Can Johnny build a protocol? Co-ordinating developer and user intentions for privacy-enhanced secure messaging protocols

Abstract

As secure messaging protocols face increasingly widespread deployment, differences between what developers "believe" about user needs and the actual needs of real-existing users could have an impact on the design of future technologies. In the domain of secure messaging, the sometimes subtle choices made by protocol designers tend to elude the understanding of users, including high-risk activists. We'll overview some common protocol design questions facing developers of secure messaging protocols and test the competing understandings of these questions using STS-inspired interviews with the designers of popular secure messaging protocols ranging from older protocols like PGP and XMPP+OTR to newer unstandardized protocols used in Signal and Briar. Far from taking users as a homogeneous and undifferentiated mass, we distinguish between the low-risk users that appear in most usability studies (such as university students in the USA and Europe) and high-risk activist userbases in countries such as Ukraine and Egypt where securing messages can be a matter of life or death. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

Co-ordinating Developers and High-Risk Users of Privacy-Enhanced Secure Messaging Protocols

“…The results presented here extend and deepen those results, and they directly contrast and even contradict the results given in the largest quantitative study of 80 low-risk users [1]. We first state our theses, generated after our first study [2] but before the additional interviews given in this study, in Section 2. Our qualitative methodology is explained in Section 3, with the interviews being delved into in Section 4.…”

“…This work is the first to do such a study that balances high-risk users, low-risk users, and developers themselves. Our previous qualitative study focused on less than 50 users [2]. The results presented here extend and deepen those results, and they directly contrast and even contradict the results given in the largest quantitative study of 80 low-risk users [1].…”

“…Note that due to the vast differences in context between developers and users, achieving "representativeness" in the present study is extremely problematic and therefore not a goal. In this regard, while previous studies looked at either a selection of primarily students in London [1] or (our own previous) work on a small subset of "radical" developers (Briar) in contrast to high-risk users in Russia [2], we have expanded the user studies to deal with interviews with corporate developers at corporations as well as high-risk users in places such as Syria (in detail, the Kurdish area of Rojava). This leads to a much more diverse spread of what we term "risk" than previous works.…”

“…The last few years have seen the spread of wide variety of secure messaging applications, and increased interest in these applications due to generalized concerns around privacy and security, caused in part due to the 2013 Snowden revelations. As put by previous work [2], currently developers imagine what properties users likely need, and these properties may or may not actually satisfy the needs of end-users. The first large-scale user study of secure messaging has shown that users are fundamentally confused around secure messaging in particular and how encryption works in general [1].…”

Collective Information Security in Large-Scale Urban Protests: the Case of Hong Kong

“…Existing qualitative studies have explored security practices of different groups of higher-risk users, e.g. [23,24,29,33,37,42,69,73,74,93], but none to our knowledge have studied such practices within large-scale urban protests.…”