# Managing Access to Confidential Documents: A Case Study of an Email Security Tool
## 6 Discussion  
**Perceptions of the encryption concept.** End-to-end encryption is still rarely used by non-expert users, even in target groups such as journalists [41]. In our study, most participants professed awareness of encryption technology, but they did not understand how it works (Section 5.1). However, many users still believed that no one could access their email through Google or a third party. Misconceptions were still present. For instance, P10 commented, _\"Because I think it's TLS encrypted, and I think it's end-to-end encrypted. Anyone in between, like any person that's staying in the middle, I think, he or she won't be able to extract the information.\"_ The user might have a misunderstanding between point-to-point encryption and end-to-end encryption because Virtru hides the underlying encryption process. The majority of our participants showed their general understanding of the encryption objective, whereas a few participants used technical words to describe the encryption concept, which suggests that they have partially correct mental models of end-to-end encryption. Therefore, the lack of our participants' understanding of the encryption process is still a problem, which confirms the findings of previous studies [30; 36; 42]. Educating users about how encryption works with an accurate model is a challenging task. The researchers in [36] recommended aligning communication efforts and designs with the functional models of encryption that users already possess.  
**Interaction with encrypted emails.** Before providing our participants with details about the security tool, most of them had negative impressions when they first saw this encrypted email by stating that it seemed suspicious or like a spam or phishing email, particularly if it came from an unknown entity, whereas those who had a positive impression felt safe since it seemed secure, required users to verify themselves before unlocking the encrypted message, and had a friendly interface. Even though Virtru has good usability [13], improving the usability of encryption is not enough. There is a need to improve risk communication that can be delivered to users about encryption. Our participants were introduced to the importance of utilizing end-to-end encrypted email (via video) to help them understand the benefits of using encrypted emails. When the participants composed an encrypted email for the first time, no one faced any difficulties after watching the video. They were comfortable using security features (e.g., setting an expiration time and disabling forwarding). We also found strong evidence that our participants were more satisfied when they shared their medical, tax, and employee personal information via end-to-end encrypted email (secure email) rather than regular email. Also, they were more concerned about sharing their sensitive information via regular email without using secure email. These findings confirm prior work [43; 44; 45] by providing evidence of the effectiveness of video-based risk communication on users' risk perceptions and actual behavior in the security context.  
**Expectations from the recipient.** Previous research [46] has shown that users are most concerned about controlling their emails' permanence (ephemerality), which limits their ability to control how their sensitive information would be used. Our participants found the expiration date feature in the encrypted email useful, along with other security features, to limit access to their medical, tax, and employee information to a specific period. However, when we asked them whether they thought the emails they sent could be misused if they set a longer expiration date, such as a year, our participants did not trust the recipients' attitudes as they could take screenshots of their information, or the recipients' email accounts could be hacked. Overall, they were more concerned about data leaks from recipients' devices rather than from the sender's account, which confirms existing findings [3].