{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T15:42:09Z","timestamp":1785512529625,"version":"3.56.0"},"publisher-location":"New York, NY, USA","reference-count":57,"publisher":"ACM","license":[{"start":{"date-parts":[[2014,12,8]],"date-time":"2014-12-08T00:00:00Z","timestamp":1417996800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000144","name":"Division of Computer and Network Systems","doi-asserted-by":"publisher","award":["CNS-1149730, CNS-1223588, CNS-1205415"],"award-info":[{"award-number":["CNS-1149730, CNS-1223588, CNS-1205415"]}],"id":[{"id":"10.13039\/100000144","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2014,12,8]]},"DOI":"10.1145\/2664243.2664254","type":"proceedings-article","created":{"date-parts":[[2014,12,8]],"date-time":"2014-12-08T16:30:28Z","timestamp":1418056228000},"page":"296-305","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":49,"title":["It's the psychology stupid"],"prefix":"10.1145","author":[{"given":"Daniela","family":"Oliveira","sequence":"first","affiliation":[{"name":"University of Florida, Bowdoin College"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Marissa","family":"Rosenthal","sequence":"additional","affiliation":[{"name":"University of Florida, Bowdoin College"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nicole","family":"Morin","sequence":"additional","affiliation":[{"name":"University of Florida, Bowdoin College"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kuo-Chuan","family":"Yeh","sequence":"additional","affiliation":[{"name":"Pennsylvania State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Justin","family":"Cappos","sequence":"additional","affiliation":[{"name":"NYU"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yanyan","family":"Zhuang","sequence":"additional","affiliation":[{"name":"NYU"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2014,12,8]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"\"Symantec Internet Security Threat Report 2013.\" http:\/\/www.symantec.com\/content\/en\/us\/enterprise\/other_resources\/b-istr_main_report_v18_2012_21291018.en-us.pdf.  \"Symantec Internet Security Threat Report 2013.\" http:\/\/www.symantec.com\/content\/en\/us\/enterprise\/other_resources\/b-istr_main_report_v18_2012_21291018.en-us.pdf."},{"key":"e_1_3_2_1_2_1","volume-title":"Passwords Found in the Wild for","author":"Marshall B. K.","year":"2013","unstructured":"B. K. Marshall , \"PasswordResearch.com Authentication News : Passwords Found in the Wild for January 2013 .\" http:\/\/blog.passwordresearch.com\/2013\/02\/passwords-found-in-wild-for-january-2013.html. B. K. Marshall, \"PasswordResearch.com Authentication News: Passwords Found in the Wild for January 2013.\" http:\/\/blog.passwordresearch.com\/2013\/02\/passwords-found-in-wild-for-january-2013.html."},{"key":"e_1_3_2_1_3_1","unstructured":"\"Seventeen steps to safer C code.\" http:\/\/www.embedded.com\/design\/programming-languages-and-tools\/4215552\/Seventeen-steps-to-safer-C-code.  \"Seventeen steps to safer C code.\" http:\/\/www.embedded.com\/design\/programming-languages-and-tools\/4215552\/Seventeen-steps-to-safer-C-code."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1037\/0033-295X.103.3.582"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1093\/acprof:oso\/9780199744282.001.0001"},{"key":"e_1_3_2_1_6_1","first-page":"71","article-title":"The tyranny of choice","author":"Schwartz B.","year":"2004","unstructured":"B. Schwartz , \" The tyranny of choice ,\" Scientific American , pp. 71 -- 75 , 2004 . B. Schwartz, \"The tyranny of choice,\" Scientific American, pp. 71--75, 2004.","journal-title":"Scientific American"},{"key":"e_1_3_2_1_7_1","first-page":"24","article-title":"The dark side of choice: When choice impairs social welfare","author":"Botti S.","year":"2006","unstructured":"S. Botti and S. S. Iyengar , \" The dark side of choice: When choice impairs social welfare ,\" American Marketing Association , pp. 24 -- 38 , 2006 . S. Botti and S. S. Iyengar, \"The dark side of choice: When choice impairs social welfare,\" American Marketing Association, pp. 24--38, 2006.","journal-title":"American Marketing Association"},{"key":"e_1_3_2_1_8_1","volume-title":"Foundations of security: what every programmer needs to know","author":"Kern C.","year":"2007","unstructured":"C. Kern , A. Kesavan , and N. Daswani , Foundations of security: what every programmer needs to know . Apress , 2007 . C. Kern, A. Kesavan, and N. Daswani, Foundations of security: what every programmer needs to know. Apress, 2007."