IMAT3712-23-Learning
IMAT3712-23-Learning
Human Computer
Interaction
Thinking and Learning
Acknowledgements
Some slides have origins in
Lecture PowerPoint by Shira Elqayam
Thinking and Learning -
Overview
Mental Actions
Learning: Acquiring mental actions
Learning: Skilled Behaviour
Planning vs Situated Action
Expert-Novice Differences
Dual Process Theory
Knowing that and knowing how
Declarative Knowledge: Knowing that
Procedural Knowledge: Knowing how
Declarative Learning:
More and richer mental representations
What caused the First World War?
Procedural Learning:
More and more refined skills
How do you knit?
Knowing that and knowing how
Declarative Knowledge: Knowing that
Procedural Knowledge: Knowing how
affect skills
Mental actions
Minds act purposefully
Changes in mental state - recognising,
remembering, imagining
Speech and other communication
Body movements
Mental actions depend on
Mental State
Perceptions
Attention is selective: spotlights focused-on
awareness
Speech
Actions
Learning associations
We learn associations between
Information structures that turn up together or in
sequence
Situations and actions
We’re sensitive to
Correlations
When thoughts and actions are useful or
successful
Learning patterns
Humans and other animals are very good at
learning
Patterns
Correlations
When we care about what they are telling us
What things are
Whether actions succeed or fail
situations
Sequence of steps
Hierarchical organization of steps within steps
Open slots for objects (etc) in particular
remembered knowledge
Requires attention (consumes limited mental
resources)
do it:
Means-Ends Analysis and
Planning
Symbolic problem solving typically involves
Goals to achieve
Reasoning about how to achieve goals (Means
Ends Analysis)
Reasoning about how to break the problem up
you forward
complex sequences of actions don’t need plans,
awareness
Novices versus Experts
Novices
Knowledge mostly declarative - facts and
assertions
Problem solving by conscious reasoning
backward chaining from goals to actions
heavy use of memory
slow
Problems and examples understood and classified
elements of knowledge
Learning aided by using concrete examples
Novices versus Experts
Experts
Much task-specific procedural problem solving
knowledge
Routine problem solving by applying learned
procedures
forward chaining from situations to actions
fast
Problems and examples understood and classified
System One
Rapid holistic judgement
System Two
Slow, effortful step-by-step reasoning
Can intervene in response from System One and
modify or reject it
Five cents
You can puzzle out the right answer, if you try
Easy to get wrong, if you don’t realise you need to
be careful
Dual Process Theory:
Using System Two
Which is better? Depends what for...
problem that is
Simpler
More frequent
Suggested by recent experiences
Implications for Design
DON’T put users in situations where System One
response is misleading
Consistency!
Pay attention to frequencies of tasks and input
conditions
Show differences and not-most-frequent
situations clearly
Phishing….
Reading
Chapter 4 of Rogers, Sharp, Preece, Interaction
Design, 6th ed. (Otherwise the chapter on cognition
in earlier editions.)
CTEC 3906
Interaction Design
Appendix:
Phishing
Phishing
User receives an urgent email with a link
The link leads them to a spoofed website
The user is asked for sensitive personal information
needed
Phishing with
System One and System Two
Phishing depends on
Users’ perceptual reaction to phishing bait
System One says it’s trustworthy
Aim is to create perceptual impression of
trustworthiness
Either
work
Users do not understand security
Users do not understand security indicators
For example:
✓What does SSL do?
✓What's browser "chrome?"
Why does phishing work?
2. Visual Deception
Visually deceptive text (homographs) from
î vs. i vs. l Dhamija,
http://www.bankofthevvest/ Tygar &
images masking text Hearst
(2006)
images mimicking windows
pop-up windows
deceptive look and feel
Why does phishing work?
3. Bounded Attention
Too focused on task to pick up signs of
phishing…
Lack of attention to security indicators
Lack of attention to the absence of security
indicators
Phishing “solution”:
Teaching people what to look
for
Too impersonal
Spelling mistakes
Substandard graphic design
BUT bad guys can copy real thing accurately
legitimate
Websites that "work" and don't have errors are
assumed legitimate
Security toolbars and warnings
Don’t reliably prevent phishing attacks
Experimental evidence that…
Users will rationalize and ignore warnings
Users can’t distinguish between errors and
attacks
Are DMU’s out-of-date security certifications
evidence of something phishy going on? (I really
hope not…)
SSL Warning
Inventive rationalizations (from
Wu, Miller & Garfinkel, 2006)
12 subjects (60%) used rationalizations to justify the
indicators of the attacks that they experienced. Nine
subjects explained away odd URLs with comments
like:
www.ssl-yahoo.com is a subdirectory of Yahoo!, like
mail.yahoo.com.
sign.travelocity.com.zaga-zaga.us must be an
outsourcing site for travelocity.com.
Sometimes the company [Target] has to register a
different name [www.mytargets.com] from its brand.
What if target.com has already been taken by another
company?
Sometimes I go to a website and the site directs me to
another address which is different from the one that I
have typed.
Rationalizations come from
mental models
What’s happening when users talk themselves into
dangerous practices?
1. Motivation
Fear of risks
Cost-benefit analysis
2. Understanding
Awareness of risks
Wrong/dangerous mental model of situation
Phishing solution:
Better spam filters
Phishing solution:
Authenticate the email sender
Phishing solution:
Website authentication
Phishing solution:
Website authentication
Phishing solution:
Website blacklists
Making phishing solutions work
Technological solutions to security problems
needed
BUT
Depend on users’ mental models of situation
SO
Design challenge is to
Keep situation simple enough to see and
understand
Enable users to develop correct/useful mental