People disregard security warnings on computers because they come at bad times
As with many UI&#x2F;UX failures, this one has a long pedigree.  A Greek interface analyst some years back identified the canonical case:  <a href="http:&#x2F;&#x2F;etc.usf.edu&#x2F;lit2go&#x2F;35&#x2F;aesops-fables&#x2F;375&#x2F;the-boy-who-cried-wolf&#x2F;" rel="nofollow">http:&#x2F;&#x2F;etc.usf.edu&#x2F;lit2go&#x2F;35&#x2F;aesops-fables&#x2F;375&#x2F;the-boy-who-c...</a><p>I&#x27;m a long-time computer professional, I&#x27;ve used systems for decades.  I&#x27;ve got a security mindset.  Which is to say, I&#x27;m the furthest thing from a typical user.<p><i>I consistently dismiss and get rid of security alerts.</i><p>There are a whole host of problems with the general process of <i>conveying information to people in a method likely to result in the desired action</i>.  It is a very broad and general problem.  It ties into various areas of alerting, alerts overload, cognitive processing, psychological biases (of both users and developers), and more.<p>Among the elements:<p>1. Users are generally trying to do something.  Something <i>other</i> than what the developer is trying to alert them of.<p>2. Users are often trying to do <i>several</i> things.  The more so with mobile computing.  Hopefully they&#x27;re not operating heavy machinery (lawn mowers, cars, aircraft), <i>but that happens.</i><p>3. The local user environment is often hostile.  <i>Never underestimate the hostility of the operating environment.</i>  <a href="https:&#x2F;&#x2F;ello.co&#x2F;dredmorbius&#x2F;post&#x2F;ef662JsTwbGM_zH1s8qGZg" rel="nofollow">https:&#x2F;&#x2F;ello.co&#x2F;dredmorbius&#x2F;post&#x2F;ef662JsTwbGM_zH1s8qGZg</a><p>4. The user, not some remote developer or site, is in ultimate control over their system.  Perhaps not <i>perfect</i> control, but control.<p>5. <i>Systems are insanely shitty at preserving user state.</i>  And pretty much always have been.  <i>Especially</i> GUIs.  In my physical office, items remain where I leave them.  Though the appearance may seem chaotic to others, <i>it has a logic to me</i>, even if that&#x27;s only happenstance and temporary.  <i>Things moved, even only slightly, are maddening.</i><p>Our desktops often have little or no respect for our organisation.  They don&#x27;t have sufficient space, they don&#x27;t retain order.  File managers reorder files, desktops reorder windows and icons.  Applications, closed, don&#x27;t restore to original state.<p>Curiously, it&#x27;s limited and simple systems which tend to fare far better.  Commandline and console tools don&#x27;t have this state to be interferred with.  Directory listings don&#x27;t re-order themselves spontaneously.  Screen, or tmux, or vim, or emacs sessions are surprisingly effective at retaining state.  The old PalmOS didn&#x27;t afford a great many capabilities, <i>but those it did it afforded well</i>.  Android, by contrast, fares far worse, and a constant frustration is loss of content-in-process edited in a browser session.<p>The upshot:  <i>users hate restarting or updating systems, because everything changes, and systems don&#x27;t respect user state.</i><p>So even <i>if</i> an update could be run quickly and effectively, it&#x27;s avoided.<p>6. Systems don&#x27;t provide an option for rescheduling maintenance work for a truly opportune time.  Office cleaners don&#x27;t work during core business hours.  Maintenance work is, where possible, scheduled for off-peak hours or days.  Our computers don&#x27;t generally follow these practices, <i>if only because the maintenance processes themselves aren&#x27;t self-contained</i>.  User prompts or queries (often utterly meaningless) need to be addressed.  Updates cannot happen in a single contained session.  Multiple reboots and restarts occur.<p>7. Vendors don&#x27;t limit system security updates to system security changes.  In far too many instances, other changes are piggybacked in -- crapware installations, <i>feature removals</i>, and more, which past experience has often shown <i>cannot be effectively rolled back.</i><p>This gets <i>directly</i> to the fable I started this with and its message:  trust is a very, very fragile commodity, and abused is lost often forever.  <i>Do not fuck with your users&#x27; trust, you will die.</i>  Maybe not quickly, and often only slowly and painfully.<p>8. Programmers&#x27; and users&#x27; priorities for alerts differ hugely.  A programmer&#x27;s primary concern is covering their own ass -- not failing to alert for something which might possibly go wrong. A user&#x27;s concern is <i>getting their job done</i> and <i>being alerted if the building is on fire</i>.  For pretty much anything else, <i>they simply do not care, nor should they</i>.  Psychological limits on attention, and practical limits on expertise, mean that <i>querying</i> users for actions is almost always wrong.  <i>Do the right thing, do it without fucking with what the user&#x27;s activity, do it without fucking with the user&#x27;s state.</i><p>I&#x27;ve written previously on alerms and alerting in hospital and Google settings:<p><a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;dredmorbius&#x2F;comments&#x2F;1x0p1b&#x2F;npr_silencing_hospital_alarms_results_in_better&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;dredmorbius&#x2F;comments&#x2F;1x0p1b&#x2F;npr_sil...</a><p><a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;dredmorbius&#x2F;comments&#x2F;2j9xri&#x2F;alerting_response_google_site_reliability&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;dredmorbius&#x2F;comments&#x2F;2j9xri&#x2F;alertin...</a><p>Repacking this, what <i>should</i> alerts do?<p>1. If an action is harmful, <i>disable it.</i><p>2. If it&#x27;s not possible to tell if an action is harmful or not <i>figure out what the underlying threat is and fix the flaw exposing it.</i><p>3. Create stateless systems -- operating systems, applications, etc., should simply <i>revert to previous state when respawned, without user action.</i>  (A &quot;wipe slate&quot; feature might also be useful, though think through that.)  This calls for a pretty solid re-think of just what applications and environments are.<p>4. <i>Schedule maintenance for times the user isn&#x27;t actively using the system.</i>  The only exception is for maintenance which can occur without violating user space.<p>5. <i>Do not overload security and bugfix updates.</i>  The Windows 10 forced migration is a key instance of this.  Virtually any carrier- or vendor-based smartphone or tablet update likewise.  There are reasons I have bought my last Android device.  Samsung and Google have both violated my trust repeatedly.