How Do Users Chain Email Accounts Together?
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F21%3A00123445" target="_blank" >RIV/00216224:14610/21:00123445 - isvavai.cz</a>
Result on the web
<a href="http://dx.doi.org/10.1007/978-3-030-78120-0_27" target="_blank" >http://dx.doi.org/10.1007/978-3-030-78120-0_27</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1007/978-3-030-78120-0_27" target="_blank" >10.1007/978-3-030-78120-0_27</a>
Alternative languages
Result language
angličtina
Original language name
How Do Users Chain Email Accounts Together?
Original language description
Recovery connections between email accounts can be exploited in manual hijacking attacks as has been shown in several incidents during the last years. Yet little is known about users’ practices of chaining email accounts together. We conducted a qualitative interview study with 23 students in which they shared their email recovery and forwarding settings with us. Altogether, we collected and analyzed information about 138 different email accounts. We used this data to map email account topologies and analyzed these topologies for recurring patterns. We found that users often make poor configuration decisions in their email recovery setups, and often create patterns in their email recovery topologies that result in security vulnerabilities. Patterns such as loops (seen in more than a quarter of our topologies) could be easily exploited in a targeted attack. We conclude that users need better guidance about how to use email based recovery settings in a robust way.
Czech name
—
Czech description
—
Classification
Type
D - Article in proceedings
CEP classification
—
OECD FORD branch
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)
Result continuities
Project
<a href="/en/project/EF16_019%2F0000822" target="_blank" >EF16_019/0000822: CyberSecurity, CyberCrime and Critical Information Infrastructures Center of Excellence</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)
Others
Publication year
2021
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Article name in the collection
IFIP International Conference on ICT Systems Security and Privacy Protection
ISBN
9783030781194
ISSN
1868-4238
e-ISSN
1868-422X
Number of pages
14
Pages from-to
416-429
Publisher name
Springer International Publishing
Place of publication
Switzerland
Event location
Oslo, Norway
Event date
Jan 1, 2021
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
—