4 ms·

Almost no one encrypts their emails because it is too much of a hassle

1 points by dane-pgp 5y ago

dane-pgp 5y ago
> Christian Stransky ... analysed emails sent by 37,000 of the university’s students and staff between January 1994 and July 2021. I doubt these 37,000 people individually opted in to handing over decades worth of emails, so presumably he just ran a script against the email accounts hosted by the university itself. That doesn't seem like a very representative sample of people, and it doesn't include journalists or politicians or ProtonMail users.
- eesmith 5y ago
  The protocol is described in the paper, at https://publications.teamusec.de/2022-oakland-email/ https://publications.teamusec.de/2022-oakland-email/ . Your presumption is incorrect. IT staff runs a program to extract and pseudonymize data at a 1 week granularity. Only this data is exported to the researchers. It also follows German privacy protection laws and the European GDPR. The "email" in this context means SMTP-based email. It's a continuation of the research theme started with "Why Johnny Can’t Encrypt" in 1999, arguing that encrypted email on 'normal' email is a usability failure. The relevant point is: > Both S/MIME and PGP were introduced almost 30 years ago with the goal to provide end-to-end encryption for email. However, in contrast to modern messaging tools such as Signal that implement end-to-end encryption by default, S/MIME and PGP require a complex manual setup by users. Consequently, previous work has shown that using email encryption correctly and securely is challenging for many users .. Hence, it is commonly believed in the security community that end-to-end encrypted email is not widely used, mostly because of lacking usability and awareness issues identified in a multitude of user studies in the past 22 years ... To the best of our knowledge, our work is the first scientific collection and evaluation of ground truth on the adoption of end-to-end email encryption. The study does mention a journalist by anecdote, pointing out the difficulty Glen Greenwald had in setting up secure email. Do you think most journalists use S/MIME or PGP? And find it easier to set up than Greenwald did? Or do they use some other messaging system for secure emails? Because I'm pretty sure it's the latter.
  - dane-pgp 5y ago
    Thanks for the link to the paper. > Email at our university is a centralized service. The university’s computing center provides email accounts for all administrative staff members, for all students as well as faculties, departments, and research groups. This is what I imagined, and I don't think my presumption was materially incorrect. The researchers looked at the email habits of accounts on a specific centralized service at a university. While that might provide some useful data on how easy it is for users to layer E2E encryption on top of such a service, it doesn't say anything at all about whether someone who wants to use an encrypted email service can or can't do so, since such a person is unlikely to choose their university- or work-issued email account to do so. It's also a pity that the last full year of email data they have, 2020, was the year that Thunderbird 78 was released, with built in support for OpenPGP. Similarly it was in July of this year that K-9 Mail received an update after a 3 year hiatus, which greatly improved its support for OpenPGP and Autocrypt. Perhaps other researchers could try repeating this study next year, to see if adoption of those new versions has an effect.
    - eesmith 5y ago
      My comment about "incorrect" concerned your presumed mechanism, which implied a lack of respect for user privacy by the researchers and IT staff. Yes, there is plenty of opportunity for follow-up work. But "pity"? After 27 years, it's a pity they didn't wait longer? Why did it take so long for Thunderbird 78 to support OpenPGP? How did they test that the UI issues of PGP in the original "Why Johnny Can't Encrypt" paper have been resolved? Do they have any measurements of uptake, and how are they gathered?
      - dane-pgp 5y ago
        I apologize if my comment made you think that I was accusing the researchers of not caring about privacy. If I had said that they "read" people's emails, that would have sounded ambiguous, but I only guessed that they ran a script, which seems to be completely accurate. I'm not sure what the period of "27 years" refers to, since the paper "Why Johnny Still, Still Can't Encrypt" was only published 6 years ago, but I stand by my use of the word "pity". If someone is making a measurement of an ecosystem which has been static for a long time, but has recently undergone a hypothetically dramatic change, it's a pity if the data only covers the static period and can't really test the hypothesis about the recent change. You're right, though, that it is much more of a pity that it's taken Thunderbird this long to support OpenPGP natively, and equally a pity that there hasn't been any published usability testing of its new version, or K-9 Mail's, as far as I know.

