Snail Mail Beats Email Any Day: On Effective Operator Security Notifications in the Internet
Max Maass, Marc-Pascal Clement, Matthias Hollick

TL;DR
This study compares traditional email notifications with mailed letters for alerting website operators about security issues, finding letters significantly improve remediation success, though detailed attack descriptions may reduce response rates.
Contribution
It introduces and evaluates the effectiveness of mailed letters as an alternative to emails for security notifications, highlighting the importance of contact method in remediation success.
Findings
Letters outperform emails in remediation rates by up to 25 percentage points.
Manually collected addresses greatly increase notification delivery success.
Detailed attack descriptions can negatively impact remediation responses.
Abstract
In the era of large-scale internet scanning, misconfigured websites are a frequent cause of data leaks and security incidents. Previous research has investigated sending automated email notifications to operators of insecure or compromised websites, but has often met with limited success due to challenges in address data quality, spam filtering, and operator distrust and disinterest. While several studies have investigated the design and phrasing of notification emails in a bid to increase their effectiveness, the use of other contact channels has remained almost completely unexplored due to the required effort and cost. In this paper, we investigate two methods to increase notification success: the use of letters as an alternative delivery medium, and the description of attack scenarios to incentivize remediation. We evaluate these factors as part of a notification campaign utilizing…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
