"Oh, sh*t! I actually opened the document!": An Empirical Study of the Experiences with Suspicious Emails in Virtual Reality Headsets

Filipo Sharevski,Jennifer Vander Loop,Sarah Ferguson

2024-12-02

Abstract:This paper reports on a study exploring user experiences with suspicious emails and associated warnings when accessed through virtual reality (VR) headsets in realistic settings. A group of (n=20) Apple Vision Pro and another group of (n=20) Meta Quest 3 users were invited to sort through their own selection of Google mail suspicious emails through the VR headset. We asked them to verbalize the experience relative to how they assess the emails, what cues they use to determine their legitimacy, and what actions they would take for each suspicious email of their choice. We covertly sent a "false positive" suspicious email containing either a URL or an attachment (an email that is assigned a suspicious email warning but, in reality, is a legitimate one) and observed how participants would interact with it. Two participants clicked on the link (Apple Vision Pro), and one participant opened the attachment (Meta Quest 3). Upon close inspection, in all three instances, the participant "fell" for the phish because of the VR headsets' hypersensitive clicking and lack of ergonomic precision during the routine email sorting task. These and the other participants thus offered recommendations for implementing suspicious email warnings in VR environments, considerate of the immersiveness and ergonomics of the headsets' interface.

Cryptography and Security

What problem does this paper attempt to address?

The problems that this paper attempts to solve are: **Users' experiences and behaviors when dealing with suspicious emails through virtual reality (VR) head - mounted devices, and how to improve the design of suspicious email warnings in the VR environment**.

Specifically, the research aims to answer the following questions:

1. **RQ1: How do users evaluate suspicious emails sent to their own mailbox addresses through Meta Quest 3 and Apple Vision Pro VR head - mounted devices?**
- Researchers hope to understand the cues and judgment criteria used by users when evaluating suspicious emails by observing their behaviors in the VR environment.

2. **RQ2: What actions will users take regarding suspicious emails sent to their own mailbox addresses through Meta Quest 3 and Apple Vision Pro VR head - mounted devices?**
- Researchers hope to understand the specific operations of users when facing suspicious emails, such as whether they will click on links or download attachments, and their decision - making processes.

3. **RQ3: What suggestions do users have for the usability and immersion/ergonomics improvement of suspicious email warnings in the VR environment?**
- Researchers hope to make improvement suggestions through users' feedback to enhance the effectiveness and user experience of suspicious email warnings in the VR environment.

### Research Background

With the development of virtual reality technology, more and more people begin to use VR head - mounted devices to perform work - related tasks, such as email processing. However, this new interaction method brings new security challenges, especially when dealing with suspicious emails. Traditional desktop and mobile devices already have relatively complete suspicious email warning mechanisms, but it is unclear whether these warnings are equally effective in the VR environment. In addition, the immersive and ergonomic characteristics of VR devices may also affect users' judgment and operation.

### Research Methods

To study these problems, the author designed an empirical study and invited 40 participants (20 using Apple Vision Pro and 20 using Meta Quest 3) to let them deal with suspicious emails in their Gmail through VR devices. During the research process, the researchers secretly sent a fake suspicious email (actually a legal email but marked as suspicious) to observe users' behaviors and reactions.

### Main Findings

1. **Effectiveness of Warnings**:
- Approximately 75% of users said they would not interact with suspicious emails after encountering warnings, while only 20% of users who did not encounter warnings chose not to interact.

2. **Users' Dissatisfaction with Warning Formats**:
- Users generally think that the existing spam warning information is insufficient and the format is not intuitive enough. Suggested improvements include color - coding, adding risk - level prompts, and pop - up confirmation boxes, etc.

3. **Operational Challenges of VR Devices**:
- Some users reported that due to the high sensitivity and insufficient operational precision of VR devices, it is easy to make misoperations (such as accidentally clicking on links). This indicates that VR devices themselves also have certain security risks.

### Conclusion

This research provides empirical data on users' handling of suspicious emails in the VR environment and points out the challenges in terms of security of VR devices. The research results provide valuable references for improving the design of suspicious email warnings in the VR environment, which is helpful for enhancing users' network security awareness and protection capabilities.