Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0

By Alma Whitten, J. D. Tygar. 1999

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Privacy in Deep Learning: A Survey (2020, background): “Data sharing by transmitting confidential data without proper encryption is an example of data exposure through communication link [33].”
Do security toolbars actually prevent phishing attacks? (2006, background): “But the difference is not significant (one-tail t(23) = -1.”
A First Look at Identity Management Schemes on the Blockchain (2018, background): “So far we have seen that the schemes we evaluated are generally not accompanied by a novel vision of user interaction, and furthermore leave the perennial challenge to provide usable end-user key management [14] as largely unaddressed.”
“A Stalker's Paradise”: How Intimate Partner Abusers Exploit Technology (2018, background): “It’s also likely that victims would ﬁnd such tools opaque and challenging to use (the average user already has a hard time understanding encryption [35,37,50], let alone deniable encryption).”
A Usability Evaluation of Tor Launcher (2017, background): “Usable security research explores a variety of security concepts, such as email encryption [20, 43], authentication [10, 28, 38], security indicators [2, 11], and warnings [15, 37].”
Graphical passwords: Learning from the first twelve years (2012, background): “Realworld usage is of particular concern with security systems because security is often a secondary task [136], enabling (or hindering) access to the user’s primary goal.”
A comparison of perceived and real shoulder-surfing risks between alphanumeric and graphical passwords (2006, background): “Alternative authentication solutions, such as token-based or biometric authentication, do not rely on the users’ memory and introduce an increased level of security at the expense of increased hardware and software costs and usability, and are therefore not used as frequent means of user authenticat”
Nudges for Privacy and Security (2017, background): “…usability started uncovering the role of interfaces in affecting—and sometimes impairing—users’ awareness of privacy and security features or threats, as well as their ability to make sound choices [Whitten and Tygar 1999; Adams and Sasse 1999; Cranor and Garﬁnkel 2005; Garﬁnkel and Lipford 2014].”
Engineering Privacy (2009, background): “Conversely, privacy-conscious engineers often strive for extremely high degrees of privacy protection that may lead to mechanisms that undermine system usability [18], [19].”
Security in the wild: user strategies for managing security as an everyday, practical problem (2004, background): “By ‘‘easier’’ though, we do not just mean Whitten and Tiger’s [32] usability of various encryption software, we mean that context-based encryption may simply be the more visible form of security measures for many people”
CONIKS: Bringing Key Transparency to End Users (2015, background): “Over two decades of experience with PGP email encryption [12, 56, 71] suggests that manual key verification is errorprone and irritating [23, 70].”
Named Data Networking (NDN) Project (2010, background): “Prior research in trust management for large-scale deployment of public key cryptography has resulted in two main approaches: hierarchical Public Key Infrastructure (PKI) [19], and peer-level PGP web of trust [87], both with significant usability problems [43, 83].”
The compliance budget: managing security behaviour in organisations (2009, background): “Researchers approaching the issue from a Human-Computer Interaction (HCI) perspective – e. g. Whitten & Tygar (1999) – demonstrated that many human failures are caused by security mechanisms that are too difficult for a non-expert to use.”
A PIN-entry method resilient against shoulder surfing (2004, background): “The importance of human factors in the design of security mechanisms is signified by the growing number of publications and workshops with a focus on that topic [37, 26, 12, 22, 5, 25, 34 , 31].”
Location Privacy via Private Proximity Testing (2011, background): “A well known usability evaluation of PGP in 1999 concluded that it is nearly unusable for the majority [48].”
An empirical study of cryptographic misuse in android applications (2013, methodology): “Similar to Whitten et al. [28] and Clark and Goodspeed [9] we analyze the usability of cryptography.”
The Economics of Personal Data and the Economics of Privacy (2010, background): “Several reasons may explain these failures: on the consumers’ side, users’ difficulties and costs in using privacy technologies (see Whit- ten and Tygar (1999)), switching costs, as well as biases such as immediate gratification, which reduce demands for those products even by privacy sensitive…”