Websites are used regularly in our day-today lives, yet research has shown that it is challenging for many users to use them securely, e.g., most prominently due to weak passwords through which they access their accounts. At the same time, many services employ low-security measures, making their users even more prone to account compromises with little to no means of remediating compromised accounts. Additionally, remediating compromised accounts requires users to complete a series of steps, ideally all provided and explained by the service. However, for U.S.-based websites, prior research has shown that the advice provided by many services is often incomplete. To further understand the underlying issue and its implications, this paper reports on a study that analyzes the account remediation procedure covering the 50 most popular websites in 30 countries, 6 each in Africa, the Americas, Asia, Europe, and Oceania. We conducted the first transcontinental analysis on the account remediation protocols of popular websites. The analysis is based on 5 steps websites need to provide advice for: compromise discovery, account recovery, access limitation, service restoration, and prevention. We find that the lack of advice prior work identified for websites from the U.S. also holds across continents, with the presence ranging from 37% to 77% on average. Additionally, we identified considerable differences when comparing countries and continents, with countries in Africa and Oceania significantly more affected by the lack of advice. To address this, we suggest providing publicly available and easy-to-follow remediation advice for users and guidance for website providers so they can provide all the necessary information.
翻译:网站已深度融入我们的日常生活,但研究表明,许多用户难以安全地使用它们,其中最突出的问题是通过弱密码访问账户。与此同时,许多服务采用低安全性措施,导致用户更容易遭受账户被盗,且几乎没有修复被入侵账户的手段。此外,修复被入侵账户需要用户完成一系列步骤,这些步骤最好由服务方全部提供并解释。然而,针对美国网站的研究显示,许多服务提供的建议往往不完整。为深入理解这一问题的本质及其影响,本文报告了一项研究,分析了覆盖30个国家(非洲、美洲、亚洲、欧洲和大洋洲各6个)中最受欢迎的50个网站的账户修复流程。我们首次对热门网站的账户修复协议进行了跨洲分析。该分析基于网站需提供建议的5个步骤:入侵发现、账户恢复、权限限制、服务恢复和预防。我们发现,此前研究发现的美国网站缺乏建议的情况在各大洲普遍存在,建议提供率平均仅为37%至77%。此外,在国家和洲际比较中观察到显著差异,非洲和大洋洲国家受建议缺失的影响尤为严重。为解决这一问题,我们建议为用户提供公开且易于遵循的修复建议,并为网站提供商提供指导,使其能够提供所有必要信息。