Secure Email Research Articles

Adaptive Phishing Detection: Harnessing the Power of Artificial Intelligence for Enhanced Email Security

Adaptive Phishing Detection: Harnessing the Power of Artificial Intelligence for Enhanced Email Security

E2EE Web Messaging Application Using Cryptography Techniques

Abstract: Instant messaging services on mobile devices, such as WhatsApp, have become immensely popular, largely due to their end-to-end encryption (E2EE) feature, which ensures user privacy. However, this has raised concerns for some governments who argue that E2EE makes it challenging to combat terrorism and organized crime. These governments have expressed the desire for a "backdoor" to access messages in cases of credible threats to national security. However, WhatsApp users have strongly opposed this idea, citing concerns about privacy infringement and potential exploitation by hackers. This paper presents the advantages of maintaining E2EE in WhatsApp and argues against granting governments a "backdoor" to access user messages. It highlights the benefits of encryption in safeguarding consumer security and privacy, while also acknowledging the challenges it poses to public safety and national security. In the realm of internet messaging security, cryptography plays a crucial role in protecting networks. This paper aims to raise awareness among common computer users about the importance of email security and its requirements. Several cryptographic techniques have been developed to achieve secure communication, and the proposed messaging system ensures security in accordance with standard security models.

Provably secure public key encryption with keyword search for data outsourcing in cloud environments

In recent days, the application of cloud computing has been gaining significant popularity among people. A considerable amount of data are being stored in the cloud server. However, data owners outsource their encrypted data to the cloud for various security reasons. Unfortunately, encrypted data cannot be searched, like plaintext data. So how to search encrypted data is an interesting problem in this era. Many public key encryption with keyword search (PEKS) schemes have been designed in the literature. However, most of them cannot prevent keyword-guessing attacks. In this paper, we develop a provably secure PEKS scheme in the random oracle model. This scheme may be used for secure email access from an email server containing a list of encrypted keywords. The proposed scheme can resist keyword-guessing attacks, and offer ciphertext and trapdoor indistinguishability properties. We use the data owner’s private key during encryption to prevent keyword-guessing attacks. Using the data owner’s public key in the verification phase ensures the resilience of keyword-guessing attacks. Finally, the proposed scheme has been tested on a real testbed, and the results show that it can be used in the cloud computing scenario to search for keywords on encrypted data.

500 General practitioners’ views on the electronic transfer of prescriptions to pharmacies in Ireland: a qualitative interview study

Abstract Introduction The use of electronic systems to transfer prescriptions continues to grow in healthcare systems worldwide. In response to the COVID-19 pandemic, legislation was implemented in Ireland in April 2020 to permit the electronic transfer of prescriptions (ETP) from prescribers to pharmacies using a national secure email system (Healthmail). This has resulted in a significant increase in the volume of prescriptions transmitted via Healthmail from general practitioners (GPs) to pharmacies in Ireland. Aim With a clear need to evaluate how stakeholders have been affected by this initiative and to guide the future delivery of patient care, the primary aim of this study was to investigate GPs’ views on the ETP to pharmacies in Ireland via Healthmail and how it has affected their practice. Methods Semi-structured interviews were conducted via video-conference with GPs in Ireland. GPs were identified using convenience and snowball sampling, purposively ensuring variety in age/years of experience, gender, and practice location. Interviews were audio-recorded and transcribed verbatim. Interview transcripts underwent thematic analysis (1). Results Twelve audio-recorded interviews were conducted with GPs between May 2021 and July 2021. The participants had a median of 16 years’ experience as a GP. Four main themes were generated: 1)Efficiencies with prescribing and easing GP workload: even with limited training, GPs felt that Healthmail’s ETP has been easy to use and seamlessly integrated into their practice. Time has been saved and overall workload decreased due to less prescription printing and delegating more to administrative staff with prescription ordering. 2) New GP-pharmacist communication pathways: GPs found asynchronous communication regarding prescription queries less disruptive to their workflow, and particularly useful for less urgent matters. Some GPs were not aware of some Healthmail functions that facilitated additional notes between GPs and pharmacists, whilst others were concerned they had no evidence if pharmacists saw these notes. 3) Security, transparency, and documentation: whilst acknowledging their lack of technological expertise, GPs perceived that Healthmail prescriptions had security advantages over physical ones overall; the increased transparency of the prescription journey minimises the risk of prescriptions being mislaid, damaged, or fraudulently altered, as well as creating an audit trail. 4) Implications for patients: ETP via Healthmail has reduced footfall to practices, reduces multiple pharmacy use, and most patients have adapted well to it. GPs were mostly reluctant to engage routinely in any hypothetical bidirectional communication with patients via Healthmail. Conclusion This study provides strong evidence for continuing the ETP to pharmacies in Ireland as GPs found this initiative easy to use, time-saving, and enhancing both GP-pharmacist communication and GP workflow. However, this study has highlighted stakeholders’ lack of awareness with some functions of Healthmail, so any future systems utilised for the ETP should come with best-practice guidance for all users. While the purposive sampling facilitated GP heterogeneity, snowball sampling may have somewhat reduced the diversity in views; a future survey would be useful in identifying if any GPs characteristics significantly influencing GPs’ views, as well as identifying other issues experienced and novel ideas to improve the ETP process going forward.

