2 ms·

Thanks for the link to the paper. > Email at our university is a centralized service. The university’s computing center provides email accounts for all admin

Thanks for the link to the paper. > Email at our university is a centralized service. The university’s computing center provides email accounts for all administrative staff members, for all students as well as faculties, departments, and research groups. This is what I imagined, and I don't think my presumption was materially incorrect. The researchers looked at the email habits of accounts on a specific centralized service at a university. While that might provide some useful data on how easy it is for users to layer E2E encryption on top of such a service, it doesn't say anything at all about whether someone who wants to use an encrypted email service can or can't do so, since such a person is unlikely to choose their university- or work-issued email account to do so. It's also a pity that the last full year of email data they have, 2020, was the year that Thunderbird 78 was released, with built in support for OpenPGP. Similarly it was in July of this year that K-9 Mail received an update after a 3 year hiatus, which greatly improved its support for OpenPGP and Autocrypt. Perhaps other researchers could try repeating this study next year, to see if adoption of those new versions has an effect.

eesmith 5y ago
My comment about "incorrect" concerned your presumed mechanism, which implied a lack of respect for user privacy by the researchers and IT staff. Yes, there is plenty of opportunity for follow-up work. But "pity"? After 27 years, it's a pity they didn't wait longer? Why did it take so long for Thunderbird 78 to support OpenPGP? How did they test that the UI issues of PGP in the original "Why Johnny Can't Encrypt" paper have been resolved? Do they have any measurements of uptake, and how are they gathered?
- dane-pgp 5y ago
  I apologize if my comment made you think that I was accusing the researchers of not caring about privacy. If I had said that they "read" people's emails, that would have sounded ambiguous, but I only guessed that they ran a script, which seems to be completely accurate. I'm not sure what the period of "27 years" refers to, since the paper "Why Johnny Still, Still Can't Encrypt" was only published 6 years ago, but I stand by my use of the word "pity". If someone is making a measurement of an ecosystem which has been static for a long time, but has recently undergone a hypothetically dramatic change, it's a pity if the data only covers the static period and can't really test the hypothesis about the recent change. You're right, though, that it is much more of a pity that it's taken Thunderbird this long to support OpenPGP natively, and equally a pity that there hasn't been any published usability testing of its new version, or K-9 Mail's, as far as I know.
  - eesmith 5y ago
    The author didn't run the script. The IT staff ran the script, which exported pseudonymized, low resolution data, which the researchers then analyzed. While it may not seem important, it looks like it was designed so the IT staff -- who have direct access to user emails and therefore the job responsibility maintaining privacy -- provide oversight to help minimize information leaks that an unfirewalled scheme like yours may easily have. Umm, the "27 years" refers to the paper's title, "27 Years and 81 Million Opportunities Later". The paper reports on "the use of email encryption based on 27 years of data". The oldest email in the archive was from 1994. I never mentioned "Why Johnny Still, Still Can't Encrypt" from 6 years ago (footnote #4 on the companion website), only the original paper "Why Johnny Can’t Encrypt: A Usability Evaluation of PGP 5.0" from 1999 (footnote #1). There's also footnote #3, "Why Johnny Still Can’t Encrypt: Evaluating the Usability of Email Encryption Software" from 2006.

eesmith 5y ago

My comment about "incorrect" concerned your presumed mechanism, which implied a lack of respect for user privacy by the researchers and IT staff. Yes, there is plenty of opportunity for follow-up work. But "pity"? After 27 years, it's a pity they didn't wait longer? Why did it take so long for Thunderbird 78 to support OpenPGP? How did they test that the UI issues of PGP in the original "Why Johnny Can't Encrypt" paper have been resolved? Do they have any measurements of uptake, and how are they gathered?

dane-pgp 5y ago
I apologize if my comment made you think that I was accusing the researchers of not caring about privacy. If I had said that they "read" people's emails, that would have sounded ambiguous, but I only guessed that they ran a script, which seems to be completely accurate. I'm not sure what the period of "27 years" refers to, since the paper "Why Johnny Still, Still Can't Encrypt" was only published 6 years ago, but I stand by my use of the word "pity". If someone is making a measurement of an ecosystem which has been static for a long time, but has recently undergone a hypothetically dramatic change, it's a pity if the data only covers the static period and can't really test the hypothesis about the recent change. You're right, though, that it is much more of a pity that it's taken Thunderbird this long to support OpenPGP natively, and equally a pity that there hasn't been any published usability testing of its new version, or K-9 Mail's, as far as I know.
- eesmith 5y ago
  The author didn't run the script. The IT staff ran the script, which exported pseudonymized, low resolution data, which the researchers then analyzed. While it may not seem important, it looks like it was designed so the IT staff -- who have direct access to user emails and therefore the job responsibility maintaining privacy -- provide oversight to help minimize information leaks that an unfirewalled scheme like yours may easily have. Umm, the "27 years" refers to the paper's title, "27 Years and 81 Million Opportunities Later". The paper reports on "the use of email encryption based on 27 years of data". The oldest email in the archive was from 1994. I never mentioned "Why Johnny Still, Still Can't Encrypt" from 6 years ago (footnote #4 on the companion website), only the original paper "Why Johnny Can’t Encrypt: A Usability Evaluation of PGP 5.0" from 1999 (footnote #1). There's also footnote #3, "Why Johnny Still Can’t Encrypt: Evaluating the Usability of Email Encryption Software" from 2006.