},{"key":"e_1_3_2_1_9_1","volume-title":"Social psychological methods of emotion elicitation (Handbook of Emotion Elicitation and Assessment)","author":"Harmon-Jones E.","year":"2007","unstructured":"E. Harmon-Jones , D. M. Amodio , and L. R. Zinner , Social psychological methods of emotion elicitation (Handbook of Emotion Elicitation and Assessment) . Oxford University Press , 2007 . E. Harmon-Jones, D. M. Amodio, and L. R. Zinner, Social psychological methods of emotion elicitation (Handbook of Emotion Elicitation and Assessment). Oxford University Press, 2007."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1002\/bs.3830250306"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1287\/deca.1100.0191"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9781139173933"},{"key":"e_1_3_2_1_13_1","volume-title":"Human Behavior and The Principle of Least Effort","author":"Zipf G. K.","year":"1949","unstructured":"G. K. Zipf , Human Behavior and The Principle of Least Effort . Addison-Wesley , 1949 . G. K. Zipf, Human Behavior and The Principle of Least Effort. Addison-Wesley, 1949."},{"key":"e_1_3_2_1_14_1","volume-title":"Simple Heuristics that Make Us Smart","author":"Rieskamp J.","year":"1999","unstructured":"J. Rieskamp and U. Hoffrage , Simple Heuristics that Make Us Smart . Oxford University Press , 1999 . J. Rieskamp and U. Hoffrage, Simple Heuristics that Make Us Smart. Oxford University Press, 1999."},{"key":"e_1_3_2_1_15_1","first-page":"63","volume-title":"StackGuard: Automatic adaptive detection and prevention of buffer-overflow attacks,\" in USENIX Security","author":"Cowan C.","year":"1998","unstructured":"C. Cowan , C. Pu , D. Maier , J. Walpole , P. Bakke , S. Beattie , A. Grier , P. Wagle , Q. Zhang , and H. Hinton , \" StackGuard: Automatic adaptive detection and prevention of buffer-overflow attacks,\" in USENIX Security , pp. 63 -- 78 , Jan 1998 . C. Cowan, C. Pu, D. Maier, J. Walpole, P. Bakke, S. Beattie, A. Grier, P. Wagle, Q. Zhang, and H. Hinton, \"StackGuard: Automatic adaptive detection and prevention of buffer-overflow attacks,\" in USENIX Security, pp. 63--78, Jan 1998."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/1368088.1368112"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/1111037.1111070"},{"key":"e_1_3_2_1_18_1","unstructured":"\"Urllib and validation of server certificate.\" http:\/\/stackoverflow.com\/questions\/6648952\/.  \"Urllib and validation of server certificate.\" http:\/\/stackoverflow.com\/questions\/6648952\/."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1147\/sj.133.0230"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1102120.1102168"},{"key":"e_1_3_2_1_21_1","volume-title":"Qualitative Research: Studying How Things Work","author":"Stake R. E.","year":"2010","unstructured":"R. E. Stake , Qualitative Research: Studying How Things Work . The Guilford Press , 2010 . R. E. Stake, Qualitative Research: Studying How Things Work. The Guilford Press, 2010."},{"key":"e_1_3_2_1_22_1","unstructured":"\"Qualtrics (http:\/\/www.qualtrics.com\/).\"  \"Qualtrics (http:\/\/www.qualtrics.com\/).\""},{"key":"e_1_3_2_1_23_1","volume-title":"Statistics for the Behavioral Sciences. Wadsworth\/Thomson Learning","author":"Gravetter F.","year":"2009","unstructured":"F. Gravetter and L. Wallnau , Statistics for the Behavioral Sciences. Wadsworth\/Thomson Learning , 8 th ed., 2009 . F. Gravetter and L. Wallnau, Statistics for the Behavioral Sciences. Wadsworth\/Thomson Learning, 8th ed., 2009.","edition":"8"},{"key":"e_1_3_2_1_24_1","volume-title":"Learning from Strangers - The Art and Method of Qualitative Interview Studies","author":"Weiss R. S.","year":"1994","unstructured":"R. S. Weiss , Learning from Strangers - The Art and Method of Qualitative Interview Studies . The Free Press , 1994 . R. S. Weiss, Learning from Strangers - The Art and Method of Qualitative Interview Studies. The Free Press, 1994."},{"key":"e_1_3_2_1_25_1","volume-title":"The Coding Manual for Qualitative Researchers","author":"Saldana J.","year":"2012","unstructured":"J. Saldana , The Coding Manual for Qualitative Researchers . SAGE Publications , 2012 . J. Saldana, The Coding Manual for Qualitative Researchers. SAGE Publications, 2012."