Assisted human reproduction legislation: Listening to the voice of patients

ObjectiveLegislation and policies regarding assisted human reproduction (AHR) vary widely across nations and societies. As one of only 5 European countries which currently lacks legislation, Ireland now has a unique opportunity to learn from other jurisdictions and introduce AHR law that is reflective of the ongoing myriad developments in this complex field. Draft legislation, initially published in 2017, was revised in 2022 with strong political commitment to enacting in the same year. This study sought to ascertain the views of fertility patients (service users) to the proposed AHR legislation in its current format, prior to its implementation. Study designA survey questionnaire, previously designed to investigate the attitudes and perceptions of healthcare professionals (HCPs) towards a broad range of issues contained within the draft AHR Bill, was adapted for a patient/service user population. The survey link was distributed via secure email to all patients that had a doctor consult at our fertility clinic in 2020–2021. ResultsThe survey link was sent to 4420 patients/service users, of whom 1044 (23.6%) responded. A majority had experienced AHR treatment. Service users indicated strong support for AHR regulation and for access to all AHR techniques for all patients, irrespective of relationship or gender status. A majority of respondents disagreed with aspects of the draft bill regarding mandatory counselling, the timing of assignment of parentage in surrogacy, the exclusion of international surrogacy and the exclusion of men from posthumous AHR. Interestingly, the fertility patient cohort were more liberal in their views and opinions regarding AHR than the Irish HCPs previously surveyed. ConclusionThis study demonstrates the views of a large group of AHR patients/service users towards proposed AHR legislation. Many of their views concur with but others differ from those of the drafters of the legislation and from those of healthcare professionals. Consideration of the views of all these groups and a collaborative approach would help ensure that Ireland has AHR legislation that is inclusive and fit for purpose in the 21st century.

Human Firewall Simulator for Enhancing Security Awareness against Business Email Compromise

Chief executive officers (CEOs) can turn out to be the weakest link to an organization’s security and attackers know that if they successfully exploit or impersonate someone who has a high level of access like CEOs or chief finance officers (CFOs), they instantly gain great advantage. The problem comes when attacker manages to take control of email accounts of the CEOs and CFOs and sends an email to another staff in the organization, he/she is likely to take it seriously, act accordingly and quickly as possible, and may be wire cash to an account directed by the “CEO/CFO,” and/or get away with private or sensitive corporate information. Because of the nature of these attack methods, detection and protection are very difficult since the attackers take advantage of the human weakness which is the weakest link. The main aim of this study is to provide a solution to protect every surface of the organization. By developing a human firewall, working with the already existing technical solutions offers the solution to remaining problem of human weakness. This research developed a simulator to train the users with the latest trends the attackers are using making them do it right (flagging, reporting, not clicking suspicions links) and making email security part of their responsibility. This makes employee become human firewall. The results from the simulator are displayed in charts as number of employees who passed the test, number of employees who will click on the malicious links, number of employees who will download the dangerous attachments, number of employees who will reply to phishing emails, average awareness of the organization, and how individual employees performed. While organizations have made progress over the years, security is a never-ending process that requires improvement day by day. Since no one in the organization’s structure is immune including the top most in the cadre (i.e., CEO), complexity in understanding and awareness creation is more wanting than before. Integrating human firewall into existing security measures as the last line of defense in email communication against business email compromise frauds offers this solution because it has preventive as well as reactive measures both geared toward maximizing email security. A simulation of the attacks to analyze the user involvement to breaching the security followed by an evaluation simulation after integrating human firewall to the organization’s email security shows success level. The results from the test show the different success levels, that is, results from pre-assessment definitely show low success level since staff/employees have not been made aware/trained to profile or flag compared to when the employees/staff have gone through the training/awareness. Post-assessment indicates high success level because actions from employees turned into human firewall know how to take proper action, for example, flagging, not clicking malicious links. The organization should update its policies to accommodate and reinforce rules on the employees to ensure that the tool is used regularly and actions taken on user deemed a threat to the organizational email security.

