Defaults, nudges and influence

A secure default does the work without asking the user for anything

The fastest way to get someone to do what you want is not usually a better argument. It is to arrange things so the easy path already is the one you want, or to trigger a response they make before they finish thinking. 02-02 showed that judgement under uncertainty is predictably biased. Security engineers lean on that to make the secure option effortless, and attackers lean on the same bias to make the insecure option feel obvious, socially normal or urgent.

A default is whatever setting applies automatically when nobody makes an explicit choice. Present bias (02-02) means most people keep it, so a security engineer who sets the secure option as the default gets the secure outcome without asking the user to do anything: automatic updates enabled, encryption on for sensitive data and communication channels, restrictive privacy settings out of the box, and minimal privileges assigned by default with more granted only on request.

Defaults cut both ways. Most social networks ship with relatively open sharing settings and leave them that way unless a user goes looking for the privacy page. When enough users lock their settings down, some platforms periodically change the settings architecture, which quietly resets the choice and forces everyone to opt out again. This is the same present-bias mechanism working against the user. It is also the lecture’s example of the control paradox: giving people more granular control over their privacy settings makes them share more information, not less, because the feeling of being in control lowers their guard.

A nudge is different from a default. It does not choose for the user; it makes the better choice more visible or convenient while leaving the decision theirs. A friendly notification to install the latest update, a reminder to turn on two-factor authentication, or a prompt to review privacy settings all move the same present-bias lever that a default moves outright.

Cialdini’s six techniques get the target to hand over access voluntarily

Psychologist Robert Cialdini describes six techniques that influence decisions. The lecture treats them as close relatives of the biases in 02-02, but for exam purposes they are a separate, named list of six, not an eleventh bias to add to that page’s ten. None of them defeats a technical control directly. Each gets the target to hand over a credential, install something, or answer a question voluntarily, so a well-configured system with a careless user is still a system an attacker can walk into.

Reciprocity. People feel obliged to return a favour. A caller posing as IT support walks a new employee through some legitimate software, then suggests installing a “new tool IT is rolling out”. Installing unapproved software may be against policy, but the employee who just received free help is likely to comply.

Commitment and consistency. People feel uncomfortable acting against a commitment they have just made. An attacker calls a new employee, talks through security policy, and gets them to explicitly commit to following it. Immediately after, the attacker asks for the employee’s password “to verify compliance”, and can then talk the employee into choosing a “better” replacement password that the attacker can easily guess.

Social proof / validation. People look at what others appear to be doing and follow it. A caller claiming to run a company-wide survey names colleagues in the same department who have supposedly taken part, and the target is far more likely to answer sensitive questions. The 2020 Twitter Bitcoin scam used the same mechanism at scale: attackers hijacked the verified accounts of figures such as Elon Musk, Bill Gates and Barack Obama, and the appearance of well-known, verified accounts promoting a donation drove people to send money.

Liking bias. People comply more readily with requests from someone they like. An attacker spends a few days building rapport over a shared interest (the lecture’s example is a shared enthusiasm for a pop singer), and once the target likes and trusts them, asks the target to install and try some software they are supposedly developing.

Respect to authority. People defer to a claimed authority figure without independently checking the claim. The lecture’s example: nurses in a hospital receive a phone call from someone claiming to be a physician, asking them to administer medication to a patient. In 95% of cases the nurses complied, stopped only because the experiment was called off before they reached the patient.

Scarcity. People place a higher value on whatever looks like it is running out. An SMS advertising a “limited-edition” product, claiming only a few remain and linking to a purchase page, uses the fear of missing out to push the click.

Optional aside

The lecture attributes the 95%-compliance hospital experiment to “R. Cialdini, Influence, 2006.” The experiment itself is the Hofling hospital study, conducted by Charles K. Hofling and colleagues in 1966: 21 of 22 nurses (95.4%) complied with an unknown “Dr Smith“‘s phone order to administer double the labelled maximum dose of a fictitious drug. Cialdini discusses the study in his book; he did not run it. The exam follows the lecture’s own framing and figure.

Pitfall

Naming the technique correctly matters more than describing the scenario back. A question that hands you an authority-figure phone call and asks “which technique” wants the single word “authority” (or the matching option), not a restatement that the caller sounded convincing.

Repeated warnings train a click-whirr reflex, and education alone does not fix it

Recognising a technique in the moment helps, but the lecture does not treat recognition as the fix. The stronger response is to design the secure action so it does not depend on the user spotting a persuasion attempt under pressure, the same way a good default does not depend on the user remembering to turn a setting on.

Repeated exposure to a situation trains a person to react automatically, without thinking it through. The lecture calls this the click-whirr reaction, and once the reflex forms, a security decision gets made before anyone actually decides. Three examples from the lecture:

• Nagging warning dialogues that must be dismissed to keep working train users to click them away without reading, defeating the point of the warning.
• Windows’ “are you sure you want to delete this permanently?” prompt, confirmed so often it becomes a reflex, which is exactly when an accidental permanent deletion gets through.
• Certificate errors. Most are benign and essentially never linked to a real attack, so a user who habitually clicks past them is behaving rationally given the real base rate. That is what makes the habit dangerous the rare time the warning is genuine. The slides pose, without resolving, the question of what a system should show the user instead.

Recall

A user clicks past a certificate warning without reading it, the way they always do, and this time the warning was real. Was the user being careless?

Not in the way “careless” usually implies. Given how rarely certificate errors correlate with a genuine attack, dismissing them is a reasonable habit built from real experience; the lecture calls users “completely right to ignore” most of them. The habit is still what let the real one through, which is why the slides leave open what should be shown to the user instead of leaving the current warning to condition past.

User education mostly fails. Simply distributing a company security policy has little measurable effect on behaviour. Training that includes feedback and iteration does better, but two things limit it: the language security engineers use is not the language users think in, and users have no built-in reason to spend effort learning it when their actual job is something else. The lecture’s conclusion is that training should complement good design, not replace it.