How Do Users Chain Email Accounts Together? - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2021

How Do Users Chain Email Accounts Together?

Lydia Kraus
  • Fonction : Auteur
  • PersonId : 1154376
Mária S̆vidron̆ová
  • Fonction : Auteur
  • PersonId : 1154377
Elizabeth Stobert
  • Fonction : Auteur
  • PersonId : 1154378

Résumé

Recovery connections between email accounts can be exploited in manual hijacking attacks as has been shown in several incidents during the last years. Yet little is known about users’ practices of chaining email accounts together. We conducted a qualitative interview study with 23 students in which they shared their email recovery and forwarding settings with us. Altogether, we collected and analyzed information about 138 different email accounts. We used this data to map email account topologies and analyzed these topologies for recurring patterns. We found that users often make poor configuration decisions in their email recovery setups, and often create patterns in their email recovery topologies that result in security vulnerabilities. Patterns such as loops (seen in more than a quarter of our topologies) could be easily exploited in a targeted attack. We conclude that users need better guidance about how to use email based recovery settings in a robust way.
Fichier principal
Vignette du fichier
512098_1_En_27_Chapter.pdf (492.94 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03746025 , version 1 (04-08-2022)

Licence

Paternité

Identifiants

Citer

Lydia Kraus, Mária S̆vidron̆ová, Elizabeth Stobert. How Do Users Chain Email Accounts Together?. 36th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2021, Oslo, Norway. pp.416-429, ⟨10.1007/978-3-030-78120-0_27⟩. ⟨hal-03746025⟩
15 Consultations
3 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More