# PowerQoPE: A Personal Quality of Internet Protection and Experience Configurator

Enock Samuel Mbewe, Taveesh Sharma, Josiah Chavula

► To cite this version:

Enock Samuel Mbewe, Taveesh Sharma, Josiah Chavula. PowerQoPE: A Personal Quality of Internet Protection and Experience Configurator. 16th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2022, Mytilene, Lesbos, Greece. pp.310-327, 10.1007/978-3-031-12172-2_25. hal-05324946

HAL Id: hal-05324946

https://inria.hal.science/hal-05324946v1

Submitted on 21 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# PowerQoPE: A Personal Quality of Internet Protection and Experience Configurator

Enock Samuel Mbewe(✉), Taveesh Sharma, and Josiah Chavula

School of IT, Department of Computer Science, University of Cape Town,
Cape Town, South Africa

{embewe,tsharma,jchavula}@cs.uct.ac.za

http://www.uct.ac.za/

**Abstract.** Security configuration remains obscure for many Internet users, especially those with limited computing skills. This obscurity exposes such users to various Internet attacks. Recently, there has been an increase in cyberattacks targeted at individuals due to the remote workforce imposed by the COVID 19 pandemic. These attacks have exposed the inefficiencies of the non-human-centric implementation of Internet security mechanisms and protocols. Security research usually positions users as the weakest link in the security ecosystem, making system and protocol developers exclude the users in the development process. This stereotypical approach has negatively affected users' security uptake. Mostly, security systems are not comprehensible for an average user, negatively affecting performance and Quality of Experience. This causes the users to shun using security mechanisms. Building on human-centric cybersecurity research, we present a tool that aids in configuring Internet Quality of protection and Experience (referred to as PowerQoPE in this paper). We describe its architecture and design methodology and finally present evaluation results. Preliminary evaluation results show that user-centric and data-driven approaches in the design of Internet security systems improves users' Quality of Experience. The controlled experiment results show that users are not really stupid; they know what they want and that given proper security configuration platforms with proper framing of components and information, they can make optimal security decisions.

**Keywords:** Usable security · QoE · QoP · Internet security · Cybersecurity

## 1 Introduction

Internet usage has become part of our daily life, with its technologies affecting every part of our daily activities. The prevalence of smartphone usage has

Supported by Hasso Platner Institute for Digital Engineering.
transformed the technology landscape, pushing the responsibility for one's digital data to the individuals. Security is one such responsibility that one must master to ensure cyber safety. Until the recent past, security has been considered corporates' responsibility and confined to a perimeter [1]. In this paradigm, most security systems are not designed for average users who form a greater part of the Internet user base. This kind of security implementation is referred to as *stupid user* or *paternalistic* security implementation [2,3]. The exclusion of users in the security systems design robs them of the opportunity to acquaint themselves with necessary security knowledge, further deforming their security mental models and paralysing their online security practice [4]. The rapid penetration of mobile devices and personalised computing platforms has demolished security perimeters calling for a paradigm shift in security implementation. Security authors agree that security systems should be human-centric, considering three fundamental concepts: User, Usage, and Usability [1].

The latest advancements in technology, such as smartphone, the Internet of Things (IoT), and Wireless Sensor Networks (WSNs), however, has completely changed the landscape of cybersecurity. We now witness the increased cyber-attacks targeted at individuals abolishing any perimeters that existed. This means that individuals must be vigilant to protect their digital assets, making security configuration a personal responsibility. Some security researchers have proposed a paradigm shift from the human out-of-security loop to the human-in-the-security loop (human-centred cybersecurity or security orchestration). The argument is that if humans are involved in security decision making, they would have better security mental models, reinforcing their security practice. However, the Internet users' mental models have been reported to be flawed by the stupid user security implementation. Their proposal follows results from a series of usable and security usability research which found that certain user behaviours either positively or negatively impact their practice [5]. Such behaviours usually are maintained throughout one's lifetime [6]. For example, overconfidence ("nothing bad can happen to me") and hyperbolic discounting (trading of security for short term benefits). These result in a privacy paradox, a situation where users' needs for privacy do not match their practice. The unfortunate part is that usually, users often underestimate the risks associated with such behaviours [7].

Internet security mechanisms and applications such as IP Security (IPsec), Virtual Private Networks (VPNs), Domain Name Systems (DNS), and Content filtering, among others, are some of the security systems that are yet to be designed for average users. DNS, for example, a fundamental component of the Internet, is barely understood by many users. Attackers exploit this weakness on one extreme who then successfully manipulate DNS records, monitor user transactions, and inject unsolicited ads and malware. Research shows that much as these can be configured by the user, they are usually hidden from the average user and are not fully comprehensible by this class of users. Demographics determine socio-technical approaches, which are very key in the Human-cyber space interaction. As such, security systems should target diverse classes of users. Usable security mainly focuses on systems and platforms. It seldomly touches on
the usability of the underlying components of the Internet. Building on previous research, this paper focuses on the intersection of Quality of Security Services (also known as Quality of Protection (QoP)) and Quality of Experience (QoE). This paper collectively calls these services Quality of Protection and Experience (QoPE).

