A Usability Study of Four Secure Email Tools Using Paired Participants

Abstract

Secure email is increasingly being touted as usable by novice users, with a push for adoption based on recent concerns about government surveillance. To determine whether secure email is ready for grassroots adoption, we employ a laboratory user study that recruits pairs of novice users to install and use several of the latest systems to exchange secure messages. We present both quantitative and qualitative results from 28 pairs of novices as they use Private WebMail (Pwm), Tutanota, and Virtru and 10 pairs of novices as they use Mailvelope. Participants report being more at ease with this type of study and better able to cope with mistakes since both participants are "on the same page." We find that users prefer integrated solutions over depot-based solutions and that tutorials are important in helping first-time users. Finally, our results demonstrate that Pretty Good Privacy using manual key management is still unusable for novice users, with 9 of 10 participant pairs failing to complete the study. CCS Concepts: • Security and privacy → Domain-specific security and privacy architectures; Usability in security and privacy; • Human-centered computing → User studies; Empirical studies in HCI; Laboratory experiments;

Privacy-Enhancing Technologies

“…The paper included a lab usability study of PGP that failed miserably and provided a wake-up call to the security community of the importance of user-centered design. Nearly 20 years later, a lab usability study of a modern PGP web client (Mailvelope) had similarly disappointing results when 9 of 10 participant pairs were unable to exchange a secure email message after 1 h of trying to use the system [18].…”

Understanding User Perceptions of Security and Privacy for Group Chat: A Survey of Users in the US and UK

“…These annotations could be used to quickly identify group members who: (a) the user has explicitly identified as a contact, (b) the user has interacted with in another group, or (c) the group member is a contact of one of the user's contacts. This last annotation is reminiscent of PGP's web-of-trust; while the web-of-trust largely failed in email [27], it may be that it provides a reasonable way to establish trust in group chat tools due to the more closed nature of these tools and their support for instantaneous communication. This approach could also help address the key verification problem identified above.…”

Blockchain Technology: What Is It Good for?

“…A related challenge is that some blockchain systems require users to store, manage, and secure cryptographic keys; this requirement is known to be a significant impediment for most users. 10 Legality and regulation Some benefits claimed by blockchain systems cannot be attributed to the underlying technology, but rather to sidestepping the regulation and oversight that slows existing systems (for example, international payments or raising capital by selling virtual assets to investors). As regulators catch up, compliance is given priority.…”