebook users to eight variations of social‑proof announcements and a non‑social control, measuring their exploration and adoption of Login Notifications, Login Approvals, and Trusted Contacts. The announcement that displayed the number of friends using a feature drove 37 % more users to explore it, raised awareness, and increased overall adoption, though among those who explored there was no difference in adoption rates between social and non‑social announcements, a result confirmed by a follow‑up survey.

Abstract

One of the largest outstanding problems in computer security is the need for higher awareness and use of available security tools. One promising but largely unexplored approach is to use social proof: by showing people that their friends use security features, they may be more inclined to explore those features, too. To explore the efficacy of this approach, we showed 50,000 people who use Facebook one of 8 security announcements'7 variations of social proof and 1 non-social control-to increase the exploration and adoption of three security features: Login Notifications, Login Approvals, and Trusted Contacts. Our results indicated that simply showing people the number of their friends that used security features was most effective, and drove 37% more viewers to explore the promoted security features compared to the non-social announcement (thus, raising awareness). In turn, as social announcements drove more people to explore security features, more people who saw social announcements adopted those features, too. However, among those who explored the promoted features, there was no difference in the adoption rate of those who viewed a social versus a non-social announcement. In a follow up survey, we confirmed that the social announcements raised viewer's awareness of available security features.