Previous work shows that most users do not configure Internet security, citing configuration complexity and overhead. Despite the failure to implement security, most Internet users acknowledge the need to stay safe online. Other reasons behind the non-implementation of security mechanisms include the negative effect of security on performance, especially in poorer network conditions. A user study by Mbewe and Chavula [4] showed that “flawed security practice does not only result from users’ negligence, but also lack of sufficient Internet security knowledge”. They, therefore, suggested that Internet security configuration frameworks should be designed with capabilities to reinforce users’ security knowledge and mental models. This study focuses on DNS privacy, VPN, and content filtering. We follow a data-driven approach to ensure that the designed system reflects the network conditions under which the device is operating. We also incorporate nudging in the form of the high-level costs of the security settings. The contributions of this work lie in the quality of protection and experience. We argue that if the users are provided with different security configuration levels with their associated costs, they would be able to comprehend some of the security concepts that have been obscure to them and, in the long run, reinforce their security mental models leading to better security practice.

## 2 Background and Related Work

Security is generally defined as the collection of all measures to prevent loss of any kind. The security concept is as old as humankind, implying that human assets have been at risk ever since humanity existed. It can be categorised into two main groups: physical security and digital security. Physical security is mainly a personal responsibility, and, over time, humans have developed complex physical security mechanisms. This may be partly attributed to regular interaction and regular experimentation with the systems. Individuals can choose the level of security they need depending on the circumstances and on what they are protecting. Digital security, on the other hand, mostly follows a delegated approach modelled after power. Security researchers have for so long argued that security concepts are too complex to be understood by human beings. Hence, it is better to manage their security centrally where knowledgeable people can understand the concepts. Security was often seen as mathematical and technical. Following this line of argument, the same argument has been repeated by different researchers, with others coining humans as the weakest link in the security ecosystem. Thus, this kind of security implementation made sense in the era when the Internet was for the elite and corporates. In this paradigm, perimeter defence made sense.
## 2.1 Quality of Protection

The early research about human involvement in deciding the level of digital security was coined Quality of Security Service (QoSS) and later Quality of Protection (QoP) [8–13]. This kind of research is aimed at balancing security and performance (throughput, latency and delay) or at least allowing the resource management systems to tradeoff security and performance. The idea came about because, generally, adding security to service increases the resource consumption and the delay of information exchange, thereby decreasing the Quality of Service (QoS), which, in turn, degrades Quality of Experience (QoE) [14–19]. Due to the multi-attribute nature of security, different researchers have focused on measuring the impact of specific security mechanisms on QoS and Quality of Experience (QoE). In an attempt to understand the impact of different encryption mechanisms on VoIP, studies [14, 15, 18] have shown that the IPSec protocol reduces jitter but significantly increases latency and end-to-end delay. They, however, recommend increasing bandwidth which might be expensive in low-resource networks. However, implementation of the proposed solutions followed the same paternalistic paradigm suiting the technological advancements of the time. The security applications developed using the recommendations from QoP research suffered a Single Point of Attack (SPoA), leading to a Single Point of Failure (SPoF). For example, Nahrstedt [8] proposed a middleware adaptation scheme to provide End-to-End tunable delay (QoS) and security. The scheme was later proven by Chen et al. [10] to be susceptible to Denial of Service bandwidth attack. To solve the identified weakness, Chen et al. [11] proposed a framework for integrating QoS and security and developing a security advisory system. Again, this solution was later proven to be susceptible to attack broadcasting. Despite the shortfalls, QoP research inspired the emerging human-centred security and Quality of Experience research.

For the majority of the users and applications, increased security cannot be achieved with technology that decreases usability. A study by Cardoso [20] proposes that the system interface be designed for ease of use so that users apply the protection mechanisms correctly. He argues that mistakes will be minimised if the users’ mental image of their protection goals matches the security mechanisms. To design this mental model, Irvine [21, 22] developed a Quality of Security Service costing framework for quantifying costs related to security service. The study uses a security translation matrix developed by Ivirne [23], which maps the elements of a simple user interface i.e. *high*, *medium*, *low* to a detailed security invocation mechanism. The study quantifies the cost from *CPU time*, *memory*, *bandwidth*, *disk space*, *delay*, *jitter* and *latency*. The authors conclude by proposing that further research be conducted to determine formulae for calculating resource costs for a range of security services and determining the best units for cost measures. Much as their work focused more on resource management systems, they tried to untangle the misconceptions about security, users and QoS. Such works inspire our work in conjunction with mental modelling research. We use the measurements approach to provide device-based security-performance costs.
# 3 System Design

## 3.1 Design Goals

The primary goal of our system is to assist Internet users, especially those with limited computing skills, to easily configure internet security settings on users' Internet access devices such as smartphones. These settings should be selected based on the network resources available on the device as well as the user's desired security level. For example, suppose the user experiences sub-optimal network performance at a given security level. In that case, they should be able to switch to a security level that provides better network performance. The system should also cater to the advanced category of users who have better understanding of their security configurations. These users usually desire autonomy in choosing the parameters that govern their smartphones' security and network performance. To achieve this, the system should allow a user to choose from all possible combinations of security parameters. Once a particular configuration is chosen and activated by the user, they should be able to also be able to test and monitor the performance of their connections. In addition, the system should be able to schedule tests periodically on the devices to collect performance data. The system should also be able to learn from this data and provide better informed security choices the next time a user requests for security configuration.