1 points by dane-pgp 5y ago

> Christian Stransky ... analysed emails sent by 37,000 of the university’s students and staff between January 1994 and July 2021. I doubt these 37,000 people individually opted in to handing over decades worth of emails, so presumably he just ran a script against the email accounts hosted by the university itself. That doesn't seem like a very representative sample of people, and it doesn't include journalists or politicians or ProtonMail users.

eesmith 5y ago
The protocol is described in the paper, at https://publications.teamusec.de/2022-oakland-email/ https://publications.teamusec.de/2022-oakland-email/ . Your presumption is incorrect. IT staff runs a program to extract and pseudonymize data at a 1 week granularity. Only this data is exported to the researchers. It also follows German privacy protection laws and the European GDPR. The "email" in this context means SMTP-based email. It's a continuation of the research theme started with "Why Johnny Can’t Encrypt" in 1999, arguing that encrypted email on 'normal' email is a usability failure. The relevant point is: > Both S/MIME and PGP were introduced almost 30 years ago with the goal to provide end-to-end encryption for email. However, in contrast to modern messaging tools such as Signal that implement end-to-end encryption by default, S/MIME and PGP require a complex manual setup by users. Consequently, previous work has shown that using email encryption correctly and securely is challenging for many users .. Hence, it is commonly believed in the security community that end-to-end encrypted email is not widely used, mostly because of lacking usability and awareness issues identified in a multitude of user studies in the past 22 years ... To the best of our knowledge, our work is the first scientific collection and evaluation of ground truth on the adoption of end-to-end email encryption. The study does mention a journalist by anecdote, pointing out the difficulty Glen Greenwald had in setting up secure email. Do you think most journalists use S/MIME or PGP? And find it easier to set up than Greenwald did? Or do they use some other messaging system for secure emails? Because I'm pretty sure it's the latter.
- dane-pgp 5y ago
  Thanks for the link to the paper. > Email at our university is a centralized service. The university’s computing center provides email accounts for all administrative staff members, for all students as well as faculties, departments, and research groups. This is what I imagined, and I don't think my presumption was materially incorrect. The researchers looked at the email habits of accounts on a specific centralized service at a university. While that might provide some useful data on how easy it is for users to layer E2E encryption on top of such a service, it doesn't say anything at all about whether someone who wants to use an encrypted email service can or can't do so, since such a person is unlikely to choose their university- or work-issued email account to do so. It's also a pity that the last full year of email data they have, 2020, was the year that Thunderbird 78 was released, with built in support for OpenPGP. Similarly it was in July of this year that K-9 Mail received an update after a 3 year hiatus, which greatly improved its support for OpenPGP and Autocrypt. Perhaps other researchers could try repeating this study next year, to see if adoption of those new versions has an effect.
  - eesmith 5y ago
    My comment about "incorrect" concerned your presumed mechanism, which implied a lack of respect for user privacy by the researchers and IT staff. Yes, there is plenty of opportunity for follow-up work. But "pity"? After 27 years, it's a pity they didn't wait longer? Why did it take so long for Thunderbird 78 to support OpenPGP? How did they test that the UI issues of PGP in the original "Why Johnny Can't Encrypt" paper have been resolved? Do they have any measurements of uptake, and how are they gathered?
    - dane-pgp 5y ago
      I apologize if my comment made you think that I was accusing the researchers of not caring about privacy. If I had said that they "read" people's emails, that would have sounded ambiguous, but I only guessed that they ran a script, which seems to be completely accurate. I'm not sure what the period of "27 years" refers to, since the paper "Why Johnny Still, Still Can't Encrypt" was only published 6 years ago, but I stand by my use of the word "pity". If someone is making a measurement of an ecosystem which has been static for a long time, but has recently undergone a hypothetically dramatic change, it's a pity if the data only covers the static period and can't really test the hypothesis about the recent change. You're right, though, that it is much more of a pity that it's taken Thunderbird this long to support OpenPGP natively, and equally a pity that there hasn't been any published usability testing of its new version, or K-9 Mail's, as far as I know.