The Design and Development of an Interactive Story for Security Education: A Case Study on Password Managers

Abstract

Password managers allow us to generate unique passwords that ultimately protect our accounts and improve our password management. Despite being one of the most common security advice, adaption of password managers remain low. The complexity and magnitude of security advice leave users pondering about the best decision to keep themselves safe online. Indeed, it is generally better to learn concepts through a feedback loop, where we are informed, make a decision, and ultimately experience the consequences of our decisions. This feedback loop is absent in the traditional way security advice is given. In this thesis, I explore the potential of using interactive stories (Choose-Your-Own Adventure stories) to simulate security consequences to convey lessons and risks. Through participatory design, survey methods, interviews, and learning science principles, I developed and validated a comprehensive and effective interactive story to be used in security education. The results of this thesis show a promising approach of using interactive stories in the security education ecosystem.