## 3.2 Choosing Parameters

Studies [24,25] have shown that choice of DNS resolver preferences are pivotal to the level of QoE for users. Mbewe and Chavula [26] further measured the impact of applying DNS filters on QoE. Their results showed that apart from providing the user with an opportunity to choose an extra layer of protection, choice of filters impacts QoE. The authors also conducted a user study investigating Internet users' security mental models, their security configuration experience and general security practice [4]. Their results show inadequate Internet security mental models in self-reported expert and non-expert Internet users. Their mental modelling and task analysis revealed that the flawed security practice does not only result from users' negligence but also lack of sufficient Internet security knowledge. They finally recommended reinforcement of users' Internet security mental models through personalised security configuration frameworks to allow users, especially those with limited technical skills, to configure their desired security level easily. This work, therefore, builds on such works and presents a personal Internet security configuration companion. The following paragraphs outline the architecture, system components, and configuration parameters.

PowerQoPE integrates three privacy-centric protocols: DNS privacy (including DNS-based content filtering), VPNs and Transport Layer Security (TLS). These have been discussed in literature [4,27–30] and they offer a multiplicity of protections based on use case but mostly difficult to many novice Internet users. We use public DNS services as shown in Table 1, which have extensively been used in DNS privacy performance measurement works. All DNS providers except
for Google have filter instances such as Security, Adult, Family and Ads filters. DNS filtering is a practice of blocking access to a domain for specific reasons such as content filtering. A site will be blocked if the contents it presents are deemed inappropriate by the configuration, such as gambling, malware, pornography, and unsolicited ads, among others. PowerQOPE uses known blocking databases and filter-enabled DNS services to help the user easily configure content filtering with minimal hustles. It further classifies commonly negotiated ciphers into strength levels using classes 3 to 5 as implemented in OpenSSL (level 5: high, level 4: medium and level 3: low).

The user interface of our application is designed to provide four main levels of security - high, medium, low, advanced. Essentially, the user choice levels are determined by DNS protocol, VPN, web-filtering and cipher strength. For example, in the high, we use non-logging DoH (which is more private than DoT), remote VPN, and a stricter web filter. In the medium security option, we use DoT, local VPN, cipher strength level 4, and family filter. Finally, we use Do53, local VPN, cipher level 3 and Do53-based family filter in the low-security level. The outcome of a security decision by the server also depends upon the type of network to which the user's device is connected. For a given network type and configuration combination, the system returns the configuration with the least page load time. In the current implementation, only two network types are supported - mobile (4G, 3G) and WiFi. Once the user decides to use a particular configuration level, our system makes a security decision by allowing the configurations to be chosen from each of the below sets:

1. $D$: A set of recursive DNS resolvers. Our current implementation supports the below recursive resolvers and their respective security filters as shown in Table 1. Each recursive resolver provides different options for the type of security filters. Each filter has three variants - DNS over port 53 (Do53), DNS over TLS (DoT), and DNS over HTTPS (DoH). In Table 1, for example, Cloudflare provides three distinct security filters, and each can be implemented with either Do53, DoT or DoH, giving $3 \times 3 = 9$ distinct options for the system to choose from.

<table><caption>**Table 1.** Different DNS providers and their security filter variants.</caption><thead><tr><td>DNS provider</td><td>Security filters</td></tr></thead><tbody><tr><td>CloudFlare</td><td>No filter, Security, Family</td></tr><tr><td>Google</td><td>No filter</td></tr><tr><td>Quad9</td><td>No filter, Security</td></tr><tr><td>Cleanbrowsing</td><td>Family, Adult, Security</td></tr><tr><td>Adguard</td><td>No filter, Ad block, Family</td></tr></tbody></table>
2. $\mathcal{C}$: A set of preferred cipher suites: As the name suggests, a cipher suite is a suite or a combination of ciphers responsible for authentication, key exchange, bulk encryption and signing.

3. $\mathcal{V}$: A set of publicly available VPN servers. Whenever the VPN mode is enabled in our system, the user's smartphone connects to a remote VPN server. These servers are chosen from a predefined list that contains servers that are freely available for academic use.

Formally, a security configuration can be denoted as a member of the set $\mathcal{D} \times \mathcal{C} \times \mathcal{V}$. Whenever the user chooses the advanced configuration, they have complete control over which member to choose from $\mathcal{D}$, $\mathcal{C}$ and $\mathcal{V}$. In all other cases, the system decides based on historical data, the user's current network type and the security level chosen. In our current implementation, VPN servers are only used when the user selects the high-security level or chooses to enable VPN at the advanced security level.

