Security expert Schneier: e-mail cannot be secured in principle

Recent research has shown that the user-friendliness of encrypting e-mail with pgp is very disappointing. Security expert Bruce Schneier discusses the investigation on his blog. He recommends chatting apps like Signal and OTP as an alternative.

Schneier writes that he “recently came to the conclusion that e-mail cannot be secured in principle, because encryption is not compatible with our use of e-mail.” He refers to a study conducted by scientists at Brigham Young University.

The researchers chose to test Mailvelope. This is a Chrome plugin that works with popular webmail services and encrypts emails using pgp, a form of end-to-end encryption. Participants in the study were 20 Gmail users, who were given an hour after a short introduction to send each other an encrypted email. They were therefore divided into pairs, the two members of which were in separate rooms.

In the end, only one out of ten couples was able to send an encrypted email. According to the researchers, this should make it clear that it is too complicated for an average person to send e-mails encrypted with PGP. One of the researchers’ recommendations was therefore to provide step-by-step guides to lower the threshold. According to Schneier, crypto chat apps like Signal are very easy to use by comparison.