Indicators of employee phishing email behaviours: Intuition, elaboration, attention, and email typology

Employees’ behaviour to phishing emails can strengthen or undermine business organisations’ cyber security. This phishing simulation and survey study explored the relationship between sociodemographic, cyber security training, phishing email typology and information processing factors and risky and secure email response behaviours. Participants (N = 590) were employees of a large financial institution who received one of four types of phishing emails. Participants who engaged in risky cyber email behaviour clicked on the link in the phishing email whereas those who engaged in secure cyber email behaviour reported the email to the institutions cyber security team. Our findings show that the likelihood of clicking on a link in a phishing email was lower for participants who had greater faith in their intuition and paid more attention to the sender's email address. The likelihood of clicking on a link in a phishing email was greater for participants who received the ‘Undelivered package’ email relative to the ‘Received PDF’. The likelihood of reporting a phishing email was greater for participants who engaged in greater elaborative processing to evaluate the email than those who used less elaboration. Theoretical and practical implications as well as future directions are discussed.

Survey on Deep Learning Approaches for Detection of Email Security Threat

Survey on Deep Learning Approaches for Detection of Email Security Threat

Assessing the Effectiveness of Communication and Awareness Strategies for Promoting Email Security Best Practices Among End-Users A Survey-Based Study

Assessing the Effectiveness of Communication and Awareness Strategies for Promoting Email Security Best Practices Among End-Users A Survey-Based Study

Stability and Effective Process Control for Secure Email Filtering

A fantastic tool for both commercial and personal communication is electronic mail. It has increasingly become a necessary component of our working life since it is straightforward, available, and simple to use. Spam emails have started to tarnish internet experiences and threaten the integrity of email. Due to the exponential growth of spam, both people and organisations are under a great deal of financial and other strain. In order to prevent the future of email itself from being in jeopardy, a solution to the spam problem must be discovered. There is an urgent need to solve the Email spam issue since spam volume has been rising over the last several decades. As part of this effort, many effects of spam emails on businesses and people were noted and thoroughly examined. In order to properly assess current technologies, solutions, and methods, a comprehensive literature review was conducted throughout the procedures. The goals of this work is to develop new methodologies for the implementation of new strategies for the efficient management of email spam and to construct a proof-of-concept software system for the Process controlled assessment of such strategies.

Evolution of Email Security Standards

The first work on email security began in 1984, which resulted in the Privacy Enhanced Mail (PEM) specifications. Two years later, work was done as part of the Secure Data Network System (SDNS) sponsored by the U.S. Government, resulting in the Message Security Protocol (MSP). PEM and MSP both influenced the development of the most popular Internet email security protocol, which is Secure MIME (S/MIME). This article provides insight into the early history of email security, describes ongoing work to improve email security, and then makes some predictions about the future.

Email Security

A crucial network application is the email client. It is significant when it is used by the business, health, and educational groups to communicate vital information like business data, patient medical records, and so on. Data and messages can be easily transmitted between senders and receivers across internal networks or the Internet, enabling messages to be received, forwarded, saved, and broadcast to recipients. Due to its numerous features, email has become a popular choice for official communications in many companies. Electronic mail is accessible through a wide range of suitable software clients, as well as through a web browser, and is also widely used for personal usage. For the information security research community, email security becomes a critical concern. to increase the security of email.