## 3.3 System Overview

<figure><img src="image_3.png" /><figcaption>**Fig. 1.** An architecture of the proposed system, PowerQoPE. In this figure, the dotted arrows represent configuration-specific connections.</figcaption></figure>

The PowerQoPE system (Fig. 1) is equipped to assist Android phone users in taking charge of their device's security. In the current implementation, the system can be used to collect measurement data and store it in the measurements repository for further analysis. All the security decisions made by the system are static and based on what has been observed previously by experimentation.
An orchestration engine forms the heart of the PowerQoPE system. A user can initiate three types of measurements from the Android application. These include speed tests, HTTP tests and video tests. Speed tests measure the latency, upload and download speed of data transfer between the nearest server and the user. HTTP tests provide insights about DNS response time, page load time and other related parameters when a website (either user-defined or system-defined) is visited from within the app. Video tests measure the buffer, load time and bandwidth for a system-defined video file. In the current implementation, these tests can only be initiated by the user.

For users who may be unfamiliar with terms like DNS, filters, VPN, cipher suites, the system provides three main security configurations - low, medium and high. As per previous experiments, if a stricter security level is chosen, the performance of applications that access the Internet is expected to degrade for poorer connections. Thus, users with a very high-quality internet connection can enjoy the benefits of maximum security that could be configured.

The Android application provides an advanced options radio button for a technically capable user. On tapping this button, they can choose the specific DNS provider and the type of filter (family, advertisements, security) depending on whether it is available with the provider or not. Since the list of supported cipher suites is large, the application only provides the category of the cipher (low, medium, high) as an option. If a user selects a specific cipher category, all ciphers belonging to that category are sent to any subsequent HTTP request made from within the app.

## 3.4 Architectural Components

**PowerQoPE Server.** This component is responsible for orchestrating the measurements, including HTTP webpage downloads, speed tests and video tests. The design of this measurement server is a modified version of QoSMon, an architecture proposed by Sharma and Chavula [31]. One key modification to this design allows measurements to be scheduled on a specific device instead of any device.

- **Measurements Scheduling Engine:** This component allows measurements to be scheduled periodically on end-user devices by minimising the contention between network and CPU resources used by measurements. This engine can be configured to use four existing measurement scheduling algorithms [32].

- **Decision Engine:** There are two main categories of decisions that the PowerQoPE server is involved in. The first decision is related to selecting the best DNS configuration for a user. The decision engine searches the historical data and finds out all the configurations with the same network type and chosen level of security. Then, it chooses a single configuration that corresponds to the least page load time. The second decision is related to choosing a VPN server when the user has selected a high configuration. The PowerQoPE server maintains a list of freely available VPN servers and updates it every 30 min with their latest configurations. Then, when asked to decide, the server chooses a single VPN server with the lowest latency and the highest throughput.
- **Remote DNS proxy:** This proxy is used in configurations where remote VPN capabilities are enabled. Our application uses OpenVPN [33] for configuring a new VPN server, and it requires the recursive resolver's IP address to be written in a configuration file. This works well for Do53 and DoT, but not in the case of DoH because it requires the complete URL of the recursive resolver instead of the IP address. Therefore, we decided to relay all DoH requests through a proxy that we configured beforehand with a particular DoH-based resolver.

**User Application Module.** The user application module (See Fig. 2) handles user configurations and user-initiated measurements. It comprises a user interface, measurements module, nudge generator and the QoPE configuration module. The user module handles user preferences and configures them on the operating system. In the current implementation of PowerQoPE, only Android phones are supported. The Android user application is designed so that it persists its connection with the server even when the user switches from one network to another. We now briefly describe each of the user module components:

<figure><img src="image_4.png" /><figcaption>Fig. 2. User application module components and user interface wireframe</figcaption></figure>

- **QoPE configuration Module:** The QoPE configuration module handles user preferences based on the decisions and classifications made by the PowerQoPE server and configures them on the device. The user can as well overwrite server recommendations by performing the advanced configuration. Currently, the module can configure DNS (Do53, DoT and DoH), web filtering, VPN and cipher suites. We provide the user with high-level choices; low, medium, high and advanced. The app connects to a local VPN server in low and medium configurations. It resolves any subsequent HTTP requests via a recursive resolver recommended by the server. In high configuration or any other configuration with VPN enabled, the app connects to a remote VPN
server. This remote server can either be chosen by the user or recommended by the system, depending on whether the advanced configuration is selected. All subsequent HTTP requests are sent through the VPN tunnel and resolved via a remote DNS proxy in this type of setting.

# 4 Evaluation

## 4.1 Methodology

This section describes the procedure followed to evaluate the components of PowerQoPE. We conducted an evaluative controlled user experiment to test the effectiveness of personal Internet security configuration tool, especially on the configuration options and security-performance cost. The experiment aimed to assess whether providing Internet users with levels of security configuration and accompanying the levels with their associated performance or privacy cost would modify user's security choice.

