Why don't more services offer encryption for email notifications?

Question

I understand that using encryption for email isn't particularly mainstream (a fraction of a percentage of users, at a guess). Is that the only reason that banks and other sensitive companies do not offer some kind of encryption for email notifications?

For example, my bank sends me an email every month:

Subject: Your monthly statement is ready

Dear Alex,

Your monthly statement is ready. Please sign in to the bank's website to download it.

For security (i.e. to prove this really came from us), your postcode is S12 TYX.

While admittedly it's not a huge deal, I'd rather Google - or any mail server - didn't ever receive my postcode in plaintext. This also applies to, for example, receipts from PayPal.

Technically, I would think it fairly trivial for the bank to encrypt this notification using my public key. Is there anything I've overlooked in coming to that conclusion?

Answer 1

Key management is the primary challenge and barrier for peer-to-peer like implementation of encryption (be it email or otherwise). There are companies (like Zixcorp) that simplify data protection for larger organizations. Zixcorp is more commonly used in healthcare than banking.

Other vendors such as Messagelabs, Websense, and other email security gateway vendors offer similar functionality to Zix where the user receives notification of a message and clicks a link to retrieve the message. This eliminates key management by forcing the user to retrieve the message through a secured channel - still subject to attack and forgery, but such a method is still in use).

Fundamentally, organizations that need to send sensitive information have several options based on their philosophy on customer communication. Forcing users to connect to their servers to retrieve notifications simplifies the communication stream by reducing the "hops" involved as well as minimizing liability by centralizing data storage. For example, if a bank uses Zix, GPG keys, or some other method via a 3rd party to send out communication, there's overhead costs tied to risk of the 3rd party. In the case of GPG keys, what if the bank screws up and sends your info to someone else using the recipients GPG keys? Such an event is easily possible - I still receive payment and account notifications from a big auto financing company after I sold my car to someone else.

By centralizing communication, it's much easier for a bank to protect the data and reduce liability.

Answer 2

I think it's the lack of widespread usage. I can't think of any technical reason that your bank or any other party couldn't send automated, encrypted emails to you, simply instead I think it's that so few people use any form of encrypted email (and therefore most of the public don't have public keys) that from their point of view it's not worth considering.

Next question is obviously 'How can we provide a secure email setup for the masses, without having to teach them the (apparently too complicated) basics of GPG?'

Answer 3

(I think you are really asking about signing the email, not encrypting it. Signing is the relevant cryptographic primitive, since you want to verify the origin of the email.)

Overview. It is far from trivial for the bank to send all of its customers signed email. There are three major challenges:

• Deployment. Many users' email clients don't support signature verification, so this would have no value for them.

• Key management. How do users get their bank's public key, in a way that isn't subject to spoofing? These issues are not trivial.

• Usability. Finally, the most serious issue: signed email is not usable by average users. It is horrifically confusing for end users. Apart from the fact that any security mechanism that isn't usable, won't have much benefit to security -- just think of all the help desk calls the bank is going to get about this. Each help desk call probably costs the bank $20-40, so that'd be a serious cost. Ouch.

Details. For more on this topic, I'd like to point you to some scientific papers in the research literature:

• Views, Reactions and Impact of Digitally-Signed Mail in e-Commerce. Simson L. Garfinkel, Jeffrey I. Schiller, Erik Nordlander, David Margrave, and Robert C. Miller. FC 2005.

• How to Make Secure Email Easier To Use. Simson L. Garfinkel, David Margrave, Jeffrey I. Schiller, Erik Nordlander, Robert C. Miller. CHI 2005.

• Johnny 2: A User Test of Key Continuity Management with S/MIME and Outlook Express. Simson L. Garfinkel, Robert C. Miller. SOUPS 2005.

For instance, the last work shows that something like 20-50% of users fail to use signed email securely, and thus could be fooled by various attacks.