"Most of us trust our email provider": Balancing security and usability in encrypted email

Abstract

End-to-end encryption is the best way to protect digital messages. Historically, end-to-end encryption has been extremely difficult for people to use, but recent tools have made it more broadly accessible, largely by employing key-directory services. These services sacrifice some security properties for convenience. We wanted to understand how average users think about these tradeoffs. We conducted a 52-person user study and found that participants could learn to understand properties of different encryption models. They also made coherent assessments about when different tradeoffs might be appropriate. Participants recognized the less-convenient exchange model was more secure overall, but considered the security of the registration model to be “good enough” for most everyday purposes.