How Do Users Chain Email Accounts Together?

Investor logo

Warning

This publication doesn't include Faculty of Arts. It includes Institute of Computer Science. Official publication website can be found on muni.cz.
Authors

KRAUS Lydia ŠVIDROŇOVÁ Mária STOBERT Elizabeth

Year of publication 2021
Type Article in Proceedings
Conference IFIP International Conference on ICT Systems Security and Privacy Protection
MU Faculty or unit

Institute of Computer Science

Citation
Web Details about the publication
Doi http://dx.doi.org/10.1007/978-3-030-78120-0_27
Keywords Email recovery; Email forwarding; Fallback authentication; Security; Usability
Attached files
Description Recovery connections between email accounts can be exploited in manual hijacking attacks as has been shown in several incidents during the last years. Yet little is known about users’ practices of chaining email accounts together. We conducted a qualitative interview study with 23 students in which they shared their email recovery and forwarding settings with us. Altogether, we collected and analyzed information about 138 different email accounts. We used this data to map email account topologies and analyzed these topologies for recurring patterns. We found that users often make poor configuration decisions in their email recovery setups, and often create patterns in their email recovery topologies that result in security vulnerabilities. Patterns such as loops (seen in more than a quarter of our topologies) could be easily exploited in a targeted attack. We conclude that users need better guidance about how to use email based recovery settings in a robust way.
Related projects:

You are running an old browser version. We recommend updating your browser to its latest version.