Corpus ID: 239769336

SoK: Securing Email -- A Stakeholder-Based Analysis (Extended Version)

  title={SoK: Securing Email -- A Stakeholder-Based Analysis (Extended Version)},
  author={Jeremy Clark and Paul C. van Oorschot and Scott Ruoti and Kent Seamons and Daniel Zappala},
While email is the most ubiquitous and interoperable form of online communication today, it was not conceived with strong security guarantees, and the ensuing security enhancements are, by contrast, lacking in both ubiquity and interoperability. This situation motivates our research. We begin by identifying a variety of stakeholders who have an interest in the current email system and in efforts to provide secure solutions. We then use the tussle among stakeholders to explain the evolution of… Expand

Figures and Tables from this paper


SoK: Secure Messaging
This paper evaluates and systematize current secure messaging solutions and proposes an evaluation framework for their security, usability, and ease-of-adoption properties, and identifies three key challenges and map the design landscape for each: trust establishment, conversation security, and transport privacy. Expand
Johnny 2: a user test of key continuity management with S/MIME and Outlook Express
The first user study of KCM-secured email is presented, conducted on naïve users who had no previous experience with secure email, and concludes that KCM is a workable model for improving email security today, but work is needed to alert users to "phishing" attacks. Expand
TLS in the Wild: An Internet-wide Analysis of TLS-based Protocols for Electronic Communication
This is the largest study to date that investigates the security of the email and chat infrastructures, using active Internet-wide scans to determine the amount of secure service deployments, and passive monitoring to investigate if user agents actually use this opportunity to secure their communications. Expand
Leading Johnny to Water: Designing for Usability and Trust
It is found that while approximately a third of users do in fact trust standalone encryption applications more than browser extensions that integrate into their webmail client, it is not due to being able to see and interact with ciphertext, and users hold a belief that desktop applications are less likely to transmit their personal messages back to the developer of the software. Expand
Composition Kills: A Case Study of Email Sender Authentication
It is shown that a range of techniques to induce inconsistencies among different components across email servers and clients can enable attackers to bypass email authentication to impersonate arbitrary senders, and forge DKIM-signed emails with a legitimate site’s signature. Expand
No Need for Black Chambers: Testing TLS in the E-mail Ecosystem at Large
This work is the first to collect and analyze the complete state of today's e-mail-related TLS configuration, for the entire IPv4 address range, and draws a comprehensive picture of the current state of security mechanisms on the transport layer for e-mails by scanning cipher suite support which was previously considered impossible due to numerous constraints. Expand
Neither Snow Nor Rain Nor MITM...: An Empirical Analysis of Email Delivery Security
This work presents the first report on global adoption rates of SMTP security extensions, including: STARTTLS, SPF, DKIM, and DMARC, and presents evidence of such attacks in the wild, highlighting seven countries where more than 20% of inbound Gmail messages arrive in cleartext due to network attackers. Expand
An Inconvenient Trust: User Attitudes toward Security and Usability Tradeoffs for Key-Directory Encryption Systems
In a 52-person interview study, participants were asked to complete encryption tasks using both a traditional key-exchange model and a key-directory-based registration model and found the security of the registration model to be “good enough” for many everyday purposes. Expand
Off-the-record communication, or, why not to use PGP
This paper presents a protocol for secure online communication, called "off-the-record messaging", which has properties better-suited for casual conversation than do systems like PGP or S/MIME. Expand
Encrypted Email: The History and Technology of Message Privacy
This SpringerBrief examines the technology of email privacy encryption from its origins to its theoretical and practical details. It explains the challenges in standardization, usability, and trustExpand