Usability of WKD

Criteria for implementing WKD with a good usability

In a bachelor thesis two use cases were developed which describe how users who don't have much experience with encryption can encrypt emails or check signatures with little effort and a good usability.
These use cases are used to name criteria which help developers to improve the usability of their products. They are also useful when it comes to a comparison between the usability of different products.
WKD-keys have a basic trust because they are fetched from WKD-servers that belong to email-providers. Reasons for that are that email-provider know that a pubkey belongs to an email-address and that email-providers usually have a higher security level than private persons who maintain a server. Some criteria reflect this basic trust of WKD-keys.

• C1: The product supports the direct method of WKD
• C2: The product supports the advanced method of WKD
• C3: The product is ready for WKD without any preparations after a clean installation
• C4: WKD is offered in the area where users enter an email-address. To fulfill this criterion it's sufficient that there is a button to start a key lookup. It's not necessary that WKD will be executed automatically. But, users shouldn't have to open more than one additional window.
• C5: WKD is offered in the area where users check the signature of an email. Like for K3 users shouldn't have to open more than one additional window.
• C6: The product uses WKD automatically when users enter an email-address in the area where they can compose an email. The users do not have to press a button to retrieve a key via WKD.
• C7: When the product has access to keys which were directly imported and don't contain any information about their trust and a WKD-key it should automatically use the WKD-key (in the area to compose an email).
• C8: When the product has access to keys which were directly imported and don't contain any information about their trust and a WKD-key it should automatically use the WKD-key (in the area to check the signature of an email).
• C9: The product distinguishes between keys without any information about their trust and keys that have at least a basic trust (e.g. WKD-keys or marginal valid keys in the web of trust) and displays this difference in the area to compose an email. In this criterion it doesn't matter, how the trust is calculated.
• C10: The product distinguishes between keys without any information about their trust and keys that have at least a basic trust (e.g. WKD-keys or marginal valid keys in the web of trust) and displays this difference in the area to check the signature of an email. In this criterion it doesn't matter, how the trust is calculated.
• C11: Displays that WKD-keys have a basic trust (compose).
• C12: Displays that WKD-keys have a basic trust (check of signature).
• C13: Displays different levels of trust (compose).
• C14: Displays different levels of trust (check of signature).

Usability of different products

Balsa

Tested version: 2.6.3

Claws Mail

Tested version: 3.18.0/4.0.0

FairEmail

Tested version: 1.1776

K9Mail

Tested version: 5.806

KMail

Tested version: 5.18.3

Mailvelope

Tested version: 4.4.1

GpgOL (Outlook)

Tested version: 2.5.1

Thunderbird

Tested version: 97.0a1