Users need to confirm they are interacting with the system, not an application
Aliases: system identity confirmation · trusted attention · trusted interaction boundary
What it is
System–application interaction distinction lets a person determine that an interface is controlled by a protected operating-system component, not drawn by an ordinary application, before entering a device secret, granting privilege, or confirming a sensitive action. A trusted path connects human attention, protected input, system identity, and resulting execution through one verifiable channel.
Why it happens
Pixels have no provenance label. An application can go full-screen, overlay content, or imitate familiar dialogs. Color and icon alone provide copyable appearance. A hardware action, protected display region, non-interceptable input, and consistent exit behavior can give the system capabilities the application lacks, but users must also know when these signals should appear.
Studying it
Run controlled recognition tasks across legitimate system prompts, application-drawn imitations, overlays, and full-screen transitions while participants accept or reject actions of varying risk. Record evidence used, false trust, false rejection, entry into the trusted path, and safe exit. Adversarially test screenshotting, occlusion, focus theft, and protected-input capture. Asking which screen “looks more like the system” does not establish trust.
Where it stops holding
Visual distinction cannot prove the system or device is uncompromised, and remote desktop and assistive technology change the trust boundary. Hardware gestures may be unavailable or hard to remember and need an equivalent accessible mechanism. Not every setting merits an expensive trusted path; apply it by secret and consequence. Familiarity helps detect anomalies but cannot replace an unforgeable property.
Applying it
- Give passwords, device PINs, biometric activation, and high-privilege confirmation a system-owned entry point and protected input surface.
- Start high-risk interaction through an application-inaccessible hardware action or protected surface and teach its meaning before use.
- Show the requesting application, target account, and impending action, with safe cancellation back to the original task.
- Jointly red-team and usability-test malicious overlays, full-screen imitation, focus theft, and assistive-technology paths.