Smart contract assisted blockchain based public key infrastructure system

ABSTRACTPublic key infrastructure (PKI) is a reliable solution for Internet communication. PKI finds applications in secure email, virtual private network (VPN), e‐commerce, e‐governance, and so on. It provides a secure mechanism to authenticate users and communications. The conventional PKI system is centralized, which exposes the infrastructure to many security issues. The digital certificate generation and validation processes in PKI suffer from high latency and inadequate authentication processes. Moreover, it needs enormous time and effort to mitigate the malfeasance of the certificate authority (CA). The complexity of employing the traditional key and certificate management increases by enforcing the centralized, which can compromise the transaction security. To overcome the aforementioned issues of PKI, three different solutions have been reported in the literature: Log based PKI (LBPKI), Web of Trust (WoT), and blockchain based PKI. The blockchain based PKI achieves more attention as it is the combination of LBPKI and WoT, which serves distributed trust, log of transactions, and constant sized data to verify the identity of users. Motivated by these facts, this article reports a blockchain‐based PKI system which has a lighter smart contract and less storage capacity and is also suitable for lightweight applications. The lighter smart contract in our infrastructure uses a, which validates the limit of one participating node for becoming theof any transaction inside the network. This approach can prevent distributed denial of service (DDoS) attacks. This smart contract also checks the signer node address. The proposed smart contract can prevent seven cyber attacks, such as Denial of Service (DoS), Man in the Middle Attack (MITM), Distributed Denial of Service (DDoS), 51%, Injection attacks, Routing Attack, and Eclipse attack. The Delegated Proof of Stake (DPoS) consensus algorithm used in this model reduces the number of validators for each transaction which makes it suitable for lightweight applications. The timing complexity of key/certificate validation and signature/certificate revocation processes do not depend on the number of transactions. The comparisons of various timing parameters with existing solutions show that the proposed PKI is competitively better.

VP.13 Updates on the development of the spinal muscular atrophy - person-reported outcome (SMA-PRO): A caregiver and self-proxy performance measure for child

There is a need for person-reported outcome measures for SMA. The PEDI-CAT is a caregiver-reported measure used to describe functional skill performance. Convergent validity of the PEDI-CAT with SMA phenotypes was established, and Rasch analysis of the full item bank revealed representation of abilities for SMA III and for daily activities for SMA II, but a floor effect for SMA I. Results led to the development of a new measure to include a larger item bank with caregiver and self-proxy options. Goals were 1) To describe the SMA PRO test development, including focus groups and cognitive-testing for item content 2) To describe the development of branching logic for data collection and 3) To report interim results on data collected with the new measure. Clinicians with expertise in SMA participated in 4 focus groups. Clinicians reviewed the results of the Rasch analysis and discussed content, scoring and clarity for the 76 daily activities and 105 mobility items. Thirty mobility and 69 daily activities items were added to address the floor effect and include items for infants and adults. A power wheelchair domain was created with 35 items and illustrations including "maintaining hand on wheelchair joystick while driving on uneven terrain." Illustrations were re-created to increase relevance for adults and children. The new items and illustrations were reviewed and several items were discarded due to perception of redundancy. Clinicians then conducted cognitive interviews with 15 study participants (7 caregivers and 8 adolescents and adults with SMA). A maximum of 30 items with accompanying illustrations were reviewed at each interview with probing questions including, "In your own words, what do you think this question is asking?" and "Does the illustration match the item wording?" Cognitive interview results were collated and items were further edited. The final items and illustrations were added to a database, and branching logic was established based on pre-determined "stopping rules" to minimize the total number of items required for each respondent. Item surveys were sent to participants and caregivers via a secure email, and data was collected prospectively. At the time of this interim study point, 58 surveys had been completed (16 "non-sitters," 38 "sitters" and 25 "walkers") across 4 functional domains. Data collection is underway, and a full analysis will be performed in order to validate the measure.

A pilot study investigating feasibility of mainstreaming germline BRCA1 and BRCA2 testing in high-risk patients with breast and/or ovarian cancer in three tertiary Cancer Centres in Ireland.

