Who am I Talking to? A Large-Scale Measurement of Surface Attribution Across Real-World Security and Privacy Interfaces

Modern user interfaces are complex composites, with elements originating from various sources, such as the operating system, apps, a web browser, or websites. We posit that security and privacy decisions can to some extent depend on users correctly identifying an element’s source, a concept we term “surface attribution.” Through two large-scale vignette-based surveys (N = 4, 400 and N = 3, 057), we present the first empirical measurement of this ability. We find that users struggle, correctly attributing UI source only 55% of the time on desktop and 53% on mobile. Familiarity and strong brand cues are associated with improved accuracy, whereas UI positioning, a long-held security design concept especially for browsers, has minimal impact. Furthermore, simply adding a “Security & Privacy” brand cue to Android permission prompts failed to improve attribution. These findings demonstrate a fundamental gap in users’ mental models, indicating that relying on them to distinguish trusted UI is a fragile security paradigm.