Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		 Previous revision
public:papers:ifipsec2021 [2021-03-26 11:13] – created x242168public:papers:ifipsec2021 [2022-04-06 14:21] (current) – xukrop
Line 6: Line 6:
 <TEXT size="large"> <TEXT size="large">
  
-\_{{fa>user}}\_\_//Authors://  Lydia Kraus and Mária Svidronová and Elizabeth Stobert+\_{{fa>user}}\_\_//Authors://  Lydia Kraus and Mária Švidroňová and Elizabeth Stobert
  
 {{fa>user-circle-o}}\_//Primary contact:// Lydia Kraus %%<%%<lydia.kraus@mail.muni.cz>%%>%% {{fa>user-circle-o}}\_//Primary contact:// Lydia Kraus %%<%%<lydia.kraus@mail.muni.cz>%%>%%
Line 12: Line 12:
 {{fa>bullhorn}}\_//Conference:// [[https://ifipsec.org/2021/|IFIP SEC 2021]] {{fa>bullhorn}}\_//Conference:// [[https://ifipsec.org/2021/|IFIP SEC 2021]]
  
-\_{{fa>id-badge}}\_\_//DOI:// [[TBD]]+\_{{fa>id-badge}}\_\_//DOI:// [[https://doi.org/10.1007/978-3-030-78120-0_27]]
 </TEXT> </TEXT>
 </col> </col>
Line 19: Line 19:
 <TEXT align="right"> <TEXT align="right">
 /* <popover trigger="focus" title="Not yet available" content="Pre-print will be added in July 2021."> */ /* <popover trigger="focus" title="Not yet available" content="Pre-print will be added in July 2021."> */
-<button type="warning" icon="fa fa-fw fa-file-pdf-o">[[|Pre-print PDF]]</button>+<button type="warning" icon="fa fa-fw fa-file-pdf-o">[[https://crocs.fi.muni.cz/_media/publications/pdf/2021-ifipsec-kraus.pdf|Pre-print PDF]]</button>
 /* </popover> */ /* </popover> */
 \_ \_
Line 31: Line 31:
 <collapse id="bibtex" collapsed="true"> <collapse id="bibtex" collapsed="true">
   @InProceedings{2021-ifipsec-kraus,   @InProceedings{2021-ifipsec-kraus,
-  Title         = {How Do Users Chain Email Accounts Together?}, +    Title         = {How Do Users Chain Email Accounts Together?}, 
-  Author        = {Lydia Kraus and Maria Svidronova and Elizabeth Stobert}, +    Author        = {Lydia Kraus and Maria Svidronova and Elizabeth Stobert}, 
-  BookTitle     = {IFIP International Conference on ICT Systems Security and Privacy Protection}, +    BookTitle     = {IFIP International Conference on ICT Systems Security and Privacy Protection}, 
-  Pages         = {}, +    Pages         = {}, 
-  Publisher     = {Springer, Cham}, +    Publisher     = {Springer, Cham}, 
-  Year          = {2021}, +    Year          = {2021}, 
-  Keywords      = {usablesec}, +    Keywords      = {usablesec}, 
-  crocsweb      = {https://crocs.fi.muni.cz/papers/ifipsec2021}, +  }
-} +
 </collapse> </collapse>
  
Line 46: Line 44:
 Recovery connections between email accounts can be exploited in manual hijacking attacks as has been shown in several incidents during the last years. Yet little is known about users' practices of chaining email accounts together. We conducted a qualitative interview study with 23 students in which they shared their email recovery and forwarding settings with us. Altogether, we collected and analyzed information about 138 different email accounts. We used this data to map email account topologies and analyzed these topologies for recurring patterns. We found that users often make poor configuration decisions in their email recovery setups, and often create patterns in their email recovery topologies that result in security vulnerabilities. Patterns such as loops (seen in more than a quarter of our topologies) could be easily exploited in a targeted attack. We conclude that users need better guidance about how to use email based recovery settings in a robust way. Recovery connections between email accounts can be exploited in manual hijacking attacks as has been shown in several incidents during the last years. Yet little is known about users' practices of chaining email accounts together. We conducted a qualitative interview study with 23 students in which they shared their email recovery and forwarding settings with us. Altogether, we collected and analyzed information about 138 different email accounts. We used this data to map email account topologies and analyzed these topologies for recurring patterns. We found that users often make poor configuration decisions in their email recovery setups, and often create patterns in their email recovery topologies that result in security vulnerabilities. Patterns such as loops (seen in more than a quarter of our topologies) could be easily exploited in a targeted attack. We conclude that users need better guidance about how to use email based recovery settings in a robust way.
 </panel> </panel>
 +
 +===== Selected conclusions =====
 +
 +  * Our results show that email account topologies are diverse, but that many include elements of line and loop topologies. 
 +  * Loop topologies are especially concerning, as they allow attackers who already have access to one account to easily gain access to a further account. 
 +  * We also found that users created other vulnerabilities in their topologies by placing the final recovery nodes in inaccessible accounts, or by using accounts owned by somebody else as a recovery option.
 +  * Users also tended to keep accounts with physical recovery options (which could be strong recovery options) separate from the rest of the recovery topology.
 +  * Participants were often unaware of the connections between their accounts and only realized during the study that there are recovery links they are not happy with.
 +
 +===== Research artifacts (supplementary material) =====
 +
 +<button type="primary" icon="fa fa-fw fa-database">[[https://drive.google.com/drive/folders/1GW-YZ2rcRNaSfbBS2YqJ0jgIs1fxjSs4?usp=sharing|Go to artifacts repository (gDrive)]]</button>
 +