End-Users and Service Providers: Trust and Distributed Responsibility for Account Security

In a between-subjects study design, we compared responses from 170 online account users of two major service providers to explore issues relating to responsibility and trust for account security. Participants attributed clear roles between themselves and their service providers for preventing attacks, monitoring their accounts, and recovering their accounts. The emerging mental model of distributed responsibility does not match service providers stated terms of use. Users identified a variety of reasons for trusting different service providers, but reputation was viewed as especially important.