[openpgp] New paper with user study on email signature spoofing

[Marcus Brinkmann <[e-mail]>]

Hi,

We[1] published a paper with a user study on signature spoofing where we examined how 25 expert users of Thunderbird and Enigmail check PGP signature for validity. It shows that users have a hard time verifying email signatures, and think the results can give guidance to implementers how to improve the usability of their software.

[1] "I don’t know why I check this...'' - Investigating Expert Users' Strategies to Detect Email Signature Spoofing Attacks
https://www.usenix.org/conference/soups2022/presentation/mayer
Peter Mayer, SECUSO - Security, Usability, Society, Karlsruhe Institute of Technology; Damian Poddebniak, Münster University of Applied Sciences; Konstantin Fischer and Marcus Brinkmann, Ruhr University Bochum; Juraj Somorovsky, Paderborn University; Angela Sasse, Ruhr University Bochum; Sebastian Schinzel, Münster University of Applied Sciences; Melanie Volkamer, SECUSO - Security, Usability, Society, Karlsruhe Institute of Technology

Abstract: 

OpenPGP is one of the two major standards for end-to-end email security. Several studies showed that serious usability issues exist with tools implementing this standard. However, a widespread assumption is that expert users can handle these tools and detect signature spoofing attacks. We present a user study investigating expert users' strategies to detect signature spoofing attacks in Thunderbird. We observed 25 expert users while they classified eight emails as either having a legitimate signature or not. Studying expert users explicitly gives us an upper bound of attack detection rates of all users dealing with PGP signatures. 52% of participants fell for at least one out of four signature spoofing attacks. Overall, participants did not have an established strategy for evaluating email signature legitimacy. We observed our participants apply 23 different types of checks when inspecting signed emails, but only 8 of these checks tended to be useful in identifying the spoofed or invalid signatures. In performing their checks, participants were frequently startled, confused, or annoyed with the user interface, which they found supported them little. All these results paint a clear picture: Even expert users struggle to verify email signatures, usability issues in email security are not limited to novice users, and developers may need proper guidance on implementing email signature GUIs correctly.

Thanks,
Marcus

—
Dipl.-Math. Marcus Brinkmann

Lehrstuhl für Netz- und Datensicherheit
Ruhr Universität Bochum
Universitätsstr. 150, Geb. ID 2/461
D-44780 Bochum

Telefon: +49 (0) 234 / 32-25030
http://www.nds.rub.de/chair/people/mbrinkmann