In the Republic ofIreland(ROI), BRCA1/BRCA2 genetic testing has been traditionally undertaken in eligible individuals, after pre-test counselling by a Clinical Geneticist/Genetic Counsellor. Clinical Genetics services in ROI are poorly resourced, with routine waiting times for appointments at the time of this pilotoften extending beyond a year. The consequent prolonged waiting times are unacceptable where therapeutic decision-making depends on the patient's BRCA status. "Mainstreaming" BRCA1/BRCA2 testing through routine oncology/surgical clinics has been implemented successfully in other centres in the UK and internationally. We aimed to pilot this pathway in three Irish tertiary centres. A service evaluation project was undertaken over a 6-month period between January and July 2017. Eligible patients, fulfilling pathology and age-based inclusion criteria defined by TGL clinical, were identified, and offered constitutional BRCA1/BRCA2 testing after pre-test counsellingby treating clinicians. Tests were undertaken by TGL Clinical. Results were returned to clinicians by secure email. Onward referrals of patients with uncertain/pathogenic results, or suspicious family histories, to Clinical Genetics were made by the treating team. Surveys assessing patient and clinician satisfaction were sent to participating clinicians and a sample of participatingpatients. Data was collected with respect to diagnostic yield, turnaround time, onward referral rates, and patient and clinician feedback. A total of 101 patients underwent diagnostic germline BRCA1/BRCA2 tests through this pathway. Pathogenic variants were identified in 12 patients (12%). All patients in whom variants were identified were appropriately referred to Clinical Genetics. At least 12 additional patients with uninformative BRCA1/BRCA2 tests were also referred for formal assessment by Clinical Geneticist or Genetic Counsellor. Issues were noted in terms of time pressures and communication of results to patients. Results from a representative sample of participants completing the satisfaction survey indicated that the pathway was acceptable to patients and clinicians. Mainstreaming of constitutional BRCA1/BRCA2 testing guided by age- and pathology-based criteria is potentially feasible for patients with breast cancer as well as patients with ovarian cancer in Ireland.

A feasibility and acceptability study of using an intra-oral camera and an asynchronous tele-mentoring protocol to detect and identify oral lesions.

Background:To examine the feasibility and acceptability of integrating a tele-mentoring component into the identification of oral lesions at the dental clinics of a Federally Qualified Health Center network.Design and Methods:General Practice Residency faculty and residents completed research ethics courses and trained dentists to use intra-oral cameras at chairside to photograph oral lesions of patients at routine dental visits. These images were then uploaded into the patient electronic health records (EHRs) with attendant descriptions and an oral surgeon was notified, who reviewed the charts, placed his observations in the EHR, and communicated his findings via secure e-mail to the involved residents, who in turn contacted their patients regarding follow-up actions. Feasibility was assessed via checklists completed by provider participants and semi-structured interviews. Acceptability was assessed via brief exit interviews completed by patient participants.Results:All 12 of the dentist participants reported that they had successfully provided the tele-mentoring intervention, and that the process (from EHR data entry to interaction with the oral surgeon over findings to patient referral) was clear and straightforward. Of 39 patient participants, most strongly agreed or agreed that the use of an intra-oral camera by their dentists helped them to better understand oral cancer screening (94.9%) and that dentists answered their questions about oral cancer and were able to provide them with resources (94.8%).Conclusions:Findings support further implementation research into adapting tele-mentoring using intra-oral cameras for training dental residents to detect and identify oral lesions and educating patients about oral cancer across settings.

P-348 Assisted Reproduction Legislation: Listening to the voice of Health Care Professionals

