After an April survey involving the Luxembourg Institute of Health suggested that daily consumption of chocolate could reduce heart disease, the sweet treat has now cropped up in another study, this time by psychologists at the University of Luxembourg.
The objective of the inaugural study was to examine the concept of "social engineering" within the context of computer hackers using psychological strategies to manipulate computer users into divulging their login details.
"Social engineering targets the weakest link in the chain, and that is the user," explained Dr. André Melzer, co-author of the studay "Trick with Treat - Reciprocity Increases the Willingness to Communicate Personal Data" which was recently published in the journal "Computers in Human Behavior". "More specifically, we investigated the psychological principle of reciprocity. When someone does something nice for us, we automatically feel obliged to return the favour. This principle is universal and important for the way we function as a society. However, this internal pressure can also be exploited to achieve certain purposes, such as encouraging someone to divulge a password."
The experiment involved 1,208 people and researchers asking randomly-selected passers-by about their attitude towards computer security, as well as for their password. The interviewers carried University of Luxembourg bags but were otherwise strangers to the respondents. In certain instances, the researchers gave participants chocolate before asking them for their password, whilst the control group was only given chocolate following the interview.
The results were both intriguing and worrying: in cases where chocolate was only given out afterwards, 29.8% of participants revealed their passwords, whilst 43.5% of respondents were willing to give up this piece of personal information when chocolate was received beforehand. This likelihood increased even further when chocolate was offered immediately prior to the participants being asked to divulge their password, with 47.9% divulging the information compared with 39.9% of participants who received their gift at the beginning of the interview.
The view showed the strength of the incentive and pressure of reciprocity. "This simulated attack was in no way a sophisticated criminal strategy. Although the consequences of such attacks can be severe for individuals or companies, many people lack awareness of such dangers," concluded Melzer.
Photo by University of Luxembourg (André Melzer)
