# Managing Access to Confidential Documents: A Case Study of an Email Security Tool
## 3 Related Work
### Sharing Confidential Information  
Users often need to share sensitive pieces of information, such as their social security number (SSN) and medical history, with trusted entities or possibly unknown recipients. Even though secure communication mediums are available, when privacy and security are considered minor factors, information will be shared without a formal security process [7; 26]. To investigate sensitive data-sharing practices, Dell [27] commissioned a global survey of 2608 professionals handling sensitive data at companies. The survey results showed that 72% of employees were willing to share sensitive, confidential, or regulated company information without proper data security protocols in place. Also, [PERSON] et al. [3] explored users' experiences with sending sensitive information via standard (unencrypted) email, which was the most common transmission method users used when they sent their sensitive documents, such as their financial information, health information, \begin{table}
\begin{tabular}{p{42.7 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Email Security Tool** & **Integration with Email Service Provider** & **Security Features** & **Threats** \\ \hline Private WebMail (Pwm) [21] & Yes, with Gmail via a browser extension & Automatic key management, end-to-end encryption & (1) An attacker that compromises the extension software (2) A malicious email service provider that impersonates the user or uses social engineering to obtain sensitive data \\ \hline Tutanota [22] & No, needs a separate website & Key pair generation, end-to-end encryption, digital signature & (1) A malicious email service provider that provides software to access the user’s data or to have their secure email account password guessed or stolen \\ \hline FGP (Mailvelope) [23] & Yes, with many providers via a browser extension & Key pair generation, end-to-end encryption, digital signature & (1) An attacker who gains access to the user’s email account could attempt to convince the user’s contacts to encrypt messages with the attacker’s public key instead of the user’s true public key \\ \hline ProtonMail [24] & Yes, with many providers & Key pair generation, end-to-end encryption, digital signature & (1) An attacker that compromises the software (2) A malicious email service provider that impersonates the user or uses social engineering to obtain sensitive data \\ \hline Gmail Confidential Mode (GCM) [25] & Yes, with Gmail & Email expiration time, revoke access, disable forwarding, recipient authentication & (1) Lack of end-to-end encryption (2) Screenshots and screen recording to save a copy of the document \\ \hline Virtru [12] & Yes, with Gmail via a browser extension & Automatic key management, end-to-end encryption, email expiration time, revoke access, recipient authentication, persistent file protection, disable forwarding, watermarking & (1) An attacker that compromises the extension software (2) A malicious email service provider that impersonates the user or uses social engineering to obtain sensitive data (3) Screenshots and screen recording to save a copy of the document \\ \hline \end{tabular}
\end{table} 
Table 1: Comparison of popular existing email security tools. and information related to their children. Users could share sensitive health information on social media (Facebook), which can negatively affect users' privacy [28; 29]. Recently, users have been using end-to-end encrypted messaging applications (e.g., Whatsapp or Signal) to communicate privately. However, many users believe that SMS is more secure than WhatsApp and that they are not targeted by government and special service surveillance [30]. Users' decisions are affected more by peer influence than secure messaging apps' security features [26]. Similarly, even though WhatsApp users were informed that their messages were end-to-end encrypted, the participants noticed it but failed to understand the implications correctly. In our study, we wanted to understand how users perceive sending and receiving an end-to-end encrypted email via Virtru.