Secure Email - A Usability Study

Adrian Reuter (1) , Karima Boudaoud (2, 3) , Marco Winckler (2, 4, 5) , Ahmed Abdelmaksoud (2) , Wadie Lemrazzeq (2)

1 TUM - Technische Universität Munchen - Technical University Munich - Université Technique de Munich
2 I3S - Laboratoire d'Informatique, Signaux, et Systèmes de Sophia Antipolis
3 Laboratoire I3S - SPARKS - Scalable and Pervasive softwARe and Knowledge Systems
4 WIMMICS - Web-Instrumented Man-Machine Interactions, Communities and Semantics
5 IRIT-ICS - Interactive Critical Systems

Several end-to-end encryption technologies for emails such as PGP and S/MIME exist since decades. However, end-to-end encryption is barely applied. To understand why users hesitate to secure their email communication and which usability issues they face with PGP, S/MIME as well as with pEp (Pretty Easy Privacy), a fairly new technology, we conducted an online survey and user testing. We found that more than 60% of e-mail users are unaware of the existence of such encryption technologies and never tried to use one. We observed that above all, users are overwhelmed with the management of public keys and struggle with the setup of encryption technology in their mail software. Even though users struggle to put email encryption into practice, we experienced roughly the same number of users being aware of the importance of email encryption. Particularly, we found that users are very concerned about identity theft, as 78% want to make sure that no other person is able to write email in their name.

Mots clés: Mail encryption; User study; Usability; PGP; S/MIME; pEp

Domaines: Cryptographie et sécurité [cs.CR]; Interface homme-machine [cs.HC]

Adrian Reuter, Karima Boudaoud, Marco Winckler, Ahmed Abdelmaksoud, Wadie Lemrazzeq. Secure Email - A Usability Study. International Workshops, AsiaUSEC, CoDeFi, VOTING, and WTSC @ International Conference on Financial Cryptography and Data Security (FC 2020), Feb 2020, Kota Kinabal, Malaysia. pp.36-46, ⟨10.1007/978-3-030-54455-3_3⟩. ⟨hal-03138769⟩