**Participants.** To ably evaluate the usefulness and inform further design of the app, an initial usability study was carried out with 14 participants (seven females and seven males). These users were novice frequent Internet users with a basic understanding of computing. Purposive sampling of participants was used to get ideas from a specific cadre of Internet users, i.e. novice Internet users. All the participants completed high school and understood English.

**Design.** Three interfaces (See Fig. 3) of security configurations were designed to assess whether adding the performance cost of different security configurations would help users make an informed security decision. The first interface had only the security configuration levels (High, Medium, Low and Advanced). The second screen was activated by toggling a button. On toggling, descriptive costs of the underlying security mechanisms were added under each security option, categorised under network quality, video streaming quality and security/privacy. We decided to use a within-subject controlled user experiment [34] approach to fully measure if the protection motivation features of the app would modify users' security and QoE mental models. Within-subjects experimental design demands that each participant tests all the conditions under study. In our case, each participant performed all the three tasks.

In order to test whether security costs and visual cost framing, in addition to the security levels, would improve the security mental models and encourage users to configure better security, we provided different interfaces of the personal security configuration tool, enabled by toggling different combinations of the configurations. First, we have security levels with no cost information (LCn) as control (See Fig. 3a). Then, security levels with textual cost information (LC, Fig. 3b) and security cost with visual cost framing (LCV, Fig. 3c). We further randomised the order of the security options for each task.
<figure><img src="image_5.png" /><figcaption>(a) First screen containing security configuration levels only</figcaption></figure>

<figure><img src="image_6.png" /><figcaption>(b) Second screen containing security configuration levels with their associated textual cost information</figcaption></figure>

<figure><img src="image_7.png" /><figcaption>(c) Third screen containing security configuration levels with their associated textual and graphical cost information</figcaption></figure>

<caption>**Fig. 3.** Configuration screens for tasks 1 to 3</caption>

**Materials.** The experiment required the following materials:

- A smartphone with android operating system.

- A mobile application which we developed iteratively for this purpose.

- Deliberate configuration of three different interfaces that visibly showed different elements.

- An interview guide used as a follow up between tasks.

**Procedure.** The Ethical clearance was sought from our University's ethics committee. The experiment was conducted at a telecentre on Likoma Island in Malawi. The location was ideal because there was an ongoing project to sensitise the youth on general cybersecurity. The researcher had no relationship with the participants, and the experiment was not related to the project.

The convener welcomed the participants, and explained the aim of the experiment. Then the participants were given an online informed consent form to read and, if in agreement, sign. It was emphasised that participants were free to withdraw from the study. Then the participants completed a pre-experiment questionnaire that captured demographics and assessed their Internet security knowledge. No identifying information was collected. Finally, the participants were assigned unique IDs.

The participants were asked to install the app on their smartphones. The experiment began when participants indicated that they were ready. Participants were asked to open the PowerQoPE app they had just installed. Then they were asked to choose their desired protection level from a list of radio buttons
(High, medium, low, advanced). Then the participants were asked to run the measurements module (both Internet speed and web QoE) using their security choice. This was specifically done to collect empirical performance cost of the selected security level. The participants were asked to give a rationale for their choice marking the end of the first task. The researcher recorded the responses on a notepad. There was a lapse of 15 min between the tasks.

Then the researcher toggled the cost information for each security option. The order of the security options was shuffled (i.e. medium, low, high) to minimise learning effects. The participants were asked to choose their desired level of protection, this time, based on the cost information visible. Again, they were required to run the measurements module if their choice in Task 1 differed from their choice in Task 2. The researcher asked them to explain their choice, and the responses were recorded.

Finally, the researcher toggled visual cost. This setting only appended simile faces to the cost information. The participants were asked to repeat the tasks. Participants' preferences were recorded for each task and summarised.

# 5 Results

This section provides two sets of results; analysis of the user experiment and results from the measurements.

## 5.1 Influence of Security Cost Information on Users' Choice of Security Level

Users' security options for each task were tabulated and compared. Figure 4 shows participants' security preferences against conditions. Recall that Task 1 only provided the security levels from which the participant was required to choose one option based on the PMT's framing of the options and their mental models. Task 2 added textual cost information to the security levels. The cost information was qualitative to avoid suffocating the participant with technical details. The costs were based on network performance, browsing, and experience and security/privacy.

The results show that 100% of participants chose the high-security option in Task 1. When textual information was added in Task 2, 50% of the participants changed their preference to medium while 21% chose low security. Finally, when visual cost nudges were added to the cost information, 71% of the participants chose medium security, 21% chose high security, and only 1 (8%) chose low security.

When asked why they configured high security in Task 1, many responded that they “care about security and secure connection”. However, when presented with cost information, the same 71% of the participants changed from a high-security configuration. When asked about the sudden change of preference, one participant said,
"Slow internet flustrates, I would rather have a combination of good Internet performance and security, hence my change from high to medium-security."

