Defaults, nudges and influence

Psychologist Robert Cialdini describes six techniques that influence decisions. The lecture treats them as close relatives of the biases in 02-02 — for exam purposes they are a separate, named list of six, not an eleventh bias to add to that page’s ten.

Reciprocity. People feel obliged to return a favour. A caller posing as IT support walks a new employee through some legitimate software, then suggests installing a “new tool IT is rolling out” — even though installing unapproved software may be against policy, the employee who just received free help is likely to comply.

Commitment and consistency. People feel uncomfortable acting against a commitment they have just made. An attacker calls a new employee, talks through security policy, and gets them to explicitly commit to following it. Immediately after, the attacker asks for the employee’s password “to verify compliance” — and having obtained it, can go a step further and talk the employee into choosing a “better” replacement password, one the attacker can easily guess.

Social proof / validation. People look at what others appear to be doing and follow it. A caller claiming to run a company-wide survey names colleagues in the same department who have supposedly already taken part, and the target is far more likely to answer sensitive questions as a result. The 2020 Twitter Bitcoin scam used the same mechanism at scale: attackers hijacked the verified accounts of high-profile figures such as Elon Musk, Bill Gates and Barack Obama, and the appearance of well-known, verified accounts promoting a donation drove people to send money to it.

Liking bias. People comply more readily with requests from someone they like. An attacker spends a few days building rapport over a shared interest — the lecture’s example is a shared enthusiasm for a pop singer — and once the target likes and trusts them, asks the target to install and try some software they are supposedly developing.

Respect to authority. People defer to a claimed authority figure without independently checking the claim. The lecture’s example: nurses in a hospital receive a phone call from someone claiming to be a physician, asking them to administer medication to a patient. In 95% of cases the nurses complied, stopped only because the experiment was called off before they reached the patient.

Scarcity. People place a higher value on whatever looks like it is running out. An SMS advertising a “limited-edition” product, claiming only a few remain and linking to a purchase page, uses the fear of missing out to push the click.

User conditioning and the click-whirr reaction. Repeated exposure to a situation trains a person to react to it automatically, without thinking it through — the lecture’s click-whirr reaction. Once the reflex forms, a security decision gets made before anyone actually decides. Three examples from the lecture:

• Nagging warning dialogues that need to be dismissed to keep working train users to click them away without reading, defeating the point of the warning.
• Windows’ “are you sure you want to delete this permanently?” prompt, confirmed so often it becomes a reflex, which is exactly when an accidental permanent deletion gets through.
• Certificate errors: most are benign and are essentially never linked to a real attack, so a user who habitually clicks past them is behaving rationally given the real base rate. That is precisely what makes the habit dangerous the rare time the warning is genuine. The slides pose, without resolving, the open question of what a system should show the user instead — this is left as an unanswered design problem, not a solved one.

Why user education mostly fails. Simply distributing a company security policy has little measurable effect on behaviour. Training that includes feedback and iteration does better, but two things limit it: the language security engineers use is not the language users think in, and users have no built-in reason to spend effort learning it when their actual job is something else entirely. The lecture’s conclusion is that training should complement good design, not replace it.