In Encryption We Don’t Trust: The Effect of End-to-End Encryption to the Masses on User Perception

Abstract

With WhatsApp's adoption of the Signal Protocol as its default, end-to-end encryption by the masses happened almost overnight. Unlike iMessage, WhatsApp notifies users that encryption is enabled, explicitly informing users about improved privacy. This rare feature gives us an opportunity to study people's understandings and perceptions of secure messaging pre-and post-mass messenger encryption (pre/post-MME). To study changes in perceptions, we compared the results of two mental models studies: one conducted in 2015 pre-MME and one in 2017 post-MME. Our primary finding is that users do not trust encryption as currently offered. When asked about encryption in the study, most stated that they had heard of encryption, but only a few understood the implications, even on a high level. Their consensus view was that no technical solution to stop skilled attackers from getting their data exists. Even with a major development, such as WhatsApp rolling out endto-end encryption, people still do not feel well protected by their technology. Surprisingly, despite WhatsApp's end-to-end security info messages and the high media attention, the majority of the participants were not even aware of encryption. Most participants had an almost correct threat model, but don't believe that there is a technical solution to stop knowledgeable attackers to read their messages. Using technology made them feel vulnerable.

PharmaCrypt: Blockchain for Critical Pharmaceutical Industry to Counterfeit Drugs

“…Software based mass encryption technology can be used in the pharmaceutical industry to fight against counterfeit drugs. The same software is required to decrypt the digital code [7]. This technology requires a large database server to store the data.…”

Understanding User Perceptions of Security and Privacy for Group Chat: A Survey of Users in the US and UK

“…Such misuse is likely explained by the fact that users have incorrect mental models about how security works [1,2,21,42]. This lack of understanding can also lead users to distrust tools making claims about security [8,12].…”

“…Educating app designers rather than users. Dechand et al [8] make the strong statement that educating users about encryption is not going to change their behavior. Based on our results, we agree.…”

Making Encryption Feel Secure: Investigating how Descriptions of Encryption Impact Perceived Security

“…The interface design showed various issues, including the use of inconsistent terminology and not making all security features clear to the user. A later study showed that users lacked both trust in and awareness of encryption in secure messaging tools, even though the tool explitely informed them that encrpytion was used [9]. Communication with end users in the context of connection security seems to be similarly challenging as shown in a qualitative study on end user and administrator mental models of HTTPS.…”