Three (3) participants switched from high security to low security. When asked why they chose low security, the participants said they would rather compromise security but not Internet speed.

<figure><img src="image_8.png" /><figcaption>**Fig. 4.** Participants' security preferences for each condition (Task 1: Security levels only, Task 2: Security levels plus textual performance cost, Task 3: Security levels, textual and visual performance cost)</figcaption></figure>

Task 3 results did not differ much from Task 2's. However, two of the three who chose the low-security option in Task 2 changed to medium-security. When asked why that change, one participant attributed the change to the images that accompanied the cost information saying that the visual nudges made the costs more visible.

We finally run paired t-tests between tasks to determine whether the differences were significant. We first compared Task 1 and Task 2, then Task 1 and Task 3 and finally Task 2 and Task 3. In short, we present the combinations as $T_1 - T_2$, $T_1 - T_3$ and $T_2 - T_3$, where T stands for "Task" as shown in Fig. 5.

<table><caption>**Fig. 5.** Paired samples test</caption><caption>Paired Samples Test</caption><thead><tr><th rowspan="3"></th><th rowspan="3"></th><th colspan="6">Paired Differences</th><th rowspan="3">t</th><th rowspan="3">df</th><th rowspan="3">Sig. (2-tailed)</th></tr><tr><th rowspan="2">Mean</th><th rowspan="2">Std. Deviation</th><th rowspan="2">Std. Error</th><th colspan="2">95% Confidence Interval of the Difference</th></tr><tr><th>Lower</th><th>Upper</th></tr></thead><tbody><tr><td>Pair 1</td><td>T<sub>1</sub> - T<sub>2</sub></td><td>-1.071</td><td>.730</td><td>.195</td><td>-1.493</td><td>-0.650</td><td>-5.491</td><td>13</td><td>.000</td></tr><tr><td>Pair 2</td><td>T<sub>1</sub> - T<sub>3</sub></td><td>-1.143</td><td>.535</td><td>.143</td><td>-1.451</td><td>-0.834</td><td>-8.000</td><td>13</td><td>.000</td></tr><tr><td>Pair 3</td><td>T<sub>2</sub> - T<sub>3</sub></td><td>-.071</td><td>.730</td><td>.195</td><td>-.493</td><td>.350</td><td>-.366</td><td>13</td><td>.720</td></tr></tbody></table>
From Fig. 5, we observe a significant difference between Task 1 and Task 2 ($p = .000$), Task 1 and Task 3 ($p = .000$). We observe no significant difference between Task 2 and Task 3 ($p = .720$). This tells us that cost information, whether textual or combined with graphical costs, can modify users’ security preferences. The results also show that adding a visual nudge to the textual cost information does not significantly affect users’ security preferences.

## 5.2 Empirical Performance Impact of Users’ Choice of Security Level

Descriptive statistics were used to analyse the measurements data. Figure 6 shows empirical performance impact of users’ security choice. Metrics of interest were page load time, DNS response time, network speed and SSL time. Due to space limitation, we will consider pageload time and SSL time.

<figure><img src="image_9.png" /><figcaption>Fig. 6. User initiated measurement results</figcaption></figure>

Figure 6a shows page load time CDF for security levels. Generally, we see that high security is slower than the medium and low-security options. However, we see that high-security options outperform both medium and low levels for faster loading pages. We suspect that such faster loading websites are at the top of the tranco list and have caches within Africa. In general, we observe that high-security configuration results in longer page load time while medium level has moderate PLTs followed by low-security level. Similar patterns are observed in Fig. 6b which shows the impact of cipher suite strength on SSL time which in turn affects page load time. However, higher strength ciphers outperform medium strength ciphers for the not-so-famous websites, i.e. websites at the tail of the tranco list<fnref n="1" />. This is because most preferred stronger ciphers perform 1 round trip while medium ciphers perform 2 round trips. Therefore, higher latency domains will incur longer SSL handshake time.

<footnote n="1">¹ See https://tranco-list.eu/latest_list.</footnote>
# 6 Discussion

Thus far, we have presented the design and preliminary evaluation of a security configuration tool called PowerQoPE. Using the concepts of the Protection Motivation Theory (PMT) [35,36], we included some features that would nudge the user into implementing a desired level of security. We then conducted a controlled user experiment to evaluate the feasibility of such features, i.e. QoE impact of different security mechanisms.

From the results, we observe that the participants implemented a high-security option in the absence of cost information. However, when cost information was added, most participants changed their preference. In this case, the users weighed the negative effects of relaxing security in trying to enjoy good Internet speed. The change was also possible because options were within reach of participants. The participants were novice Internet users. The complex underlying security constructs were hidden under advanced security options. This simplified and minimised novice participants’ search space. Using this prototype, novices could configure VPN, DNS and content filtering, defeating the stereotype that security is so complex for an ordinary user.