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.5555\/1095704"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/360051.360056"},{"key":"e_1_3_2_1_28_1","unstructured":"R. Anderson \"Why information security is hard - an economic perspective \" ACSAC 2001.   R. Anderson \"Why information security is hard - an economic perspective \" ACSAC 2001."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.6028\/NBS.IR.76-1041"},{"key":"e_1_3_2_1_30_1","volume-title":"DTIC AD A056816","author":"Hollingsworth R.","year":"1978","unstructured":"R. B. II and D. Hollingsworth , \" Protection Analysis Project Final Report,\" ISI\/RR-78-13 , DTIC AD A056816 , USC\/Information Sciences Institute , 1978 . R. B. II and D. Hollingsworth, \"Protection Analysis Project Final Report,\" ISI\/RR-78-13, DTIC AD A056816, USC\/Information Sciences Institute, 1978."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/185403.185412"},{"key":"e_1_3_2_1_32_1","unstructured":"T. Aslam \"A Taxonomy of Security Faults in the UNIX Operating System \" 1995.  T. Aslam \"A Taxonomy of Security Faults in the UNIX Operating System \" 1995."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/2413296.2413309"},{"key":"e_1_3_2_1_35_1","volume-title":"December","author":"Bratus S.","year":"2011","unstructured":"S. Bratus , M. E. Locasto , M. L. Patterson , L. Sassaman , and A. Shubina , \" Exploit Programming: From Buffer Overflows to \"Weird Machines\" and Theory of Computation.\" USENIX ;login , December 2011 . S. Bratus, M. E. Locasto, M. L. Patterson, L. Sassaman, and A. Shubina, \"Exploit Programming: From Buffer Overflows to \"Weird Machines\" and Theory of Computation.\" USENIX ;login, December 2011."},{"key":"e_1_3_2_1_36_1","first-page":"3","volume-title":"LEET'12, (Berkeley, CA, USA)","author":"Samuel M.","year":"2012","unstructured":"M. Samuel and U. Erlingsson , \" Let's Parse to Prevent pwnage (invited position paper),\" in Proceedings of the 5th USENIX conference on Large-Scale Exploits and Emergent Threats , LEET'12, (Berkeley, CA, USA) , pp. 3 -- 3 , USENIX Association , 2012 . M. Samuel and U. Erlingsson, \"Let's Parse to Prevent pwnage (invited position paper),\" in Proceedings of the 5th USENIX conference on Large-Scale Exploits and Emergent Threats, LEET'12, (Berkeley, CA, USA), pp. 3--3, USENIX Association, 2012."},{"key":"e_1_3_2_1_37_1","volume-title":"March","author":"Garg V.","year":"2013","unstructured":"V. Garg and L. J. Camp , \" Heuristics and biases: Implications for security,\" IEEE Technology & Society , March 2013 . V. Garg and L. J. Camp, \"Heuristics and biases: Implications for security,\" IEEE Technology & Society, March 2013."},{"key":"e_1_3_2_1_38_1","volume-title":"A trend analysis of exploitations,\" IEEE Symposium on Security and Privacy","author":"Browne H. K.","year":"2001","unstructured":"H. K. Browne , W. A. Arbaugh , J. McHugh , and W. L. Fithen , \" A trend analysis of exploitations,\" IEEE Symposium on Security and Privacy , 2001 . H. K. Browne, W. A. Arbaugh, J. McHugh, and W. L. Fithen, \"A trend analysis of exploitations,\" IEEE Symposium on Security and Privacy, 2001."},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/RAMS.2006.1677355"},{"key":"e_1_3_2_1_41_1","first-page":"136","article-title":"Towards a unifying approach in understanding security problems","author":"Alhazmi O. H.","year":"2009","unstructured":"O. H. Alhazmi and Y. K. Malaiya , \" Towards a unifying approach in understanding security problems ,\" IEEE International Conference on Software Reliability Engineering (ISSRE) , pp. 136 -- 145 , 2009 . O. H. Alhazmi and Y. K. Malaiya, \"Towards a unifying approach in understanding security problems,\" IEEE International Conference on Software Reliability Engineering (ISSRE), pp. 136--145, 2009.","journal-title":"IEEE International Conference on Software Reliability Engineering (ISSRE)"},{"key":"e_1_3_2_1_42_1","unstructured":"\"Open Source Vulnerability Database (http:\/\/www.osvdb.org\/).\"  \"Open Source Vulnerability Database (http:\/\/www.osvdb.org\/).\""},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/1809100.1809104"},{"key":"e_1_3_2_1_44_1","volume-title":"An Empirical Study on using the National Vulnerability Database to Predict Software Vulnerabilities,\" International Conference on Database and Expert Systems Applications (DEXA)","author":"Zhang S.","year":"2011","unstructured":"S. Zhang , D. Caragea , and X. Ou , \" An Empirical Study on using the National Vulnerability Database to Predict Software Vulnerabilities,\" International Conference on Database and Expert Systems Applications (DEXA) , 2011 . S. Zhang, D. Caragea, and X. Ou, \"An Empirical Study on using the National Vulnerability Database to Predict Software Vulnerabilities,\" International Conference on Database and Expert Systems Applications (DEXA), 2011."