I've only scanned it, but this seems to be a very useful paper and talk: https://www.ieee-security.org/TC/SP2017/papers/84.pdf https://www.youtube.com/watch?v=5aNmbWS--io
via https://boingboing.net/2017/05/31/why-dont-people-use-secure-i.html A group of scholars and practicioners from the US, Germany and the UK conducted a qualitative study on the "obstacles to adoption of secure communications tools," which was presented to the 38th IEEE Symposium on Security and Privacy. The researchers conducted in-depth interviews with users from across a variety of ages, skill levels and backgrounds to see what barriers existed to the adoption of privacy-oriented, cryptographically secured tools. Their findings have implications for the two major approaches to increasing secure tools adoption: user-interface improvements and training materials. They found that usability wasn't the major impediment to adoption; rather, the "fragmented user base" (that is, none of your friends are on your secure messaging platform), lack of interoperability (the platform won't talk to other platforms) and low quality of service (voice calls on Signal suck) get in the way. • Low Quality of Service (QoS) is an obstacle to adoption. Participants assessed the reliability and security of a communication tool by the QoS of messages and voice calls they experienced. Low QoS does not only hinder adoption, but also creates general doubts about how reliable and secure the tool is. • Sensitivity of information does not drive adoption. Perceived sensitivity of information should drive the adoption of secure communication tools, but this was not the case with our participants. Instead, they used voice calls (regardless of the tool) and other obfuscation techniques to exchange sensitive information. • Secure communications were perceived as futile. Most participants did not believe secure tools could offer protection against powerful or knowledgeable adversaries. Most participants had incorrect mental models of how encryption works, let alone more advanced concepts (e.g., digital signatures, verification fingerprints). If the perception that secure communications are futile persists, this will continue to hinder adoption. • Participants’ security rankings of tools were inaccurate. We asked our participants to rank the tools they have used in terms of how secure they are. Many participants ranked the services (e.g., voice calls, messages) offered by the tools, rather than ranking the tools first. They perceived calls more secure than messages. Furthermore, they based their rankings on how large the tool’s user base is, QoS, social factors and other criteria, rather than assessing the security properties a secure tool offers. • Participants did not understand the EFF Secure Messaging Scorecard. The scorecard contains seven security properties. Four of these were misunderstood: participants did not appreciate the difference between point-to-point and E2E encryption, and did not comprehend forward secrec -- Nathan of Guardian nat...@guardianproject.info _______________________________________________ List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev To unsubscribe, email: guardian-dev-unsubscr...@lists.mayfirst.org