We further note that other users would still choose suboptimal security configuration even in the presence of the options. This fact cannot be ignored for Internet users with a persistent slow connection. To this type of users, it makes sense to restrict the options to ensure that there always exists a minimum possible security level; otherwise, such users may give up security for speed. This cognitive bias is known as hyperbolic discounting [2]. In this situation, one chooses short time benefits disregarding the long time consequences.

Empirically, we found that the cost displayed to the user closely represented the actual impact of the underlying security mechanisms. We also note that the choice architectures implemented in the prototype maps the objective measurement results. This suggests that data-driven security decisions would improve the QoE even if the user configures a high-level security option. We see from the empirical measurements results that participants used slower networks as evidences by longer page load times. These are typical speeds offered by mobile service providers in most parts of Africa. Therefore, adaptive security configuration solutions such as PowerQoPE would assist users under such network conditions to decide the level of security based on their network conditions.

We argue that properly designed security configuration tools would bridge the divide between novice and expert users while still aiding in optimal security decision-making. This calls for more studies and experiments on user-centric security. This may lead to different use cases integrated into the security configuration interfaces of devices from different vendors and operating systems such as smartphones, SOHO routers and others.

The apparent limitation of this study lies in the sample size and diversity of participants. The sample size of 14 participants may not give us generalisable results. Also, we tested this on novice users from one geographical location. However, we argue that the results provide insights into how Internet security
configuration protocols can be designed to involve novice users in the security decision making. Such platforms can be used to reinforce users’ security mental models thereby improving their online security practice.

# 7 Conclusion and Future Work

In this paper, we have shown that complex security configurations can be made available to novice users who have generally been regarded as the weakest link in the security ecosystem. Future work will expand the evaluation with more participants of diverse demographics. Future works also include testing Usefulness, Satisfaction and Ease of use.

**Acknowledgments.** The authors are grateful for the financial support received from the Hasso Plattner Institute for Digital Engineering through the HPI Research School at the University of Cape Town. In addition, the authors would like to thank *Mr Henry Mikanda* for helping with UI design and *Mr Joseph Kumwenda* for the help rendered during data collection. Finally, we thank all the participants for their time and willingness to provide information published in this study

# References

1. Grobler, M., Gaire, R., Nepal, S.: User, usage and usability: redefining human centric cyber security. Front. Big Data, **4** (2021). www.ncbi.nlm.nih.gov/pmc/articles/PMC7968726/

2. Acquisti, A., et al.: Nudges for privacy and security: understanding and assisting users’ choices online. ACM Comput. Surv. **50**(3), 1–41 (2017)

3. Wash, R., Rader, E.: Influencing mental models of security: a research agenda. In: Proceedings New Security Paradigms Workshop, p. 9 (2011)

4. Mbewe, E.S., Chavula, J.: Security mental models and personal security practices of internet users in Africa. In: Sheikh, Y.H., Rai, I.A., Bakar, A.D. (eds.) e-Infrastructure and e-Services for Developing Countries, pp. 47–68. Springer International Publishing, Cham (2022). https://doi.org/10.1007/978-3-031-06374-9_4

5. Gcaza, N., von Solms, R., Grobler, M.M., van Vuuren, J.J.: A general morphological analysis: delineating a cyber-security culture. Inf. Comput. Secur. (2017)

6. Van Schaik, P., Jeske, D., Onibokun, J., Coventry, L., Jansen, J., Kusev, P.: Risk perceptions of cyber-security and precautionary behaviour. Comput. Hum. Behav. **75**, 547–559 (2017)

7. Tischer, M., Durumeric, Z., Foster, S., Duan, S., Mori, A., Bursztein, E., Bailey, M.: Users really do plug in USB drives they find. In: IEEE Symposium on Security and Privacy (SP). IEEE, vol. 2016, pp. 306–319 (2016)

8. Nahrstedt, K.: An integrated solution to delay and security support in wireless networks. In: IEEE Wireless Communications and Networking Conference 2006. WCNC 2006, vol. 4, pp. 2211–2215 (2006)

9. Chen, J., Hu, C., Zeng, H., Zhang, J.: Impact of Security on QoS in communication network. In: 2009 International Conference on Networks Security, Wireless Communications and Trusted Computing, vol. 2, pp. 40–43 (2009)
10. Taleb, T., Hadjadj Aoul, Y., Benslimane, A.: Integrating security with QoS in next generation networks. In: 2010 IEEE Global Telecommunications Conference GLOBECOM 2010, pp. 1–5 (2010)

11. Taleb, T., Hadjadj-Aoul, Y.: $QoS^2$: a framework for integrating quality of security with quality of service. Secur. Commun. Netw. **512**, 1462–1470 (2012). https://doi.org/10.1002/sec.523

12. Ksiezopolski, B., Zurek, T., Mokkas, M.: Quality of protection evaluation of security mechanisms. Sci. World J. (2014)

