Delivered-To: dfarber+@xxxxxxxxxxxxxxxxxx
Date: Sun, 23 Nov 2003 11:09:56 -0600
From: Don Norman <norman@xxxxxxxxxxx>
Subject: Are there statistics regarding the safety of email?
To: dave@xxxxxxxxxx
Organization: Nielsen Norman group
As a long-time reader of multiple lists and student of human behavior, I
have recently found myself in a debate about the real (not theoretical)
safety of information enclosed within email (and to a lesser extent, between
an Instant message being sent between two people).
Any Farberonians have data? Not opinions, data.
Here is the issue.
We all know that both email and IM is sent unencrypted. Anyone with a
sniffer could read the contents. Hence, the common statement that one should
never send social security numbers, credit card information, and other
private data in these ways.
But what are the facts? I have read numerous accounts of thefts, identity
theft, and break-ins, but all involved various break-ins, Trojan-horses, or
other deceptions. I have never (yet) read of thefts by sniffing -- with the
exception of targeting cases, where one person deliberately spied upon
another. But here, I am talking about the likelihood that some people might
monitor a large stream of email or IM in the hopes of collecting personal
data.
Are there any data of misappropriation of personal email through sniffing or
other means of reading unencrypted email or Instant Messaging?
My suspicion is that, despite the openness of the transmission, it is in
reality reasonably safe.
So what are the data?
Don Norman. Nielsen Norman Group http://www.nngroup.com
norman@xxxxxxxxxxx http://www.jnd.org
Prof. Computer Science and Psychology, Northwestern University