[1]   Adams, A., and Sasse, M. A. Users are not the enemy. Commun. ACM 42, 12 (1999), 40–46.

[2]   APWG. Anti-phishing working group. https://www.antiphishing.org.

[3]   Arshad, F., and Reeder, R. When user studies attack: Evaluating security by intentionally attacking users. SOUPS Conference Report https://www.ieee-security.org/Cipher/ConfReports/2005/CR2005-SOUPS.html#%'_Toc110303259.

[4]   Atreya, C., Aviv, A., Johnson, M., Raykova, M., Bellovin, S. M., and Kaiser, G. Rust: The reusable security toolkit. In submission to SOUPS ’08: Proceedings of the symposium on Usable privacy and security (2008).

[5]   Brown, K. Step by step guide to infocard. https://msdn.microsoft.com/msdnmag/issues/06/05/securitybriefs/default.a%'spx.

[6]   Dhamija, R., Tygar, J. D., and Hearst, M. Why phishing works. In CHI ’06: Proceedings of the SIGCHI conference on Human Factors in computing systems (NY, NY, USA, 2006).

[7]   FFIEC. Authentication in an internet banking environment. https://www.ffiec.gov/pdf/authentication_guidance.pdf, 2005.

[8]   Forum, C. A. Extended validation SSL certificates. https://cabforum.org/.

[9]   Hallam-Baker, P. Secure internet letterhead. In W3C Workshop on Transparency and Usability of Web Authentication (2006).

[10]   ISO/IEC. ISO 9241-11 guidance on usability.

[11]   Jackson, C., Simon, D. R., Tan, D. S., and Barth, A. An evaluation of extended validation and picture-in-picture attacks. In Proceedings of Usable Security (USEC ’07) Workshop (2007).

[12]   Jakobsson, M., and Ratkiewicz, J. Designing ethical phishing experiments: A study of (ROT13) rOnl query features. In WWW ’06: Proceedings of the 15th international conference on World Wide Web (NY, NY, USA, 2006), ACM.

[13]   Schechter, S. E., Dhamija, R., Ozment, A., and Fischer, I. The emperor’s new security indicators. In Proceedings of the 2007 IEEE Symposium on Security and Privacy (Washington, DC, USA, 2007), IEEE Computer Society.

[14]   SOUPS 2006. Security user study toolkits. https://cups.cs.cmu.edu/soups/2006/workshop-kits/kits.html.

[15]   Whalen, T., and Inkpen, K. M. Gathering evidence: Use of visual security cues in web browsers. In GI ’05: Proceedings of the 2005 conference on Graphics interface (Waterloo, Ontario, Canada, 2005), Canadian Human-Computer Communications Society.

[16]   Wu, M., Miller, R. C., and Garfinkel, S. L. Do security toolbars actually prevent phishing attacks? In CHI ’06: Proceedings of the SIGCHI conference on Human Factors in computing systems (NY, NY, USA, 2006), ACM Press.

[17]   Wu, M., Miller, R. C., and Little, G. Web wallet: Preventing phishing attacks by revealing user intentions. In SOUPS ’06: Proceedings of the second symposium on Usable privacy and security (New York, NY, USA), ACM Press.