Abstract Study question To investigate the perceptions of health care practitioners in Ireland to a draft Assisted Human Reproduction (AHR) Bill, currently being assess by government. Summary answer There is strong support for AHR and for national legislation in this field among healthcare professionals working in Ireland. What is known already AHR legislation is essential to protect the rights of those accessing, born from and providing AHR services. Ireland is one of the only countries in the EU which lacks specific AHR legislation. The General Scheme of an AHR Bill was published in 2017 and is currently awaiting review and approval by government. Study design, size, duration An anonymous 25-item questionnaire was distributed via secure email link. This was a detailed 5-point Likert Scale questionnaire based on clinically relevant aspects of the Irish draft AHR Bill. Consultants and trainees in Obstetrics and Gynaecology were identified through The Institute of Obstetricians and Gynaecologists. A snow balling approach was used to recruit General Practitioners and all Fertility Clinics in Ireland were asked to distribute the questionnaire to their staff. The study remained open for 28days. Participants/materials, setting, methods Participants included Consultant and trainee Obstetrician Gynaecologists, general practitioners and multidisciplinary staff at Irish fertility clinics. The questionnaire focused on six key factors; a national AHR regulatory authority, AHR treatment type and availability, age limits for AHR treatment, counselling prior to ART, posthumous use of gametes and embryos and legislations surrounding surrogacy. Main results and the role of chance In total 245 responses were received. The majority of respondents were female aged 31-59years. 42.2% (n = 103/244) are currently working or had previous experience working with ART. 93% (n = 215/231) of respondents believe that Ireland should have a national authority to regulate AHR – similar to the Human Fertilisation and Embryology Authority (HFEA) in the UK. Over 80% of participants strongly agreed with access to IVF and gamete and embryo vitrification being available in Ireland. The majority of participants also supported oocyte and sperm donation (69% and 71% respectively). Support for more recent technologies in AHR was variable. Over 50% of respondents strongly disagreed with sex selection for non-medical reasons and less than half of participants strongly agreed with ART for single men and transgender males/females. 80.5% (n = 170/211) of respondents felt that there should be an upper age limit for women receiving access to ART and 64.5% (n = 136/211) felt there should be an upper age limit for men. Those who had experience working in an AHR clinic felt more strongly that sperm / egg donors should be paid a modest fee for donation (p = 0.04; p = 0.03 respectively) and that counselling should be mandatory for every person considering gamete donation (p = 0.0233). Limitations, reasons for caution Due to reliance on third parties in distribution of the survey to target groups, a response rate could not be calculated, a limitation of the study. A further limitation is the high detail of the survey questions, which seemed to lead to participant fatigue with later questions. Wider implications of the findings National legislation on AHR is both needed and desired by health care professionals working in Ireland. It is hoped that results of this study will help inform the proposed national AHR legislation as it nears completion and in turn, elevate Irelands low position in the European Atlas of Fertility Policies. Trial registration number not applicable

Changes to primary care delivery during the COVID-19 pandemic and perceived impact on medication safety: A survey study

IntroductionThe COVID-19 pandemic has had a profound impact on the delivery of primary care around the world. In Ireland, the use of technologies such as virtual consultations and the electronic transfer of prescriptions became widespread in order to deliver care to patients while minimising infection risk. The impact of these changes on medication safety is not yet known. ObjectivesThe aims of this survey study were to investigate 1) the changes that have occurred in Irish primary care since the start of the COVID-19 pandemic and 2) the impact of these changes on medication safety. MethodsAnonymous, online surveys were distributed to general practitioners (GPs) and pharmacists from August–September 2021. Surveys contained quantitative (multiple-choice, Likert scale) and qualitative (free-text) questions concerning workflow changes, medication safety incidents and near misses, and GP/pharmacist perspectives on medication safety and COVID-19. Reported medication safety incidents and near misses were categorised according to the WHO Conceptual Framework for the International Classification for Patient Safety. ResultsIn total, there were 251 responses to the survey, comprising of 211 pharmacists and 40 GPs. The most significant workflow changes during the pandemic were the widespread use of a secure clinical email service (Healthmail) that facilitates electronic prescription transfer and communication (75.3% of respondents) and the increased use of telephone consultations (49%). Overall, Healthmail was widely perceived to have had a positive impact on medication safety. Most GPs did not perceive a change in the frequency of medication safety incidents during the pandemic, while most pharmacists reported a slight increase in incidents. Survey participants highlighted pressure, patient expectations, and patient monitoring as significant challenges encountered during the pandemic. ConclusionsDuring the pandemic, a number of significant changes occurred in primary care in Ireland, particularly involving communication of healthcare information, with varying impacts on workflow and medication safety. Future research should focus on the optimisation of electronic prescribing and telemedicine services in Ireland, patient perspectives on the changes in primary care, and interventions to improve medication safety in primary care.

Web and email security: Keeping your practice IT secure

Web and email security: Keeping your practice IT secure

A reused key attack on an encrypted mobile app database: Case study on KakaoTalk and ProtonMail

Many mobile apps use encryption to protect user data. Therefore, research on the use of encrypted data in forensic investigations is warranted. When encrypting data, developers can incorporate data such as user information and passwords during the encryption key generation process. Currently, encryption keys can be protected by hardware security modules such as KeyStore and KeyChain using an OS-provided API. Hardware security modules use a built-in random number generator to create random keys and securely store them. As a result, it is practically impossible to decrypt data that have been encrypted using a hardware security module. However, cryptographic algorithm misuse, regardless of whether encryption keys are acquired, present an opportunity for data acquisition. In this paper, we show that a reused key attack that exploits a vulnerability caused by encryption scheme misuse can be used against a secure email service, ProtonMail, and Korea’s representative instant messenger KakaoTalk.