Do we value convenience over security?

Many users continue to make unsafe transactions over the web -- even if they're aware of the danger of such transactions, a new survey from Symantec suggests.

Symantec's product marketing manager, Ryan White, revealed the results of the company's Online Internet Safety Survey in a blog post Friday. White admitted to being somewhat surprised by the results.

"What struck me the most was that in many cases, respondents continued online transactions even when those transactions lacked security cues respondents knew should be there," White wrote, "For example, 80 per cent of respondents knew to look for the padlock icon signifying Secure Sockets Layer (SSL) encryption, but only 55 per cent said they would abort a transaction if they didn't see it."

The padlock indicator was the most obvious safety signal users chose to ignore, so it's hardly surprising that users also ignored signs such as mismatched domain certificates, and chose to use insecure connections when browsing social media sites. Perhaps the most shocking: a whopping 25 per cent of users responded that they had continued an online transaction they knew to be unsafe.

This blasé attitude toward security was even stranger considering the survey respondents were very well-informed about online security. A stunning 97 per cent of respondents considered themselves to be either "somewhat" or "extremely" knowledgeable about online security. Respondents also seemed to act more securely in other situations -- 98 per cent of respondents were either "extremely" or "somewhat" concerned about their confidential data when banking.

While White was puzzled by this mismatch, the reasons seem obvious: the sheer number of security precautions we're advised to take online can be exhausting. It's not hard to imagine that ven the most security-conscious user sometimes lets their guard down.

The question, then, is this: what can we do to stay safe? Should we create security tools that are easier to use, so that users are less likely to ignore them? Or is this a problem that can only be solved if users have a better mindset about security? Security education may not be enough if users continue to make unsafe choices -- even when they know better.