"Adulthood is trying each of the same six passwords that you use for everything": The Scarcity and Ambiguity of Security Advice on Social Media

Video

DOI

Awareness of security and privacy best practices is important for computer users to keep their systems and data secure. Prior work has shown, in experimental settings, that social media are effective platforms for encouraging security-enhancing behavior and sharing security experiences. To understand how effective security and privacy discussions on social networks may be in practice, we study, via historical social media logs of 38 participants containing almost 200,000 social media posts, how and how much participants talked about security and privacy on social media platforms, specifically Facebook and Twitter. We found that interactions with security and privacy posts made up less than 0.09% of all interactions we observed. A thematic analysis of the security- and privacy-related posts that participants interacted with revealed that very rarely were posts constructively talking about security and privacy, instead often joking about security practices or encouraging undesirable behavior. Our findings, though based on a fraction of the population of social media users, suggest that while social networks may be effective in influencing security behavior, there may not be enough substantial or useful discussions of security and privacy to encourage better security behaviors in practice and on a larger scale. Our findings highlight the importance of increasing the prevalence of constructive security and privacy advice on online social media in order to encourage widespread adoption of best security practices.