13. Rusinek, D., Ksiezopolski, B., Wierzbicki, A.: AQoPA: automated quality of protection analysis framework for complex systems. In: Saeed, K., Homenda, W. (eds.) CISIM 2015. LNCS, vol. 9339, pp. 475–486. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-24369-6\_39

14. Radmand, P., Talevski, A.: Impact of encryption on QoS in VoIP. In: 2010 IEEE Second International Conference on Social Computing, pp. 721–726 (2010)

15. Mohammed, H.A., Ali, A.H.: Effect of some security mechanisms on the QoS VoIP application using OPNET. Int. J. Curr. Eng. Technol. **3**, 1626–1630 (2013)

16. Hani Haidar, A., Houseini, M., Kshour, M.: The analyse of adding security on QoS parameters. Int. J. Innovative Res. Adv. Eng. **2**, 11 (2015)

17. Lindskog, S., Jonsson, E.N.: Adding Security to Quality of Service Architectures (2002)

18. Al-khatib, A.A., Hassan, R.: Impact of IPSec protocol on the performance of network real-time applications: a review. I. J. Netw. Secur. **20**, 811–819 (2018)

19. Hayajneh, T., Mohd, B., Itradat, A.: Performance and information security evaluation with firewalls. Int. J. Secur. Appl. **7**, 335–372 (2013)

20. Cardoso, L.S.: Quality and security usability. In ITU-T Wksp. End-to-End QoE/QoS, Geneva, Switzerland, pp. 721–726 (2006)

21. Irvine, C., Levin, T.: Toward a taxonomy and costing method for security services. In: Proceedings 15th Annual Computer Security Applications Conference (ACSAC 1999), pp. 183–188 (1999)

22. Spyropoulou, E., Levin, T., Irvine, C.: Calculating costs for quality of security service. In: Proceedings 16th Annual Computer Security Applications Conference (ACSAC 2000), pp. 334–343 (2000)

23. Irvine, C.: A note on mapping user-oriented security policies to complex mechanisms and services (1999). https://calhoun.nps.edu/handle/10945/15290

24. Mbewe, E.S., Chavula, J.: On QoE impact of DoH and DoT in Africa: why a user’s DNS choice matters. In: Zitouni, R., Phokeer, A., Chavula, J., Elmokashfi, A., Gueye, A., Benamar, N. (eds.) AFRICOMM 2020. LNICST, vol. 361, pp. 289–304. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-70572-5\_18

25. Hounsel, A., Borgolte, K., Schmitt, P., Holland, J., Feamster, N.: Analyzing the costs (and benefits) of DNS, DoT, and DoH for the modern Web (2019). arxiv.org/pdf/1907.08089.pdf

26. Mbewe, E.S., Chavula, J.: Measuring QoE impact of DoE-based filtering. In: Proceedings of Southern Africa Telecommunication Networks and Applications Conference. Champagne Sports Resort, Central Drakensberg, KwaZulu-Natal, South Africa. SATNAC, pp. 240–245 (2021). https://pubs.cs.uct.ac.za/id/eprint/1508/

27. Ion, I., Reeder, R., Consolvo, S.: No one can hack my mind: comparing expert and non-expert security practices. In: SOUPS 2015 - Proceedings of the 11th Symposium on Usable Privacy and Security, pp. 327–346 (2019)

28. Maceli, M.G.: Encouraging patron adoption of privacy-protection technologies: challenges for public libraries. IFLA J. **44**(3), 195–202 (2018)
29. Reeder, R.W., Ion, I., Consolvo, S.: 152 simple steps to stay safe online: security advice for non-tech-savvy users. IEEE Secur. Priv. **15**(5), 55–64 (2017)

30. Zou, Y., Roundy, K., Tamersoy, A., Shintre, S., Roturier, J., Schaub, F.: Examining the adoption and abandonment of security, privacy, and identity theft protection practices. In: Conference on Human Factors in Computing Systems - Proceedings, pp. 1–15 (2020)

31. Sharma, T., Chavula, J.: Investigating Measurement Scheduling Strategies in Low Resource Networks (Poster), New York, NY, USA. Association for Computing Machinery, p. 453–456 (2021). https://doi.org/10.1145/3460112.3472310

32. Sharma, T., Chavula, J.: Topology-aware measurement scheduling strategies in low resource networks. In: Proceedings of Southern Africa Telecommunication Networks and Applications Conference (SATNAC), Central Drakensberg, South Africa. SATNAC, pp. 308–313 (2021)

33. Feilner, M.: OpenVPN: building and integrating virtual private networks. Packt Publishing Ltd (2006)

34. Anderson, A.J.: Controlled experiments. Interpreting Data, pp. 183–190 (2019)

35. Rogers, R.W.: A protection motivation theory of fear appeals and attitude change. J. Psychol. **91**(1), 93–114 (1975). Taylor & Francis

36. Rogers, R.W.: Cognitive and psychological processes in fear appeals and attitude change: a revised theory of protection motivation. In: Social Psychophysiology: A Sourcebook, pp. 153–176. Guilford Press (1983)