},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653717"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/IMF.2009.15"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.5555\/1785594.1785641"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijhcs.2011.07.007"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2012.245"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"crossref","unstructured":"B. Fischhoff P. Slovic S. Lichtenstein and B. C. Stephen Read \"How safe is safe enough? a osychometric study of attitudes towards technological risks and benefits \" Policy Sciences vol. 9 no. 2 1978.  B. Fischhoff P. Slovic S. Lichtenstein and B. C. Stephen Read \"How safe is safe enough? a osychometric study of attitudes towards technological risks and benefits \" Policy Sciences vol. 9 no. 2 1978.","DOI":"10.1007\/BF00143739"},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2010.198"},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1080\/03637759209376276"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/50087.50089"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1016\/0164-1212(87)90032-X"},{"key":"e_1_3_2_1_55_1","first-page":"113","volume-title":"Uml class diagram syntax: an empirical study of comprehension,\" in Proceedings of the 2001 Asia-Pacific symposium on Information visualisation-Volume 9","author":"Purchase H. C.","year":"2001","unstructured":"H. C. Purchase , L. Colpoys , M. McGill , D. Carrington , and C. Britton , \" Uml class diagram syntax: an empirical study of comprehension,\" in Proceedings of the 2001 Asia-Pacific symposium on Information visualisation-Volume 9 , pp. 113 -- 120 , Australian Computer Society, Inc. , 2001 . H. C. Purchase, L. Colpoys, M. McGill, D. Carrington, and C. Britton, \"Uml class diagram syntax: an empirical study of comprehension,\" in Proceedings of the 2001 Asia-Pacific symposium on Information visualisation-Volume 9, pp. 113--120, Australian Computer Society, Inc., 2001."},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.compedu.2007.10.003"},{"key":"e_1_3_2_1_57_1","volume-title":"Expert software design strategies","author":"Visserl W.","year":"1990","unstructured":"W. Visserl , J.-M. Hocz , and F. Chesnay , \" Expert software design strategies ,\" 1990 . W. Visserl, J.-M. Hocz, and F. Chesnay, \"Expert software design strategies,\" 1990."},{"key":"e_1_3_2_1_58_1","first-page":"255","volume-title":"The processes involved in designing software,\" Cognitive skills and their acquisition","author":"Jeffries R.","year":"1981","unstructured":"R. Jeffries , A. A. Turner , P. G. Polson , and M. E. Atwood , \" The processes involved in designing software,\" Cognitive skills and their acquisition , pp. 255 -- 283 , 1981 . R. Jeffries, A. A. Turner, P. G. Polson, and M. E. Atwood, \"The processes involved in designing software,\" Cognitive skills and their acquisition, pp. 255--283, 1981."},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1002\/int.4550010304"}],"event":{"name":"ACSAC '14: Annual Computer Security Applications Conference","location":"New Orleans Louisiana USA","acronym":"ACSAC '14","sponsor":["ACSA Applied Computing Security Assoc"]},"container-title":["Proceedings of the 30th Annual Computer Security Applications Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2664243.2664254","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2664243.2664254","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T06:12:01Z","timestamp":1750227121000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2664243.2664254"}},"subtitle":["how heuristics explain software vulnerabilities and how priming can illuminate developer's blind spots"],"short-title":[],"issued":{"date-parts":[[2014,12,8]]},"references-count":57,"alternative-id":["10.1145\/2664243.2664254","10.1145\/2664243"],"URL":"https:\/\/doi.org\/10.1145\/2664243.2664254","relation":{},"subject":[],"published":{"date-parts":[[2014,12,8]]},"assertion":[{"value":"2014-12-08","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}