The Motivated Can Encrypt (Even with PGP)
The Motivated Can Encrypt (Even with PGP)
复制标题
DOI：
10.2478/popets-2021-0037
复制
发表时间：
2021-04
影响因子：
--
通讯作者：
G. Borradaile;Kelsy Kretschmer;Michele Gretes;Alexandria LeClerc
中科院分区：
文献类型：
--
作者：
G. Borradaile;Kelsy Kretschmer;Michele Gretes;Alexandria LeClerc
现有的端到端加密（E2EE）电子邮件系统，主要是PGP，长期以来一直在受控的实验室环境中进行评估。虽然这些研究为普通用户暴露了可用性障碍，并提供了设计改进，但仍然存在迫切需要私人通信的用户，他们必须应对现有软件及其局限性。我们试图了解受具体隐私威胁（例如易受国家监视的威胁）驱动的个人是否能够克服可用性问题，采用复杂的E2EE工具进行长期使用。我们调查了地区活动家，因为对社会运动的监视是有据可查的。我们的研究小组包括来自美国9个社会运动团体的个人，他们选择参加一个关于使用thunderbird +Enigmail进行电子邮件加密的研讨会。通过与支持社会运动团体的非营利组织合作，这些研讨会将在2017年年中之前举行。在接受PGP电子邮件加密培训6到40个月后，超过一半的研究参与者继续使用PGP电子邮件加密，尽管在此期间广泛部署了简单的E2EE消息应用程序，如Signal。我们研究可用性与社会因素的相互作用，如动机和个人通过行动主义承担的风险。我们发现，虽然可用性是一个重要因素，但它不足以解释长期使用。例如，我们发现一个人行动主义的风险与长期使用PGP呈负相关。这项研究代表了PGP电子邮件加密采用的第一个长期研究，也是第一个野外研究。
Abstract Existing end-to-end-encrypted (E2EE) email systems, mainly PGP, have long been evaluated in controlled lab settings. While these studies have exposed usability obstacles for the average user and offer design improvements, there exist users with an immediate need for private communication, who must cope with existing software and its limitations. We seek to understand whether individuals motivated by concrete privacy threats, such as those vulnerable to state surveil-lance, can overcome usability issues to adopt complex E2EE tools for long-term use. We surveyed regional activists, as surveillance of social movements is well-documented. Our study group includes individuals from 9 social movement groups in the US who had elected to participate in a workshop on using Thunder-bird+Enigmail for email encryption. These workshops tool place prior to mid-2017, via a partnership with a non-profit which supports social movement groups. Six to 40 months after their PGP email encryption training, more than half of the study participants were continuing to use PGP email encryption despite intervening widespread deployment of simple E2EE messaging apps such as Signal. We study the interplay of usability with social factors such as motivation and the risks that individuals undertake through their activism. We find that while usability is an important factor, it is not enough to explain long term use. For example, we find that riskiness of one’s activism is negatively correlated with long-term PGP use. This study represents the first long-term study, and the first in-the-wild study, of PGP email encryption adoption.