2 ms·

I apologize if my comment made you think that I was accusing the researchers of not caring about privacy. If I had said that they "read" people's emails, that

I apologize if my comment made you think that I was accusing the researchers of not caring about privacy. If I had said that they "read" people's emails, that would have sounded ambiguous, but I only guessed that they ran a script, which seems to be completely accurate. I'm not sure what the period of "27 years" refers to, since the paper "Why Johnny Still, Still Can't Encrypt" was only published 6 years ago, but I stand by my use of the word "pity". If someone is making a measurement of an ecosystem which has been static for a long time, but has recently undergone a hypothetically dramatic change, it's a pity if the data only covers the static period and can't really test the hypothesis about the recent change. You're right, though, that it is much more of a pity that it's taken Thunderbird this long to support OpenPGP natively, and equally a pity that there hasn't been any published usability testing of its new version, or K-9 Mail's, as far as I know.

eesmith 5y ago
The author didn't run the script. The IT staff ran the script, which exported pseudonymized, low resolution data, which the researchers then analyzed. While it may not seem important, it looks like it was designed so the IT staff -- who have direct access to user emails and therefore the job responsibility maintaining privacy -- provide oversight to help minimize information leaks that an unfirewalled scheme like yours may easily have. Umm, the "27 years" refers to the paper's title, "27 Years and 81 Million Opportunities Later". The paper reports on "the use of email encryption based on 27 years of data". The oldest email in the archive was from 1994. I never mentioned "Why Johnny Still, Still Can't Encrypt" from 6 years ago (footnote #4 on the companion website), only the original paper "Why Johnny Can’t Encrypt: A Usability Evaluation of PGP 5.0" from 1999 (footnote #1). There's also footnote #3, "Why Johnny Still Can’t Encrypt: Evaluating the Usability of Email Encryption Software" from 2006.

eesmith 5y ago

The author didn't run the script. The IT staff ran the script, which exported pseudonymized, low resolution data, which the researchers then analyzed. While it may not seem important, it looks like it was designed so the IT staff -- who have direct access to user emails and therefore the job responsibility maintaining privacy -- provide oversight to help minimize information leaks that an unfirewalled scheme like yours may easily have. Umm, the "27 years" refers to the paper's title, "27 Years and 81 Million Opportunities Later". The paper reports on "the use of email encryption based on 27 years of data". The oldest email in the archive was from 1994. I never mentioned "Why Johnny Still, Still Can't Encrypt" from 6 years ago (footnote #4 on the companion website), only the original paper "Why Johnny Can’t Encrypt: A Usability Evaluation of PGP 5.0" from 1999 (footnote #1). There's also footnote #3, "Why Johnny Still Can’t Encrypt: Evaluating the Usability of Email Encryption Software" from 2006.